{"schema_version":"2","view":"grouped","data":[{"id":70970,"cve_ids":["CVE-2024-44981","CVE-2024-57841","CVE-2025-38469","CVE-2025-40022","CVE-2025-68179","CVE-2025-68214","CVE-2025-71104","CVE-2026-23210","CVE-2026-23230","CVE-2026-23451","CVE-2026-23454","CVE-2026-31502","CVE-2026-43147","CVE-2026-43456","CVE-2026-45968","CVE-2026-52910","CVE-2026-52912","CVE-2026-52929","CVE-2026-52977","CVE-2026-52994","CVE-2026-53059","CVE-2026-53110","CVE-2026-53163","CVE-2026-53260","CVE-2026-53264","CVE-2026-53365","CVE-2026-53366","CVE-2026-53381","CVE-2026-63801","CVE-2026-63823","CVE-2026-63827","CVE-2026-63879","CVE-2026-63881","CVE-2026-63886","CVE-2026-63887","CVE-2026-63888","CVE-2026-63920","CVE-2026-63944","CVE-2026-63970","CVE-2026-63972","CVE-2026-63973","CVE-2026-63992","CVE-2026-64000","CVE-2026-64002","CVE-2026-64007","CVE-2026-64010","CVE-2026-64011","CVE-2026-64015","CVE-2026-64018","CVE-2026-64029","CVE-2026-64034","CVE-2026-64048","CVE-2026-64098","CVE-2026-64109","CVE-2026-64114","CVE-2026-64115","CVE-2026-64121","CVE-2026-64217","CVE-2026-64247","CVE-2026-64266","CVE-2026-64268","CVE-2026-64304","CVE-2026-64312","CVE-2026-64355","CVE-2026-64383","CVE-2026-64384","CVE-2026-64385","CVE-2026-64386","CVE-2026-64387","CVE-2026-64423","CVE-2026-64450","CVE-2026-64481","CVE-2026-64524","CVE-2026-64527","CVE-2026-64541","CVE-2026-64543","CVE-2026-64562","CVE-2026-64563","CVE-2026-64572","CVE-2026-64577","CVE-2026-64581","CVE-2026-64593","CVE-2026-68121","CVE-2026-68133","CVE-2026-68136","CVE-2026-68138","CVE-2026-68155","CVE-2026-68158","CVE-2026-68159","CVE-2026-68160","CVE-2026-68202","CVE-2026-68397","CVE-2026-68398","CVE-2026-68417","CVE-2026-68426","CVE-2026-68428","CVE-2026-68480","CVE-2026-72020","CVE-2026-72069","CVE-2026-72072","CVE-2026-72083","CVE-2026-72084","CVE-2026-72123","CVE-2026-72135","CVE-2026-72221","CVE-2026-72222","CVE-2026-72251","CVE-2026-72262","CVE-2026-72288","CVE-2026-72289","CVE-2026-72317","CVE-2026-72339","CVE-2026-72389","CVE-2026-74345","CVE-2026-74377","CVE-2026-74378","CVE-2026-74390","CVE-2026-74394","CVE-2026-74454","CVE-2026-74488","CVE-2026-74496","CVE-2026-74516","CVE-2026-74518","CVE-2026-74537","CVE-2026-74556","CVE-2026-74581","CVE-2026-74582","CVE-2026-74612","CVE-2026-74669","CVE-2026-74695","CVE-2026-80722"],"payload":{"kind":"advisory","title":"Security update for the Linux Kernel","summary":"The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731). - CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225). - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604). - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072). - CVE-2026-43147: Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (bsc#1264642). - CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734). - CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023). - CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659). - CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000). - CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004). - CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242). - CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126). - CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655). - CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985). - CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqu","evidence":"osv:SUSE-SU-2026:4369-1","products":[{"name":{"value":"kernel-default","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-livepatch-SLE15-SP6_Update_31","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1-150600.13.3.4","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-64kb","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1.150600.12.62.4","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-zfcpdump","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1.150600.12.62.4","evidence":"/affected/12/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/13/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/13/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/14/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/14/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/15/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/15/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/16/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/16/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4369-1","aliases":["SUSE-SU-2026:4369-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.135.1","kernel-default-livepatch-devel":"6.4.0-150600.23.135.1","kernel-livepatch-6_4_0-150600_23_135-default":"1-150600.13.3.4"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.3.4"}]}],"package":{"name":"kernel-livepatch-SLE15-SP6_Update_31","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_31&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.135.1","kernel-default-livepatch-devel":"6.4.0-150600.23.135.1","kernel-livepatch-6_4_0-150600_23_135-default":"1-150600.13.3.4"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-64kb","purl":"pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-zfcpdump","purl":"pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}}],"modified":"2026-10-02T18:42:50.599983491Z","provider":"osv","upstream":["CVE-2024-44981","CVE-2024-57841","CVE-2025-38469","CVE-2025-40022","CVE-2025-68179","CVE-2025-68214","CVE-2025-71104","CVE-2026-23210","CVE-2026-23230","CVE-2026-23451","CVE-2026-23454","CVE-2026-31502","CVE-2026-43147","CVE-2026-43456","CVE-2026-45968","CVE-2026-52910","CVE-2026-52912","CVE-2026-52929","CVE-2026-52977","CVE-2026-52994","CVE-2026-53059","CVE-2026-53110","CVE-2026-53163","CVE-2026-53260","CVE-2026-53264","CVE-2026-53365","CVE-2026-53366","CVE-2026-53381","CVE-2026-63801","CVE-2026-63823","CVE-2026-63827","CVE-2026-63879","CVE-2026-63881","CVE-2026-63886","CVE-2026-63887","CVE-2026-63888","CVE-2026-63920","CVE-2026-63944","CVE-2026-63970","CVE-2026-63972","CVE-2026-63973","CVE-2026-63992","CVE-2026-64000","CVE-2026-64002","CVE-2026-64007","CVE-2026-64010","CVE-2026-64011","CVE-2026-64015","CVE-2026-64018","CVE-2026-64029","CVE-2026-64034","CVE-2026-64048","CVE-2026-64098","CVE-2026-64109","CVE-2026-64114","CVE-2026-64115","CVE-2026-64121","CVE-2026-64217","CVE-2026-64247","CVE-2026-64266","CVE-2026-64268","CVE-2026-64304","CVE-2026-64312","CVE-2026-64355","CVE-2026-64383","CVE-2026-64384","CVE-2026-64385","CVE-2026-64386","CVE-2026-64387","CVE-2026-64423","CVE-2026-64450","CVE-2026-64481","CVE-2026-64524","CVE-2026-64527","CVE-2026-64541","CVE-2026-64543","CVE-2026-64562","CVE-2026-64563","CVE-2026-64572","CVE-2026-64577","CVE-2026-64581","CVE-2026-64593","CVE-2026-68121","CVE-2026-68133","CVE-2026-68136","CVE-2026-68138","CVE-2026-68155","CVE-2026-68158","CVE-2026-68159","CVE-2026-68160","CVE-2026-68202","CVE-2026-68397","CVE-2026-68398","CVE-2026-68417","CVE-2026-68426","CVE-2026-68428","CVE-2026-68480","CVE-2026-72020","CVE-2026-72069","CVE-2026-72072","CVE-2026-72083","CVE-2026-72084","CVE-2026-72123","CVE-2026-72135","CVE-2026-72221","CVE-2026-72222","CVE-2026-72251","CVE-2026-72262","CVE-2026-72288","CVE-2026-72289","CVE-2026-72317","CVE-2026-72339","CVE-2026-72389","CVE-2026-74345","CVE-2026-74377","CVE-2026-74378","CVE-2026-74390","CVE-2026-74394","CVE-2026-74454","CVE-2026-74488","CVE-2026-74496","CVE-2026-74516","CVE-2026-74518","CVE-2026-74537","CVE-2026-74556","CVE-2026-74581","CVE-2026-74582","CVE-2026-74612","CVE-2026-74669","CVE-2026-74695","CVE-2026-80722"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264369-1/","https://bugzilla.suse.com/1230238","https://bugzilla.suse.com/1235944","https://bugzilla.suse.com/1247455","https://bugzilla.suse.com/1250748","https://bugzilla.suse.com/1252682","https://bugzilla.suse.com/1254306","https://bugzilla.suse.com/1255225","https://bugzilla.suse.com/1255250","https://bugzilla.suse.com/1256708","https://bugzilla.suse.com/1257154","https://bugzilla.suse.com/1258430","https://bugzilla.suse.com/1258517","https://bugzilla.suse.com/1260522","https://bugzilla.suse.com/1261604","https://bugzilla.suse.com/1261780","https://bugzilla.suse.com/1263072","https://bugzilla.suse.com/1264642","https://bugzilla.suse.com/1264734","https://bugzilla.suse.com/1265449","https://bugzilla.suse.com/1265928","https://bugzilla.suse.com/1266402","https://bugzilla.suse.com/1267023","https://bugzilla.suse.com/1268659","https://bugzilla.suse.com/1269000","https://bugzilla.suse.com/1269004","https://bugzilla.suse.com/1269126","https://bugzilla.suse.com/1269238","https://bugzilla.suse.com/1269242","https://bugzilla.suse.com/1269306","https://bugzilla.suse.com/1269655","https://bugzilla.suse.com/1269731","https://bugzilla.suse.com/1269792","https://bugzilla.suse.com/1269981","https://bugzilla.suse.com/1269985","https://bugzilla.suse.com/1271365","https://bugzilla.suse.com/1271366","https://bugzilla.suse.com/1271830","https://bugzilla.suse.com/1272179","https://bugzilla.suse.com/1272182","https://bugzilla.suse.com/1272230","https://bugzilla.suse.com/1272381","https://bugzilla.suse.com/1272385","https://bugzilla.suse.com/1272390","https://bugzilla.suse.com/1272569","https://bugzilla.suse.com/1272571","https://bugzilla.suse.com/1272662","https://bugzilla.suse.com/1272673","https://bugzilla.suse.com/1272680","https://bugzilla.suse.com/1272682","https://bugzilla.suse.com/1272756","https://bugzilla.suse.com/1272798","https://bugzilla.suse.com/1272868","https://bugzilla.suse.com/1272877","https://bugzilla.suse.com/1273030","https://bugzilla.suse.com/1273053","https://bugzilla.suse.com/1273054","https://bugzilla.suse.com/1273105","https://bugzilla.suse.com/1273276","https://bugzilla.suse.com/1273303","https://bugzilla.suse.com/1273311","https://bugzilla.suse.com/1273422","https://bugzilla.suse.com/1273426","https://bugzilla.suse.com/1273484","https://bugzilla.suse.com/1273488","https://bugzilla.suse.com/1273523","https://bugzilla.suse.com/1273555","https://bugzilla.suse.com/1273578","https://bugzilla.suse.com/1273742","https://bugzilla.suse.com/1273743","https://bugzilla.suse.com/1273745","https://bugzilla.suse.com/1273748","https://bugzilla.suse.com/1273762","https://bugzilla.suse.com/1273766","https://bugzilla.suse.com/1273774","https://bugzilla.suse.com/1273869","https://bugzilla.suse.com/1273882","https://bugzilla.suse.com/1273891","https://bugzilla.suse.com/1273903","https://bugzilla.suse.com/1273930","https://bugzilla.suse.com/1273944","https://bugzilla.suse.com/1273968","https://bugzilla.suse.com/1273995","https://bugzilla.suse.com/1274014","https://bugzilla.suse.com/1274031","https://bugzilla.suse.com/1274041","https://bugzilla.suse.com/1274208","https://bugzilla.suse.com/1274226","https://bugzilla.suse.com/1274274","https://bugzilla.suse.com/1274497","https://bugzilla.suse.com/1274539","https://bugzilla.suse.com/1274541","https://bugzilla.suse.com/1274543","https://bugzilla.suse.com/1274545","https://bugzilla.suse.com/1274547","https://bugzilla.suse.com/1274550","https://bugzilla.suse.com/1274620","https://bugzilla.suse.com/1274696","https://bugzilla.suse.com/1274699","https://bugzilla.suse.com/1274705","https://bugzilla.suse.com/1274752","https://bugzilla.suse.com/1274753","https://bugzilla.suse.com/1274754","https://bugzilla.suse.com/1274888","https://bugzilla.suse.com/1274898","https://bugzilla.suse.com/1274902","https://bugzilla.suse.com/1274908","https://bugzilla.suse.com/1274941","https://bugzilla.suse.com/1275161","https://bugzilla.suse.com/1275304","https://bugzilla.suse.com/1275307","https://bugzilla.suse.com/1275470","https://bugzilla.suse.com/1275472","https://bugzilla.suse.com/1275474","https://bugzilla.suse.com/1275506","https://bugzilla.suse.com/1275528","https://bugzilla.suse.com/1275535","https://bugzilla.suse.com/1275540","https://bugzilla.suse.com/1275555","https://bugzilla.suse.com/1275665","https://bugzilla.suse.com/1275669","https://bugzilla.suse.com/1275687","https://bugzilla.suse.com/1275696","https://bugzilla.suse.com/1275782","https://bugzilla.suse.com/1275784","https://bugzilla.suse.com/1275797","https://bugzilla.suse.com/1275798","https://bugzilla.suse.com/1275827","https://bugzilla.suse.com/1275867","https://bugzilla.suse.com/1275886","https://bugzilla.suse.com/1275905","https://bugzilla.suse.com/1275925","https://bugzilla.suse.com/1276006","https://bugzilla.suse.com/1276350","https://bugzilla.suse.com/1276665","https://bugzilla.suse.com/1276931","https://bugzilla.suse.com/1277073","https://bugzilla.suse.com/1277155","https://bugzilla.suse.com/1277254","https://bugzilla.suse.com/1277285","https://bugzilla.suse.com/1277391","https://bugzilla.suse.com/1277408","https://bugzilla.suse.com/1277505","https://bugzilla.suse.com/1277523","https://bugzilla.suse.com/1277571","https://bugzilla.suse.com/1277678","https://bugzilla.suse.com/1277860","https://bugzilla.suse.com/1278088","https://bugzilla.suse.com/1278233","https://bugzilla.suse.com/1278236","https://bugzilla.suse.com/1279813","https://www.suse.com/security/cve/CVE-2024-44981","https://www.suse.com/security/cve/CVE-2024-57841","https://www.suse.com/security/cve/CVE-2025-38469","https://www.suse.com/security/cve/CVE-2025-40022","https://www.suse.com/security/cve/CVE-2025-68179","https://www.suse.com/security/cve/CVE-2025-68214","https://www.suse.com/security/cve/CVE-2025-71104","https://www.suse.com/security/cve/CVE-2026-23210","https://www.suse.com/security/cve/CVE-2026-23230","https://www.suse.com/security/cve/CVE-2026-23451","https://www.suse.com/security/cve/CVE-2026-23454","https://www.suse.com/security/cve/CVE-2026-31502","https://www.suse.com/security/cve/CVE-2026-43147","https://www.suse.com/security/cve/CVE-2026-43456","https://www.suse.com/security/cve/CVE-2026-45968","https://www.suse.com/security/cve/CVE-2026-52910","https://www.suse.com/security/cve/CVE-2026-52912","https://www.suse.com/security/cve/CVE-2026-52929","https://www.suse.com/security/cve/CVE-2026-52977","https://www.suse.com/security/cve/CVE-2026-52994","https://www.suse.com/security/cve/CVE-2026-53059","https://www.suse.com/security/cve/CVE-2026-53110","https://www.suse.com/security/cve/CVE-2026-53163","https://www.suse.com/security/cve/CVE-2026-53260","https://www.suse.com/security/cve/CVE-2026-53264","https://www.suse.com/security/cve/CVE-2026-53365","https://www.suse.com/security/cve/CVE-2026-53366","https://www.suse.com/security/cve/CVE-2026-53381","https://www.suse.com/security/cve/CVE-2026-63801","https://www.suse.com/security/cve/CVE-2026-63823","https://www.suse.com/security/cve/CVE-2026-63827","https://www.suse.com/security/cve/CVE-2026-63879","https://www.suse.com/security/cve/CVE-2026-63881","https://www.suse.com/security/cve/CVE-2026-63886","https://www.suse.com/security/cve/CVE-2026-63887","https://www.suse.com/security/cve/CVE-2026-63888","https://www.suse.com/security/cve/CVE-2026-63920","https://www.suse.com/security/cve/CVE-2026-63944","https://www.suse.com/security/cve/CVE-2026-63970","https://www.suse.com/security/cve/CVE-2026-63972","https://www.suse.com/security/cve/CVE-2026-63973","https://www.suse.com/security/cve/CVE-2026-63992","https://www.suse.com/security/cve/CVE-2026-64000","https://www.suse.com/security/cve/CVE-2026-64002","https://www.suse.com/security/cve/CVE-2026-64007","https://www.suse.com/security/cve/CVE-2026-64010","https://www.suse.com/security/cve/CVE-2026-64011","https://www.suse.com/security/cve/CVE-2026-64015","https://www.suse.com/security/cve/CVE-2026-64018","https://www.suse.com/security/cve/CVE-2026-64029","https://www.suse.com/security/cve/CVE-2026-64034","https://www.suse.com/security/cve/CVE-2026-64048","https://www.suse.com/security/cve/CVE-2026-64098","https://www.suse.com/security/cve/CVE-2026-64109","https://www.suse.com/security/cve/CVE-2026-64114","https://www.suse.com/security/cve/CVE-2026-64115","https://www.suse.com/security/cve/CVE-2026-64121","https://www.suse.com/security/cve/CVE-2026-64217","https://www.suse.com/security/cve/CVE-2026-64247","https://www.suse.com/security/cve/CVE-2026-64266","https://www.suse.com/security/cve/CVE-2026-64268","https://www.suse.com/security/cve/CVE-2026-64304","https://www.suse.com/security/cve/CVE-2026-64312","https://www.suse.com/security/cve/CVE-2026-64355","https://www.suse.com/security/cve/CVE-2026-64383","https://www.suse.com/security/cve/CVE-2026-64384","https://www.suse.com/security/cve/CVE-2026-64385","https://www.suse.com/security/cve/CVE-2026-64386","https://www.suse.com/security/cve/CVE-2026-64387","https://www.suse.com/security/cve/CVE-2026-64423","https://www.suse.com/security/cve/CVE-2026-64450","https://www.suse.com/security/cve/CVE-2026-64481","https://www.suse.com/security/cve/CVE-2026-64524","https://www.suse.com/security/cve/CVE-2026-64527","https://www.suse.com/security/cve/CVE-2026-64541","https://www.suse.com/security/cve/CVE-2026-64543","https://www.suse.com/security/cve/CVE-2026-64562","https://www.suse.com/security/cve/CVE-2026-64563","https://www.suse.com/security/cve/CVE-2026-64572","https://www.suse.com/security/cve/CVE-2026-64577","https://www.suse.com/security/cve/CVE-2026-64581","https://www.suse.com/security/cve/CVE-2026-64593","https://www.suse.com/security/cve/CVE-2026-68121","https://www.suse.com/security/cve/CVE-2026-68133","https://www.suse.com/security/cve/CVE-2026-68136","https://www.suse.com/security/cve/CVE-2026-68138","https://www.suse.com/security/cve/CVE-2026-68155","https://www.suse.com/security/cve/CVE-2026-68158","https://www.suse.com/security/cve/CVE-2026-68159","https://www.suse.com/security/cve/CVE-2026-68160","https://www.suse.com/security/cve/CVE-2026-68202","https://www.suse.com/security/cve/CVE-2026-68397","https://www.suse.com/security/cve/CVE-2026-68398","https://www.suse.com/security/cve/CVE-2026-68417","https://www.suse.com/security/cve/CVE-2026-68426","https://www.suse.com/security/cve/CVE-2026-68428","https://www.suse.com/security/cve/CVE-2026-68480","https://www.suse.com/security/cve/CVE-2026-72020","https://www.suse.com/security/cve/CVE-2026-72069","https://www.suse.com/security/cve/CVE-2026-72072","https://www.suse.com/security/cve/CVE-2026-72083","https://www.suse.com/security/cve/CVE-2026-72084","https://www.suse.com/security/cve/CVE-2026-72123","https://www.suse.com/security/cve/CVE-2026-72135","https://www.suse.com/security/cve/CVE-2026-72221","https://www.suse.com/security/cve/CVE-2026-72222","https://www.suse.com/security/cve/CVE-2026-72251","https://www.suse.com/security/cve/CVE-2026-72262","https://www.suse.com/security/cve/CVE-2026-72288","https://www.suse.com/security/cve/CVE-2026-72289","https://www.suse.com/security/cve/CVE-2026-72317","https://www.suse.com/security/cve/CVE-2026-72339","https://www.suse.com/security/cve/CVE-2026-72389","https://www.suse.com/security/cve/CVE-2026-74345","https://www.suse.com/security/cve/CVE-2026-74377","https://www.suse.com/security/cve/CVE-2026-74378","https://www.suse.com/security/cve/CVE-2026-74390","https://www.suse.com/security/cve/CVE-2026-74394","https://www.suse.com/security/cve/CVE-2026-74454","https://www.suse.com/security/cve/CVE-2026-74488","https://www.suse.com/security/cve/CVE-2026-74496","https://www.suse.com/security/cve/CVE-2026-74516","https://www.suse.com/security/cve/CVE-2026-74518","https://www.suse.com/security/cve/CVE-2026-74537","https://www.suse.com/security/cve/CVE-2026-74556","https://www.suse.com/security/cve/CVE-2026-74581","https://www.suse.com/security/cve/CVE-2026-74582","https://www.suse.com/security/cve/CVE-2026-74612","https://www.suse.com/security/cve/CVE-2026-74669","https://www.suse.com/security/cve/CVE-2026-74695","https://www.suse.com/security/cve/CVE-2026-80722"]},"related_cves":[{"value":"CVE-2024-44981","evidence":"/upstream"},{"value":"CVE-2024-57841","evidence":"/upstream"},{"value":"CVE-2025-38469","evidence":"/upstream"},{"value":"CVE-2025-40022","evidence":"/upstream"},{"value":"CVE-2025-68179","evidence":"/upstream"},{"value":"CVE-2025-68214","evidence":"/upstream"},{"value":"CVE-2025-71104","evidence":"/upstream"},{"value":"CVE-2026-23210","evidence":"/upstream"},{"value":"CVE-2026-23230","evidence":"/upstream"},{"value":"CVE-2026-23451","evidence":"/upstream"},{"value":"CVE-2026-23454","evidence":"/upstream"},{"value":"CVE-2026-31502","evidence":"/upstream"},{"value":"CVE-2026-43147","evidence":"/upstream"},{"value":"CVE-2026-43456","evidence":"/upstream"},{"value":"CVE-2026-45968","evidence":"/upstream"},{"value":"CVE-2026-52910","evidence":"/upstream"},{"value":"CVE-2026-52912","evidence":"/upstream"},{"value":"CVE-2026-52929","evidence":"/upstream"},{"value":"CVE-2026-52977","evidence":"/upstream"},{"value":"CVE-2026-52994","evidence":"/upstream"},{"value":"CVE-2026-53059","evidence":"/upstream"},{"value":"CVE-2026-53110","evidence":"/upstream"},{"value":"CVE-2026-53163","evidence":"/upstream"},{"value":"CVE-2026-53260","evidence":"/upstream"},{"value":"CVE-2026-53264","evidence":"/upstream"},{"value":"CVE-2026-53365","evidence":"/upstream"},{"value":"CVE-2026-53366","evidence":"/upstream"},{"value":"CVE-2026-53381","evidence":"/upstream"},{"value":"CVE-2026-63801","evidence":"/upstream"},{"value":"CVE-2026-63823","evidence":"/upstream"},{"value":"CVE-2026-63827","evidence":"/upstream"},{"value":"CVE-2026-63879","evidence":"/upstream"},{"value":"CVE-2026-63881","evidence":"/upstream"},{"value":"CVE-2026-63886","evidence":"/upstream"},{"value":"CVE-2026-63887","evidence":"/upstream"},{"value":"CVE-2026-63888","evidence":"/upstream"},{"value":"CVE-2026-63920","evidence":"/upstream"},{"value":"CVE-2026-63944","evidence":"/upstream"},{"value":"CVE-2026-63970","evidence":"/upstream"},{"value":"CVE-2026-63972","evidence":"/upstream"},{"value":"CVE-2026-63973","evidence":"/upstream"},{"value":"CVE-2026-63992","evidence":"/upstream"},{"value":"CVE-2026-64000","evidence":"/upstream"},{"value":"CVE-2026-64002","evidence":"/upstream"},{"value":"CVE-2026-64007","evidence":"/upstream"},{"value":"CVE-2026-64010","evidence":"/upstream"},{"value":"CVE-2026-64011","evidence":"/upstream"},{"value":"CVE-2026-64015","evidence":"/upstream"},{"value":"CVE-2026-64018","evidence":"/upstream"},{"value":"CVE-2026-64029","evidence":"/upstream"},{"value":"CVE-2026-64034","evidence":"/upstream"},{"value":"CVE-2026-64048","evidence":"/upstream"},{"value":"CVE-2026-64098","evidence":"/upstream"},{"value":"CVE-2026-64109","evidence":"/upstream"},{"value":"CVE-2026-64114","evidence":"/upstream"},{"value":"CVE-2026-64115","evidence":"/upstream"},{"value":"CVE-2026-64121","evidence":"/upstream"},{"value":"CVE-2026-64217","evidence":"/upstream"},{"value":"CVE-2026-64247","evidence":"/upstream"},{"value":"CVE-2026-64266","evidence":"/upstream"},{"value":"CVE-2026-64268","evidence":"/upstream"},{"value":"CVE-2026-64304","evidence":"/upstream"},{"value":"CVE-2026-64312","evidence":"/upstream"},{"value":"CVE-2026-64355","evidence":"/upstream"},{"value":"CVE-2026-64383","evidence":"/upstream"},{"value":"CVE-2026-64384","evidence":"/upstream"},{"value":"CVE-2026-64385","evidence":"/upstream"},{"value":"CVE-2026-64386","evidence":"/upstream"},{"value":"CVE-2026-64387","evidence":"/upstream"},{"value":"CVE-2026-64423","evidence":"/upstream"},{"value":"CVE-2026-64450","evidence":"/upstream"},{"value":"CVE-2026-64481","evidence":"/upstream"},{"value":"CVE-2026-64524","evidence":"/upstream"},{"value":"CVE-2026-64527","evidence":"/upstream"},{"value":"CVE-2026-64541","evidence":"/upstream"},{"value":"CVE-2026-64543","evidence":"/upstream"},{"value":"CVE-2026-64562","evidence":"/upstream"},{"value":"CVE-2026-64563","evidence":"/upstream"},{"value":"CVE-2026-64572","evidence":"/upstream"},{"value":"CVE-2026-64577","evidence":"/upstream"},{"value":"CVE-2026-64581","evidence":"/upstream"},{"value":"CVE-2026-64593","evidence":"/upstream"},{"value":"CVE-2026-68121","evidence":"/upstream"},{"value":"CVE-2026-68133","evidence":"/upstream"},{"value":"CVE-2026-68136","evidence":"/upstream"},{"value":"CVE-2026-68138","evidence":"/upstream"},{"value":"CVE-2026-68155","evidence":"/upstream"},{"value":"CVE-2026-68158","evidence":"/upstream"},{"value":"CVE-2026-68159","evidence":"/upstream"},{"value":"CVE-2026-68160","evidence":"/upstream"},{"value":"CVE-2026-68202","evidence":"/upstream"},{"value":"CVE-2026-68397","evidence":"/upstream"},{"value":"CVE-2026-68398","evidence":"/upstream"},{"value":"CVE-2026-68417","evidence":"/upstream"},{"value":"CVE-2026-68426","evidence":"/upstream"},{"value":"CVE-2026-68428","evidence":"/upstream"},{"value":"CVE-2026-68480","evidence":"/upstream"},{"value":"CVE-2026-72020","evidence":"/upstream"},{"value":"CVE-2026-72069","evidence":"/upstream"},{"value":"CVE-2026-72072","evidence":"/upstream"},{"value":"CVE-2026-72083","evidence":"/upstream"},{"value":"CVE-2026-72084","evidence":"/upstream"},{"value":"CVE-2026-72123","evidence":"/upstream"},{"value":"CVE-2026-72135","evidence":"/upstream"},{"value":"CVE-2026-72221","evidence":"/upstream"},{"value":"CVE-2026-72222","evidence":"/upstream"},{"value":"CVE-2026-72251","evidence":"/upstream"},{"value":"CVE-2026-72262","evidence":"/upstream"},{"value":"CVE-2026-72288","evidence":"/upstream"},{"value":"CVE-2026-72289","evidence":"/upstream"},{"value":"CVE-2026-72317","evidence":"/upstream"},{"value":"CVE-2026-72339","evidence":"/upstream"},{"value":"CVE-2026-72389","evidence":"/upstream"},{"value":"CVE-2026-74345","evidence":"/upstream"},{"value":"CVE-2026-74377","evidence":"/upstream"},{"value":"CVE-2026-74378","evidence":"/upstream"},{"value":"CVE-2026-74390","evidence":"/upstream"},{"value":"CVE-2026-74394","evidence":"/upstream"},{"value":"CVE-2026-74454","evidence":"/upstream"},{"value":"CVE-2026-74488","evidence":"/upstream"},{"value":"CVE-2026-74496","evidence":"/upstream"},{"value":"CVE-2026-74516","evidence":"/upstream"},{"value":"CVE-2026-74518","evidence":"/upstream"},{"value":"CVE-2026-74537","evidence":"/upstream"},{"value":"CVE-2026-74556","evidence":"/upstream"},{"value":"CVE-2026-74581","evidence":"/upstream"},{"value":"CVE-2026-74582","evidence":"/upstream"},{"value":"CVE-2026-74612","evidence":"/upstream"},{"value":"CVE-2026-74669","evidence":"/upstream"},{"value":"CVE-2026-74695","evidence":"/upstream"},{"value":"CVE-2026-80722","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ddb2c304-0ccc-4573-96b3-606b178f0dff","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-23230","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerability is in the SMB client code (fs/smb/client/). The race is triggered between processing a server's create response (setting is_open) and the server sending a lease break notification. A malicious SMB server can trigger this remotely over the network.\nAC:L - The attacker (malicious SMB server) controls when lease breaks are sent and can time them immediately after the create response. The attacker can retry many times across many directory opens, and the RMW race window is inherent to every bitfield write, making it reliably triggerable.\nPR:N - The attacker is the SMB server, requiring no privileges on the victim system. The lease break is processed as part of normal SMB protocol handling with no additional authentication check beyond the existing session.\nUI:R - The victim must mount an SMB share from the attacker's server (or a compromised server), which requires explicit user or administrator action.\nS:U - The vulnerability impacts the kernel where the SMB client runs; it does not cross a security boundary such as a VM or sandbox.\nC:H - The race can restore has_lease after the lease reference was dropped, leading to reference count corruption and use-after-free. UAF on heap objects gives the attacker read primitives over arbitrary kernel memory through heap spraying.\nI:H - The use-after-free from reference count corruption allows the attacker to reclaim the freed cached_fid object with controlled data, enabling arbitrary kernel write primitives and potential code execution.\nA:H - The reference count corruption and list corruption caused by the restored stale flags will lead to double-free, use-after-free, or list corruption, all of which reliably cause kernel panics/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-23230","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-31502","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the vulnerable team header_ops path by locally creating/enslaving network devices through rtnetlink and then triggering dev_hard_header()/dev_parse_header() via local packet/socket or network-stack activity on the malformed team device. The required setup is a local kernel networking configuration path rather than an unauthenticated packet-processing path.\nAC:L - The vulnerable topology, such as GRE -> bond -> team, is fully attacker-controlled once the required namespace capabilities are available, and triggering the bad callback is deterministic. There is no race or external timing condition required.\nPR:L - Creating team/bond/GRE devices and enslaving them requires CAP_NET_ADMIN, and packet sockets require CAP_NET_RAW, but both are available to an unprivileged user inside a user and network namespace on systems permitting unprivileged user namespaces. This is therefore low privileges, not real init-namespace root.\nUI:N - No victim interaction is required after the attacker has local access and namespace capabilities. The attacker can configure the devices and trigger the callback directly.\nS:U - The impact is within the same kernel security authority. This is a kernel crash/type-confusion or privilege-impact issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a header_ops type confusion where callbacks interpret team private data as another subsystem's private structure, causing attacker-influenced kernel pointer dereferences and potential kernel memory exposure. Following the higher-severity rule for type confusion, confidentiality impact is high.\nI:H - Type confusion in kernel callback dispatch can lead to misinterpreted object pointers and potentially control-flow or write-primitive exploitation beyond the observed crash. Kernel type confusion is scored as high integrity impact.\nA:H - The reported and expected failure mode is a kernel oops/BUG/crash when the inherited callback uses the wrong net_device private layout. This gives high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31502","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43456","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local rtnetlink/AF_PACKET operations: creating/enslaving a non-Ethernet slave to a bond and then causing `dev_hard_header()` on the bond device. Remote packets are not sufficient without the vulnerable local device configuration.\nAC:L - No race or special external timing is required; the attacker can deterministically create the bond/GRE setup and trigger the confused header callback. Required modules/configuration are common and autoloadable through rtnetlink in normal deployments.\nPR:L - The setup requires `CAP_NET_ADMIN` and the AF_PACKET trigger requires `CAP_NET_RAW`, but both are obtainable by an unprivileged local user inside a user/network namespace. Therefore this is low privilege rather than real init-namespace root only.\nUI:N - Exploitation does not require a victim user to perform an action. The attacker can perform the setup and trigger locally.\nS:U - The impact is within the kernel security authority on the same system. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug is kernel type confusion where bonding private data is interpreted as another device's private structure, and the confused callback can read kernel data using the wrong layout. Following the required higher-severity rule for type confusion, confidentiality impact is High.\nI:H - The confused header callback uses bogus private-data fields to construct and push protocol headers into an skb, making this a kernel memory/type confusion condition rather than a pure NULL dereference. Type confusion is scored as High integrity impact.\nA:H - The reported failure is a kernel BUG/oops in `pskb_expand_head()` reachable through the confused `ipgre_header()` call. This provides a reliable local kernel crash/DoS."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43456","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52910","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable attach/detach operation is reached through local `setsockopt()` on an `SO_REUSEPORT` socket with `SO_ATTACH_REUSEPORT_CBPF` or `SO_DETACH_REUSEPORT_BPF`. Although packet receive executes the stale program, the attacker-controlled trigger for freeing/replacing it is a local socket API path.\nAC:L - The race is attacker-controlled: a local attacker can create the UDP reuseport group, replace/detach the cBPF program, and concurrently send packets to drive `reuseport_select_sock()`. No rare external condition is required.\nPR:L - A basic unprivileged local user can create UDP sockets on an unprivileged port, set `SO_REUSEPORT`, and attach a classic reuseport BPF filter; this path does not require `CAP_NET_ADMIN`. User namespaces are not needed to make the path reachable.\nUI:N - No victim user action is required once the attacker runs the local reproducer. The attacker controls the sockets, the filter replacement, and the packet generation.\nS:U - The bug is a kernel memory lifetime error used for local kernel compromise or crash within the same host security authority. It does not cross a VM, IOMMU, or similar security boundary.\nC:H - This is a use-after-free of a `bpf_prog` object that is dereferenced after reclamation while selecting a reuseport socket. Per kernel CVSS guidance, UAFs are treated as enabling high confidentiality impact through potential kernel memory disclosure.\nI:H - The stale freed `bpf_prog` can be reused while the receive path reads and runs through the program object, making control-flow or data corruption plausible. Per kernel CVSS guidance, UAF memory corruption warrants high integrity impact.\nA:H - The reported reproducer triggers a KASAN vmalloc out-of-bounds/use-after-free splat in the packet receive path. Such kernel memory corruption can reliably crash or destabilize the kernel."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52912","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local control of netfilter/NFQUEUE, bridge device lifecycle, and verdict reinjection through netlink/rtnetlink paths. Remote packets alone cannot force the needed bridge teardown and userspace verdict sequence.\nAC:L - A local attacker can deterministically create a namespace, bridge/veth setup, NFQUEUE rule, queued packet, bridge teardown, and reinjection. There is no race dependent on conditions outside attacker control.\nPR:L - The setup requires CAP_NET_ADMIN, but netfilter and bridge configuration are reachable with CAP_NET_ADMIN inside a user-created network namespace on systems allowing unprivileged user namespaces. This is Low, not High.\nUI:N - No victim action is required once the local attacker runs the exploit sequence. The attacker controls packet injection, queueing, device teardown, and verdict delivery.\nS:U - The impact is kernel memory corruption within the same host security authority. This is a standard local kernel privilege escalation/DoS scenario, not a VM or hardware boundary escape.\nC:H - The bug is a use-after-free of the bridge master net_device retained in skb->dev across NFQUEUE. Kernel UAFs can be leveraged for kernel memory disclosure, so confidentiality impact is High.\nI:H - The stale net_device pointer is dereferenced after free in the receive path and can plausibly be combined with heap reclaim/spraying for memory corruption or control-flow impact. As a kernel UAF, integrity impact is High.\nA:H - At minimum, reinjection can dereference freed net_device memory in netif_receive_skb and crash/oops the kernel. Repeated local triggering makes availability impact High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52912","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52929","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached while processing an SCTP RE-CONFIG response chunk received from a remote SCTP peer on an established association. A malicious peer can send a denied ADD_OUT_STREAMS response over the network once stream reconfiguration is negotiated.\nAC:L - The packet/state sequence is protocol-controlled and reproducible: negotiate SCTP RE-CONFIG, trigger an ADD_OUT_STREAMS request, deny it, then cause later reuse of the stale stream state. Although RE-CONFIG must be enabled by the application, there is no race or condition outside the attacker's reasonable influence in a deployment using this feature.\nPR:N - A remote SCTP peer does not need local kernel privileges or authenticated OS privileges to send the denial response. The path is gated by SCTP association state, verification tag, and matching outstanding request sequence, not by credentials.\nUI:N - No human user interaction is required once the SCTP service/association is operating with stream reconfiguration. The triggering input is network protocol traffic from the peer.\nS:U - The vulnerability affects kernel SCTP state within the same host security authority. It does not cross a VM, IOMMU, or other separate authorization boundary.\nC:N - The investigated failure mode is stale SCTP stream scheduler metadata leading to a NULL pointer dereference in scheduler value retrieval. I did not find evidence of an attacker-controlled memory read or information disclosure primitive.\nI:N - The bug leaves scheduler-private stream state inconsistent but the demonstrated impact is a NULL dereference/crash, not controlled data modification or code execution. No arbitrary write primitive was evident from the rollback path.\nA:H - The stale stream extension state can lead to a kernel NULL pointer dereference/oops in the SCTP scheduler path. A remotely reachable kernel crash is a high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52929","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53110","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached by locally loading or attaching BPF programs through the bpf() syscall and then executing the JITed program or generated trampoline. It is not directly reachable from remote network packets without prior local BPF program installation.\nAC:L - An attacker can craft BPF bytecode/attachments that exercise unsigned kfunc arguments or trampoline return values, and there is no race or external timing condition required. The bug is a deterministic ABI/JIT miscompilation on affected s390 systems.\nPR:L - Loading kfunc/tracing BPF normally requires BPF-related capabilities, but BPF token delegation can evaluate these in a non-init user namespace in delegated/containerized deployments. Following the higher-severity rule, this is scored as low privileges rather than requiring real init-namespace root.\nUI:N - No victim action is needed after the attacker can issue the relevant bpf() syscalls. The attacker loads/attaches and triggers the affected BPF program path directly.\nS:U - The vulnerability affects kernel execution in the same security authority as the vulnerable component. It is a local kernel compromise/DoS style issue, not a VM escape or separate security-scope boundary bypass.\nC:H - The missing zero-extension lets attacker-controlled high bits cross the verifier/native ABI boundary for kfunc calls and trampoline returns. This can plausibly turn verifier-assumed bounded values into unsafe kernel values, matching prior BPF JIT verifier-bypass classes with kernel memory disclosure potential.\nI:H - Incorrect unsigned argument or return extension can corrupt kernel control/data flow through kfuncs or BPF modify-return trampolines. Under the required higher-severity assumption, this is treated as exploitable for kernel memory modification or privilege escalation.\nA:H - At minimum, passing ABI-invalid kfunc arguments or malformed trampoline return values can trigger kernel oops/panic paths, as similar BPF JIT argument-extension bugs have done. The attacker can repeatedly load/trigger the crafted BPF program."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53110","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53260","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable TCP request-socket path is reached by unauthenticated IPv4 or IPv6 SYN packets delivered to a listening socket over the network. This occurs before any application-level authentication.\nAC:L - Although the bug is a PREEMPT_RT timing race, an attacker can repeatedly create request sockets and timer/drop races by driving TCP connection attempts; under the required higher-severity rule this is treated as attacker-controllable rather than an uncontrollable environmental condition.\nPR:N - No credentials, capabilities, or prior authentication are required to send SYN packets to an exposed TCP listener and reach `tcp_conn_request()` and `reqsk_queue_hash_req()`. The path is in the generic TCP receive stack.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform an interactive action. Network traffic alone can exercise the vulnerable path on an affected listening service.\nS:U - The impact is within the kernel/network stack security authority on the same host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The failure is explicitly reported as a refcount underflow/use-after-free in a kernel heap object. Per the required guidance, UAF-class lifetime corruption is scored as high confidentiality impact because it can potentially be shaped into memory disclosure.\nI:H - The corrupted request-socket lifetime can leave stale kernel objects reachable through ehash/timer paths. Per the required guidance, UAF-class kernel memory corruption is scored as high integrity impact because it may be exploitable for write or control-flow manipulation.\nA:H - The observed failure triggers a kernel refcount warning with use-after-free semantics in timer context and can destabilize networking or the kernel. Kernel warnings/oopses, hangs, or UAF-triggered crashes are high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53260","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53264","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local rtnetlink `RTM_NEWTFILTER`/`RTM_DELTFILTER` traffic-control netlink messages, not by remote packet input.\nAC:L - The race is attacker-controlled because the same local actor can issue concurrent filter creation and deletion operations against the same action index. No external victim timing or rare environmental condition is required.\nPR:L - The operations require `CAP_NET_ADMIN` for non-GET rtnetlink messages, but traffic control is reachable with `CAP_NET_ADMIN` inside a user-created network namespace. Under the provided kernel guidance, this is Low privileges rather than High.\nUI:N - No victim interaction is needed; exploitation consists of the attacker sending crafted concurrent rtnetlink requests.\nS:U - The impact is within the kernel security authority and is a standard local kernel memory-corruption/privilege-escalation class issue. It does not cross a VM, IOMMU, or separate authorization scope boundary.\nC:H - The bug is a use-after-free of a `tc_action` object during action lookup/refcounting. A kernel heap UAF can be shaped into disclosure primitives, so confidentiality impact is High.\nI:H - The stale freed action pointer can be reused after heap reallocation and then modified/dereferenced through refcount, bind count, ops, and action lifecycle fields. This is memory corruption that can plausibly support arbitrary write or code execution, so integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or mutate freed/reused kernel memory and can crash or oops the kernel. Availability impact is therefore High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53366","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached while a local process constructs outgoing IPv4 UDP/raw/ping datagrams through sendmsg/splice/sendfile-style socket paths. I did not find a defensible received-packet or unauthenticated remote path that supplies the required cork/MSG_MORE-style fraggap conditions.\nAC:L - The attacker can choose UDP socket options/flags, payload sizes, corking/MSG_MORE behavior, and splice/zerocopy-style paged sends to reach the fraggap paged-allocation path. There is no race or external timing condition required.\nPR:L - A normal unprivileged local user can create IPv4 UDP sockets and use UDP_CORK/MSG_MORE/splice or related paged send paths; raw sockets are CAP_NET_RAW-gated but are not needed for the strongest local trigger. This is therefore basic local user privilege, not real administrator privilege.\nUI:N - No victim interaction is required once the attacker can run the local send/splice sequence. The vulnerable skb construction happens synchronously in the attacker-driven socket send path.\nS:U - The impact is within the same kernel security authority as the vulnerable IPv4 networking code. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug under-allocates/accounting for the linear skb area and can copy attacker-controlled fraggap bytes past skb->end into trailing skb_shared_info metadata. Kernel memory corruption of this kind is reasonably capable of being developed into information disclosure, so the higher severity confidentiality value is appropriate.\nI:H - The copied fraggap bytes corrupt kernel skb metadata past the intended buffer boundary. This is an out-of-bounds write in kernel heap/networking structures and is scored as high integrity impact.\nA:H - The corrupted skb metadata can crash or destabilize the kernel networking stack, and related negative-copy accounting can also produce severe send-path failure behavior. Kernel crash or oops potential is high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53366","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53381","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local VFS operations (open/write/close) on a virtiofs mount with FUSE submounts; exploitation is in the guest FUSE client during file release and submount umount, not via remote network packets.\nAC:L - This is a use-after-free where the attacker controls file close (async FUSE RELEASE) and can drive or coincide with submount umount; Kata Containers reproduces it reliably with virtiofsd --announce-submounts (default).\nPR:L - An unprivileged local process with access to the virtiofs mount can trigger it; virtiofs defaults to allow_other and normal POSIX permissions, and no real root or init-namespace capabilities are required.\nUI:N - Exploitation needs no victim interaction beyond the attacker (or their container workload) performing normal filesystem I/O while submount teardown occurs during pod/container lifecycle.\nS:U - Impact stays within the guest kernel security boundary (crash or guest kernel compromise); it does not by itself cross a VM/host or IOMMU boundary.\nC:H - The flaw is a use-after-free in fuse_release_end() calling iput() on an inode after its superblock is destroyed, which can be turned into arbitrary kernel memory read via heap manipulation.\nI:H - Use-after-free on a struct inode in the kernel heap provides a standard path to controlled memory corruption, heap spraying, and arbitrary write or code execution in kernel context.\nA:H - Confirmed kernel general protection fault/oops in iput() from fuse_release_end during virtio_fs request completion, and UAF bugs inherently threaten kernel stability even without full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53381","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63801","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached from the TIPC packet receive path (UDP bearer on port 6118 or L2 bearer) when encrypted frames arrive from a remote peer; no local syscall is required to enter tipc_aead_decrypt().\nAC:L - The attacker can reliably win the race by flooding packets to queue async decrypt completions while repeatedly destroying the network namespace; the repro demonstrates full control of both sides of the timing window.\nPR:L - Reliable exploitation is demonstrated via unshare-created user/network namespaces where the attacker gains CAP_NET_ADMIN-equivalent control to configure TIPC crypto and cycle namespace teardown, which per kernel CNA guidance maps to Low rather than High.\nUI:N - Exploitation requires only sending network packets and namespace lifecycle manipulation; no victim user action such as opening a file or mounting a filesystem is needed.\nS:U - Impact is confined to kernel memory within the same security authority; this is a standard kernel UAF/privilege-escalation class bug, not a VM escape or cross-authority boundary bypass.\nC:H - The UAF reads freed slab memory including aead->crypto->stats, aead->crypto->net, and aead[] pointers in tipc_crypto_rcv_complete, enabling arbitrary kernel memory disclosure via controlled reuse of the freed tipc_crypto object.\nI:H - Use-after-free of tipc_crypto structures can be leveraged for heap spraying and arbitrary write primitives, and tipc_crypto_rcv_complete continues processing with freed pointers including key attachment and node table operations.\nA:H - KASAN confirmed slab-use-after-free in tipc_aead_decrypt_done on a workqueue thread; UAF on this path causes kernel oops/panic even when not fully exploited for code execution."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63801","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63823","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local `request_key()` and `keyctl()` syscalls (`KEYCTL_ASSUME_AUTHORITY`, `KEYCTL_INSTANTIATE`, `KEYCTL_INSTANTIATE_IOV`, `KEYCTL_REJECT`); there is no network, adjacent-radio, or physical-device entry path.\nAC:L - Exploitation is a race the attacker orchestrates by calling `request_key()` and concurrently driving `KEYCTL_INSTANTIATE_IOV` with a user buffer that page-faults during `copy_from_iter_full()`, while a second helper thread or completion path revokes/frees the auth payload.\nPR:L - Any unprivileged local user can invoke `request_key()` and the affected `keyctl` instantiate/reject operations in the spawned helper context; no real-root or non-userns capability is required.\nUI:N - Exploitation does not depend on a victim performing an action beyond the attacker’s own syscall activity and helper process setup.\nS:U - Impact is kernel memory corruption and local privilege escalation within the same kernel security domain, not a VM-guest-to-host or IOMMU boundary escape.\nC:H - This is a heap use-after-free of `struct request_key_auth`; after free the code dereferences `rka->target_key` and related fields, enabling attacker-controlled reuse and arbitrary kernel memory disclosure.\nI:H - The UAF corrupts trusted kernel pointers (`target_key`, `dest_keyring`) used in `key_instantiate_and_link()`, which can be turned into arbitrary kernel writes and local privilege escalation.\nA:H - Use-after-free of kernel heap objects can cause kernel oops/panic during post-fault dereferences, and is independently severe even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63823","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63879","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local AMDGPU DRM ioctls (e.g., AMDGPU_GEM_USERPTR, AMDGPU_CS) and KFD ioctls on /dev/kfd that call amdgpu_hmm_range_get_pages(); there is no network-facing entry point.\nAC:L - Exploitation requires a >2GB userptr/SVM mapping and a concurrent munmap/remap during the multi-chunk HMM walk, but the attacker controls both the ioctl thread and the address-space manipulation, so the race is attacker-driven rather than dependent on uncontrollable conditions.\nPR:L - Any unprivileged local user with access to the AMDGPU render node or /dev/kfd (typically render/video group membership) can create large userptr buffers and submit GPU work that triggers the vulnerable HMM path; root or init-namespace capabilities are not required.\nUI:N - Exploitation is fully attacker-driven through GPU memory registration and command submission ioctls and does not require any action from another user or administrator.\nS:U - The flaw corrupts or misuses kernel-tracked page metadata and enables standard local kernel memory safety impact and privilege escalation within the same kernel security domain, not a VM escape or IOMMU boundary bypass.\nC:H - Re-reading the MMU notifier sequence per 2GB chunk lets later validation pass while earlier PFNs may reference unmapped or freed pages, giving the GPU (and kernel DMA helpers) a stale-page/use-after-free primitive that can disclose arbitrary physical memory contents.\nI:H - Stale PFNs from invalidated mappings can be DMA-mapped and written by GPU operations, enabling arbitrary memory corruption and potential control-flow hijacking via repurposed physical pages rather than a bounded or crash-only effect.\nA:H - Operating on invalid struct page pointers during pinning/DMA mapping can trigger kernel oopses or panics, and the underlying use-after-free class of bug inherently threatens system availability even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63879","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63881","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local `ioctl()` on `/dev/kfd` via `AMDKFD_IOC_DBG_TRAP` with `KFD_IOC_DBG_TRAP_SUSPEND_QUEUES` or `KFD_IOC_DBG_TRAP_RESUME_QUEUES`; there is no network, adjacent-radio, or physical-access path to the vulnerable code.\nAC:L - On affected 32-bit `size_t` kernel builds, an attacker fully controls `num_queues` in the ioctl and can reliably force the multiply overflow (e.g. `num_queues >= 0x40000001`) to trigger undersized `memdup_user()` followed by unbounded kernel heap corruption.\nPR:L - A local unprivileged user with AMDGPU/KFD device access can open `/dev/kfd`, enable the debug runtime and debug trap on their own process (no ptrace or root required), then invoke suspend/resume with a malicious `num_queues` value.\nUI:N - Exploitation is achieved entirely through attacker-initiated ioctl calls in an established KFD debug session; no victim interaction is required.\nS:U - Impact is kernel heap corruption and potential local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - The integer overflow causes a heap buffer far smaller than `num_queues`, and subsequent `q_array_get_index()`/`copy_to_user()` operations perform out-of-bounds kernel reads that can disclose adjacent heap memory and be leveraged for arbitrary read primitives.\nI:H - `q_array_invalidate()` and per-queue status updates write attacker-influenced values (`KFD_DBG_QUEUE_INVALID_MASK`/`KFD_DBG_QUEUE_ERROR_MASK`) far beyond the allocated buffer, constituting an out-of-bounds heap write exploitable for control-flow hijacking and arbitrary kernel modification.\nA:H - Writing billions of 32-bit values past a 4-byte kmalloc object corrupts adjacent kernel heap metadata and objects, readily causing kernel oops/panic and complete loss of availability even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63881","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63886","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered by a remote iSCSI initiator sending crafted CHAP login PDUs over TCP to the in-kernel LIO iSCSI target during the network login/authentication handshake.\nAC:L - Once an iSCSI target with CHAP is reachable, an attacker can reliably trigger the overflow by sending CHAP_R with a 0b-prefixed base64 string up to 127 characters; no race or special memory layout is required.\nPR:N - The heap overflow occurs during the CHAP authentication handshake before the password hash comparison succeeds, so exploitation is reachable by an unauthenticated remote network attacker who knows a configured CHAP username.\nUI:N - Exploitation requires only the attacker initiating an iSCSI login connection and sending malicious CHAP PDUs; no action from a victim user is needed.\nS:U - Successful exploitation corrupts kernel heap memory within the same kernel security boundary, enabling denial of service or kernel privilege escalation, not a cross-boundary escape such as VM guest-to-host.\nC:H - The out-of-bounds heap write corrupts adjacent kmalloc objects and can be leveraged for arbitrary kernel memory disclosure through heap grooming, consistent with heap overflow impact guidance.\nI:H - A controlled kernel heap out-of-bounds write of up to 79 bytes past a digest-sized buffer can corrupt adjacent structures and be developed into arbitrary code execution or kernel privilege escalation.\nA:H - The overflow causes slab-out-of-bounds writes confirmed by KASAN and can crash or destabilize the kernel during login processing, constituting high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63886","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63887","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The Linux iSCSI target (LIO) is an in-kernel SCSI target that accepts remote TCP connections on the iSCSI portal (typically port 3260); crafted Login PDUs reach the vulnerable encoder via the normal network receive and login-negotiation path.\nAC:L - Once an iSCSI target portal is reachable, an attacker can reliably trigger the overflow by sending a single Login PDU packed with unknown key=value pairs; no races or victim-dependent timing are required.\nPR:N - The heap overflow occurs during login negotiation before iSCSI authentication completes; a discovery-session login requires only InitiatorName and SessionType with no credentials, initiator ACL, or local privileges.\nUI:N - Exploitation requires only network packets sent by the attacker; no action from a legitimate user or administrator is needed beyond the target already exposing its iSCSI portal.\nS:U - The corruption is confined to kernel heap memory in the iSCSI target/login context and does not cross a VM, container, or IOMMU security boundary by itself.\nC:H - A ~24 KiB out-of-bounds write into the kmalloc-8k slab can corrupt adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - The unbounded sprintf heap overrun is a large out-of-bounds write that can corrupt adjacent heap metadata or objects to achieve arbitrary kernel memory modification and potential code execution.\nA:H - Corrupting kmalloc-8k heap objects during login response encoding can cause kernel oops, BUG, or panic, and the attack can be repeated against an exposed iSCSI target."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63887","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63888","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the in-kernel LIO iSCSI target, reachable by sending iSCSI Text PDUs over TCP after connection setup on the network-facing iSCSI portal (typically port 3260), analogous to nfsd/ksmbd network exposure.\nAC:L - An attacker fully controls login parameter negotiation (DataDigest=CRC32C) and subsequent Text PDU content; the CRC overread fires deterministically on every qualifying Text PDU, and the double-free is reliably triggered by sending a bad DataDigest followed by another Text PDU on the same ITT when ERL>0.\nPR:N - No Linux OS privileges are required; the default discovery session permits unauthenticated login (AuthMethod=None, authentication disabled), after which SendTargets Text requests reach the vulnerable handler without any credentials.\nUI:N - Exploitation requires only crafted iSCSI protocol traffic from the attacker; no victim user action such as mounting a filesystem or clicking a link is needed.\nS:U - The vulnerability corrupts kernel heap memory within the iSCSI target subsystem on the host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The CRC path performs a slab out-of-bounds read past the text_in allocation, and the double-free is a use-after-free class bug that reads freed heap metadata; per kernel guidance both OOB reads and UAFs warrant High confidentiality impact.\nI:H - The double-free corrupts the slab freelist (triggering CONFIG_SLAB_FREELIST_HARDENED BUG() on hardened kernels), providing a classic heap corruption primitive that can be leveraged for arbitrary kernel memory writes and code execution.\nA:H - The double-free provably crashes the kernel (KASAN splat or SLAB_FREELIST_HARDENED BUG()), and the heap corruption can cause kernel panics; any UAF is scored as High availability impact per kernel guidance."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63888","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63920","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (nftables netlink to install a payload-set rule, setsockopt for IPV6_RECV* options, and recvmsg). Although the trigger packet is received over IPv6, the mandatory nftables corruption step is classified as Local per kernel guidance.\nAC:L - The attacker fully controls the nftables payload-set rule, the on-wire extension header, socket receive options, and the recvmsg call, making the slab out-of-bounds read reliably reproducible without races or external conditions.\nPR:L - An unprivileged local user can create a user+network namespace, obtain CAP_NET_ADMIN there, configure nftables, open a UDPv6/raw socket with extension-header cmsg options, and trigger the bug without real root in the initial namespace.\nUI:N - No victim interaction is required; the attacker can send the crafted IPv6 datagram and call recvmsg on their own socket to trigger the out-of-bounds read.\nS:U - Impact is confined to kernel memory disclosure and potential kernel instability within the same kernel security domain; it does not cross a VM/host or IOMMU boundary.\nC:H - put_cmsg() can copy up to 2040 bytes past the actual extension header into userspace ancillary data, leaking adjacent slab/kernel memory (confirmed by KASAN slab-out-of-bounds in put_cmsg).\nI:N - The bug is an out-of-bounds read that copies kernel data to userspace; it does not modify kernel memory, corrupt control structures, or provide a write primitive.\nA:H - The out-of-bounds slab read can provoke a KASAN fault/kernel oops during put_cmsg(), and repeated triggering can deny availability of the affected system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63920","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63944","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the Bluetooth HCI ISO/CIS path (`hci_le_create_cis_sync`), reachable only via the Bluetooth radio interface. Per kernel CVSS guidance, Bluetooth vulnerabilities are scored as Adjacent, including on phones and LE Audio devices in public spaces.\nAC:L - The UAF is a race between `hci_le_create_cis_sync` dropping locks and a concurrent `hci_conn_del`. An attacker who controls one side of the CIS setup (local ISO socket threads or a remote peer timing ACL/CIS teardown) can repeatedly trigger the race; success does not depend on uncontrollable conditions like kernel memory layout.\nPR:N - No local Unix privileges are required for the highest-impact scenario: a remote Bluetooth peer in range can provoke CIS teardown/disconnect events while the victim host is performing normal LE Audio CIS establishment (e.g., phone connecting to earbuds). Local exploitation via ISO sockets also requires no special capabilities at the kernel level.\nUI:N - Both sides of the race run inside the kernel's own HCI event handling: hci_le_create_cis_pending() queues the vulnerable work from hci_le_cis_established_evt(), hci_cs_le_create_cis(), hci_unbound_cis_failed() and iso_connect_cfm(), all driven by controller events and remote peer traffic, while the freeing side is a peer-initiated disconnect reaching hci_conn_del(). On an LE Audio host the CIS establishment happens by itself when the earbuds connect and the attacker supplies the disconnect, so nothing is asked of the person holding the device; the existing pairing is a precondition of the deployment, not an in-attack user step.\nS:U - Impact is confined to kernel memory corruption within the Bluetooth subsystem on the host; this is standard kernel compromise, not a cross-boundary escape (KVM guest-to-host, IOMMU bypass, or sandbox breakout).\nC:H - This is a slab use-after-free read of `conn->conn_timeout` on a freed `hci_conn` (kmalloc-8k object). UAF reads against attacker-influencable freed objects can disclose kernel heap contents and are scored as High per kernel CVSS guidance.\nI:H - Although the immediate bug is a post-unlock dereference of a freed `hci_conn`, UAF on large `hci_conn` kmalloc objects enables heap grooming and control of freed memory contents, which can be chained into arbitrary kernel writes or code execution; UAF class bugs are scored I:H.\nA:H - Use-after-free access to a freed connection object can cause kernel oops/panic (as demonstrated by the same bug class in the related `le_read_features_complete` fix found by syzkaller). Even without full exploitation, triggering the UAF reliably causes High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63944","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63970","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local AF_VSOCK transmission (syscall/io_uring send on a connected virtio vsock socket), not by processing remote network packets. Per kernel CVSS guidance, vsock is Local.\nAC:L - An attacker fully controls the trigger: SO_ZEROCOPY, io_uring IORING_OP_SEND_ZC with IORING_RECVSEND_FIXED_BUF and a vectored iov exceeding MAX_SKB_FRAGS (17), causing io_sg_from_iter() to return -EMSGSIZE on a deterministic error rollback path.\nPR:L - Exploitation requires only an unprivileged local process that can open a vsock connection and use io_uring zerocopy send; no CAP_NET_ADMIN or real root is needed beyond ordinary local user access in a virtio-vsock environment (KVM/Firecracker/cloud microVMs).\nUI:N - No victim interaction is required; the attacker triggers the bug directly through their own socket send/io_uring operation.\nS:U - Impact is kernel memory corruption and privilege escalation within the same security domain where the send occurs (guest kernel or host kernel). It is not a cross-boundary VM escape on the receive path; the flaw is in the sender's local skb teardown.\nC:H - Incorrect __skb_frag_unref() on SKBFL_MANAGED_FRAG_REFS pages without a bound uarg corrupts refcount/lifetime of io_uring registered buffer pages, yielding use-after-free and arbitrary kernel memory read primitives.\nI:H - The refcount corruption is a memory-safety bug in kernel heap/page management that can be leveraged for arbitrary write and control-flow hijacking, not merely a bounded data change.\nA:H - The erroneous frag unref on managed zerocopy pages can cause immediate kernel oops/panic from refcount underflow or use-after-free during skb teardown, independent of full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63970","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63992","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code runs on the VXLAN/GENEVE transmit path when processing remotely received UDP-encapsulated tunnel traffic (or L2 frames forwarded through a bridge port), which is reachable by sending crafted packets over the network to the victim VTEP.\nAC:L - The attacker fully controls the inner IPv4 header fields (DF bit, length, addresses) and can reliably craft oversized packets that exceed the tunnel-adjusted PMTU on bridge-port tunnel devices without depending on race timing or uncontrollable system state.\nPR:N - Exploitation requires only the ability to send network packets to a host with VXLAN/GENEVE bridged; no local account, authentication, or capabilities on the victim are needed.\nUI:N - No victim user action is required; the kernel processes attacker-supplied packets automatically through the tunnel receive, bridge forward, and re-encapsulation path.\nS:U - The out-of-bounds read and resulting kernel oops occur within the kernel network stack on the same host; there is no crossing of a VM, container, or IOMMU security boundary beyond standard kernel memory safety failure.\nC:H - Reading through `icmp_hdr(skb)` when `transport_header` is unset causes an out-of-bounds read at `skb->head + 65535`, potentially disclosing adjacent kernel memory beyond the skb buffer before any bounds checking occurs.\nI:N - The flaw is an out-of-bounds read of the ICMP type field; it does not directly modify or write kernel memory, though it may cause a kernel fault.\nA:H - The invalid pointer dereference at offset 65535 can trigger a kernel oops or panic when accessing unmapped memory, causing denial of service on the affected host."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63992","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64000","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached when the kernel processes received Ethernet frames via the netdev RX handler in net/hsr, and a remote attacker on the HSR/PRP ring can deliver a crafted supervision frame without any local access to the victim host.\nAC:L - The attacker fully controls the malformed frame content and length; a precisely truncated supervision frame reliably passes existing TLV validation and triggers the out-of-bounds read with no races or attacker-uncontrollable conditions.\nPR:N - Exploitation requires only the ability to inject L2 HSR/PRP supervision frames onto the ring segment; no local account, capabilities, or authentication on the target kernel is needed.\nUI:N - No victim user action is required beyond normal operation of an HSR/PRP-configured node; the attacker triggers the bug solely by sending a malicious frame.\nS:U - Impact is confined to kernel memory safety within the same security authority; there is no VM escape, IOMMU bypass, or cross-security-boundary scope change.\nC:H - The bug is an out-of-bounds read of supervision TLV header fields past the skb tail, which can disclose adjacent kernel heap/skb memory and is not strictly bounded to a few attacker-uncontrolled bytes.\nI:H - Out-of-bounds access in kernel packet parsing can supply attacker-influenced TLV type/length values that drive further skb_pull arithmetic and extended parsing, creating a plausible path to memory corruption and control-flow hijacking.\nA:H - Reading beyond the skb buffer boundary during softirq packet processing can cause a kernel oops/panic, and the attacker can repeatedly trigger the condition with crafted frames."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64000","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64002","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls—network namespace teardown via unshare/setns/put_net, sysctl access to /proc/sys/net/ipv4/ip_local_reserved_ports, and/or local socket bind/connect—not remote packet delivery.\nAC:L - The attacker can control both sides of the race by concurrently tearing down a network namespace while hammering the sysctl or triggering socket port selection in that namespace.\nPR:L - An unprivileged local user can reach this via user namespaces (CAP_SYS_ADMIN within the user_ns for CLONE_NEWNET) and world-writable sysctl access (mode 0644) during namespace destruction.\nUI:N - No victim interaction is required beyond the attacker's own concurrent namespace teardown and sysctl or socket activity.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it is standard local kernel memory corruption, not a VM/hypervisor boundary escape.\nC:H - Freed 8 KiB bitmap memory remains reachable via sysctl reads (find_next_bit) and inet_is_local_reserved_port() (test_bit), enabling heap information disclosure through a use-after-free.\nI:H - Sysctl writes via proc_do_large_bitmap perform bitmap_copy/bitmap_or into the freed allocation, providing a heap write primitive exploitable for control-flow hijacking.\nA:H - Concurrent access to the freed bitmap can cause kernel oops/panic from invalid memory access, and UAF exploitation inherently threatens kernel availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64002","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64007","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered when remote TCP packets traverse SYNPROXY netfilter hooks (NF_INET_LOCAL_IN / NF_INET_POST_ROUTING) on a host with SYNPROXY configured, which is the standard internet-facing firewall/router deployment for this subsystem.\nAC:L - An attacker who controls a TCP session through SYNPROXY can reliably send timestamp-bearing packets to hit the vulnerable path; the stale-pointer UAF write occurs whenever skb_ensure_writable() must expand a cloned skb, which the attacker can influence by sustaining traffic on the proxied connection.\nPR:N - Exploitation requires only that the victim already runs SYNPROXY (normal for protected services); the remote attacker needs no credentials or local privileges on the target system to send the triggering TCP packets.\nUI:N - No victim user action is required beyond normal network operation; exploitation is fully automated via crafted or sustained TCP traffic through the SYNPROXY session.\nS:U - Impact is confined to kernel memory on the affected host running SYNPROXY; this is standard kernel privilege escalation/memory corruption, not a cross-VM or cross-security-boundary escape.\nC:H - The stale tcphdr pointer causes inet_proto_csum_replace4() to write into freed slab memory, a use-after-free class bug that can be leveraged for arbitrary kernel memory read via heap grooming techniques.\nI:H - The out-of-bounds write into freed slab memory via a stale tcphdr pointer is a use-after-free write primitive that can be developed into arbitrary kernel memory writes and local privilege escalation.\nA:H - Writing into freed slab memory can corrupt adjacent kernel objects and cause kernel oops, panic, or crash, and UAF conditions are inherently capable of destabilizing the system even during exploitation attempts."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64007","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64015","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through find_key_to_update() on the persistent keyring register, which is invoked from keyctl_get_persistent() via the keyctl(2) syscall. There is no network, adjacent-radio, or physical-device path to this code.\nAC:L - Exploitation is a race between assoc_array_find() and assoc_array_gc() on the .persistent_register keyring; the attacker controls both sides by repeatedly calling KEYCTL_GET_PERSISTENT (including from multiple threads) while driving key expiry/GC via keyctl timeouts or natural garbage collection. Per kernel guidance, attacker-controlled races are AC:L.\nPR:L - Any unprivileged local user who can invoke keyctl() can call KEYCTL_GET_PERSISTENT for their own UID (-1) with a writable destination keyring (e.g., session keyring). No real-root or CAP_SETUID capability is required for the vulnerable lookup path; this remains PR:L even inside user namespaces.\nUI:N - Exploitation requires only the attacker's own keyctl syscalls and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary on its own.\nC:H - assoc_array_find() is documented to require an RCU read lock, but the persistent-keyring path called it without one while assoc_array_gc() frees tree nodes via call_rcu(), yielding a use-after-free on assoc_array nodes/leaves. UAF on kernel heap objects can be turned into arbitrary kernel memory reads.\nI:H - The freed assoc_array nodes can be reallocated and corrupted through concurrent GC versus lookup, providing a standard kernel heap UAF primitive that can be developed into arbitrary write or code-execution primitives.\nA:H - Dereferencing RCU-freed assoc_array tree nodes during lookup can cause kernel oops/panic from invalid pointer access, and UAF exploitation commonly destabilizes or crashes the kernel even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64015","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64018","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached via MSI-driven hardware completion processing in the MANA HWC control path (not netdev packet receive), triggered when the Azure hypervisor/host tampers with guest-visible DMA-coherent WQE memory on the same physical compute node.\nAC:L - A malicious host or NIC firmware that can modify shared unencrypted DMA buffers controls both the forged sge->address and the timing of HWC RX completions, allowing reliable out-of-bounds indexing without winning a race or depending on guest state.\nPR:N - Exploitation requires no privileges on the victim guest VM; the attacker operates from the Azure hypervisor/host side by modifying DMA-coherent memory that the guest kernel trusts during HWC response handling.\nUI:N - No victim user action is required; exploitation occurs automatically when the driver processes a hardware completion event on the HWC receive queue.\nS:C - In Confidential VMs the guest relies on host isolation guarantees, but shared unencrypted DMA memory lets a hostile hypervisor cross that CVM security boundary to corrupt guest kernel memory and confidentiality.\nC:H - An out-of-bounds rx_req_idx yields a corrupted hwc_work_request whose buf_va is dereferenced and copied via memcpy in mana_hwc_handle_resp(), enabling arbitrary kernel memory disclosure.\nI:H - The out-of-bounds hwc_work_request supplies attacker-controlled pointers and SGE fields used to repost RX WQEs via mana_hwc_post_rx_wqe(), enabling kernel heap corruption and exploitable memory writes.\nA:H - Indexing reqs[] out of bounds with attacker-controlled values can dereference invalid kernel pointers and corrupt adjacent heap objects, causing kernel oops/panic and denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64018","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64029","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access via the ALSA sequencer device node (/dev/snd/seq) using write(2) and port-subscription ioctls; there is no network, Bluetooth, or physical-device attack surface on the vulnerable code path.\nAC:L - The race is between concurrent UMP event delivery and the last output-port unsubscribe/close path, and a local attacker can control both sides with parallel threads (flood write() while repeatedly subscribing/unsubscribing to the UMP port).\nPR:L - Any local unprivileged user who can open /dev/snd/seq (typically membership in the audio group on desktop/workstation systems where UMP MIDI hardware is present) can create sequencer clients, subscribe to UMP kernel ports, and trigger the bug without real root or init-namespace capabilities.\nUI:N - Exploitation is fully attacker-driven through sequencer writes and subscription management; no victim interaction such as opening files, mounting filesystems, or plugging in devices is required beyond the UMP endpoint already being present on the system.\nS:U - Impact is confined to kernel memory corruption and potential local privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary bypass.\nC:H - KASAN confirmed a slab use-after-free on freed substream runtime metadata in snd_rawmidi_kernel_write1(); UAF on kernel heap objects enables controlled reallocation and arbitrary kernel memory disclosure primitives.\nI:H - The UAF occurs inside snd_rawmidi_kernel_write1(), which performs memcpy() into runtime->buffer using attacker-supplied UMP event payload, providing a plausible path to arbitrary kernel memory corruption and code execution beyond a simple crash.\nA:H - The confirmed KASAN slab-use-after-free in kernel write path causes kernel oops/panic; even without full exploitation, the bug reliably threatens system availability through kernel crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64029","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64034","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a malicious hypervisor or host that can modify MANA HWC DMA-coherent response buffers between guest kernel loads; it is not reachable by sending network packets to the guest's data path.\nAC:L - The attacker controlling the hypervisor fully controls DMA buffer contents and can reliably flip hwc_msg_id between the validation read and the use in mana_hwc_handle_resp() on uncacheable coherent memory.\nPR:N - The attacking hypervisor needs no guest OS credentials or capabilities; exploitation targets the guest kernel through the virtual device DMA path while the MANA driver is active.\nUI:N - No victim user action is required beyond normal Azure VM operation with the MANA driver loaded and HWC receive buffers posted.\nS:C - The vulnerability crosses the VM/DMA security boundary by allowing a hostile hypervisor to corrupt guest kernel memory that the confidential-guest threat model assumes is protected from host tampering.\nC:H - Out-of-bounds indexing via bypassed hwc_msg_id validation enables reading adjacent kernel heap objects through misdirected caller_ctx access and test_bit() on the inflight bitmap.\nI:H - Host-controlled response data is copied with memcpy() to an out-of-bounds output_buf pointer, enabling arbitrary kernel memory corruption and potential control-flow hijacking.\nA:H - Out-of-bounds caller_ctx access and corrupted completion signaling can cause kernel oops, panic, or hang during HWC response handling."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64034","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64048","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The fault is triggered while processing a malicious CLC ACCEPT message received from a remote TCP peer during the SMC-D handshake; the attacker controls the server response over the network.\nAC:L - Once a victim with SMC-Dv2 hardware initiates an SMC connection, a malicious peer can reliably send `d1.chid == 0` in the CLC ACCEPT to match the empty reserved slot 0 without races or special timing.\nPR:N - No local privileges are required on the victim host; an unauthenticated remote attacker operating a malicious SMC server can crash connecting clients, and unprivileged users can create SMC sockets without capability checks.\nUI:N - Exploitation requires only that a victim application initiate a normal outbound SMC connection to the attacker's server, which occurs automatically in enterprise middleware without per-connection user action.\nS:U - The vulnerability causes a kernel crash on the victim host but does not cross a security boundary such as VM escape or sandbox breakout.\nC:N - The bug is a null pointer dereference when taking `ism_dev[0]->lgr_lock`; it causes an immediate kernel fault with no information disclosure.\nI:N - The attempted write at address 0x68 is a spinlock operation on a NULL `smcd_dev` pointer, not a controlled or arbitrary memory modification primitive.\nA:H - A successful trigger causes a kernel null pointer dereference (KASAN-reported oops/panic), crashing the affected system or at minimum the connecting process's kernel context."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64048","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64098","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through local DRM ioctl syscalls (DRM_IOCTL_MODE_CURSOR and DRM_MASTER modesetting ioctls) on /dev/dri/card0, not via any network-facing kernel service.\nAC:L - An attacker can reliably trigger the bug by signaling a thread blocked in dma_resv_lock_interruptible (-EINTR), forcing memory pressure for -ENOMEM, or running concurrent plane updates to race the unlocked fence-list mutation.\nPR:L - Exploitation requires DRM master on the virtio-gpu device, which a local user with standard DRI access (video/render group membership on typical virtio-gpu VMs) can obtain when no compositor holds master; this is not init-namespace root.\nUI:N - Triggering the bug requires only attacker-initiated DRM ioctl calls (cursor/plane updates); no action by another user or victim is needed.\nS:U - The corruption occurs within the same kernel security domain (guest or host) that issued the ioctl; virtio-gpu runs in the guest kernel and this does not cross a VM/hypervisor boundary to the host.\nC:H - Mutating the dma_resv fence list without holding the lock races with concurrent readers and can corrupt kernel heap metadata, which is reasonably leverageable for arbitrary memory disclosure.\nI:H - The same unlocked fence-list corruption can corrupt kernel pointers and synchronization state, providing a plausible path to arbitrary kernel writes or control-flow hijacking.\nA:H - The bug produces kernel WARN/oops under lockdep and fence-list corruption can cause kernel crashes, hangs, or panics during subsequent dma_resv operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64098","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64109","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local syscalls on AF_UNIX SOCK_STREAM sockets (recvmsg, splice_read, setsockopt SO_PEEK_OFF), not via any network protocol handler.\nAC:L - The attacker controls both racing threads on the same socket fd and can retry the peek/normal-recv interleaving; this is a self-induced race, not one dependent on uncontrollable kernel state.\nPR:L - Any unprivileged local user can create AF_UNIX socketpairs, set SO_PEEK_OFF, and run concurrent recv operations without capabilities, including from within user namespaces.\nUI:N - Exploitation requires no victim interaction; the attacker sets up and races their own socket endpoints programmatically.\nS:C - Successful kernel heap UAF exploitation from an unprivileged container, Android app sandbox, or user-namespace tenant crosses the sandbox boundary to compromise the host kernel.\nC:H - This is a slab use-after-free read of sk_buff->len on freed memory, which per UAF guidance enables arbitrary kernel memory disclosure and heap layout leaks.\nI:H - UAF on sk_buff objects in the kernel heap can be leveraged through heap grooming and spraying to obtain arbitrary write and kernel code execution primitives.\nA:H - The UAF read can trigger KASAN slab-use-after-free faults, kernel oops, or panic during the dereference, and repeated triggering causes denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64109","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64114","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (socket/sendmsg on a raw IP_HDRINCL socket); malformed packets are injected locally into the output path, not via remote network ingress which validates ihl >= 5.\nAC:L - The attacker fully controls the crafted header ihl value and can install the required xfrm AH policy and route via CAP_NET_ADMIN in their own network namespace, making exploitation reliable without conditions outside attacker control.\nPR:L - Triggering requires CAP_NET_RAW for raw sockets and CAP_NET_ADMIN to install xfrm AH policy, both obtainable by an unprivileged user via user+network namespaces or a container granted NET_ADMIN without init-namespace root.\nUI:N - No victim interaction is required; the attacker sends the malformed packet directly through their own raw socket and configured IPsec policy.\nS:U - Impact is kernel memory corruption and panic within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The integer underflow in ah_output() memcpy length produces an out-of-bounds read of near SIZE_MAX bytes, providing an arbitrary kernel memory read primitive beyond any bounded disclosure.\nI:H - The same memcpy with underflowed length causes a massive out-of-bounds write that can corrupt adjacent kernel heap memory and be leveraged for control-flow hijacking.\nA:H - The OOB memcpy reliably causes a kernel-mode fault and host panic, as reproduced with KASAN and in a rootless Docker container, denying all system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64114","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64115","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local AF_VSOCK syscalls (connect/close) to drive VMCI control packets; per kernel CVSS guidance, vsock is scored Local even when the peer is a VM guest reaching a host listener.\nAC:L - The attacker controls both sides of the handshake race by initiating a connection and aborting it with RST during TCP_SYN_SENT; KASAN testing showed 52/100 repro without conditions outside attacker control.\nPR:L - Any unprivileged local user inside a VM (or on the same host) can open AF_VSOCK sockets and connect to a listening peer without CAP_NET_ADMIN or other elevated privileges.\nUI:N - Exploitation requires only a victim service with a bound/listening vsock socket, which is normal background operation; no interactive victim action is needed.\nS:C - In the most severe reasonable VMware deployment, an unprivileged guest VM triggers kernel memory corruption on the hypervisor host via VMCI vsock, crossing the guest-to-host virtualisation security boundary analogous to KVM/Xen VM escape.\nC:H - The bug is a slab use-after-free on struct sock; UAF on kernel heap objects enables arbitrary memory read primitives through controlled reuse of the freed socket structure.\nI:H - The UAF involves a write to a freed object's refcount field and corrupts kernel heap metadata, providing a foundation for arbitrary write and kernel code execution via heap grooming.\nA:H - The vulnerability reliably triggers kernel UAF detected by KASAN (refcount write to freed memory on a kworker), which causes kernel oops/panic and denial of host availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64115","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64247","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggering requires a Hyper-V TLB-flush hypercall from an L2 vCPU under KVM, ultimately reached through the local KVM_RUN ioctl; no network path reaches it.\nAC:L - A malicious nested-virtualization tenant controls both the unchecked enlightened-VMCS/VMCB VP ID and the sparse-bank hypercall data, with no uncontrollable race required.\nPR:L - The attacker needs control of a KVM guest with nested virtualization, or ordinary /dev/kvm access to create one, but requires neither host root nor an init-namespace capability.\nUI:N - Once the crafted nested guest executes, no action by another user is required.\nS:C - The out-of-bounds access occurs in the host kernel from attacker-controlled guest state, crossing the KVM guest-to-host isolation boundary.\nC:H - The attacker-selected VP ID makes test_bit() query selectable bits far beyond the stack-resident 64-bit mask, and the resulting TLB-flush decision can provide an oracle for host kernel memory.\nI:N - The primitive performs reads only; a set result merely selects a legitimate L2 vCPU for an extra TLB flush, with no out-of-bounds write or unsafe mapping change.\nA:H - The selectable access can reach a VMAP_STACK guard or another unmapped page and oops the host; KASAN already detects the access as an eight-byte invalid read, which can become a host-wide denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64247","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64266","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - A local attacker reaches the flaw by serving a self-created FUSE mount and invoking splice() on its associated /dev/fuse descriptor.\nAC:L - The attacker controls writeback generation, splice processing, and concurrent connection abort, allowing repeated attempts at the race without an uncontrollable prerequisite.\nPR:L - FUSE supports user-namespace mounts, and an unprivileged mount owner can operate /dev/fuse and abort their own connection without init-namespace root.\nUI:N - The attacker can create and exercise their own FUSE connection without any victim action.\nS:U - Exploitation compromises the kernel within the same operating-system security authority and does not inherently cross a virtualization boundary.\nC:H - The freed argument and folio arrays are subsequently dereferenced, permitting attacker-influenced stale folio pointers and potential arbitrary kernel-memory disclosure through pipe buffers.\nI:H - Heap reclamation can replace the freed folio pointers and loop metadata, enabling attacker-directed memory or refcount operations that may support arbitrary writes and kernel code execution.\nA:H - The repeatable use-after-free and invalid folio operations can cause an oops, panic, or other complete system failure."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64266","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64268","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - siw carries iWARP over ordinary routable TCP, and the vulnerable receive callback processes crafted Read Response FPDUs from the remote endpoint of an established RDMA connection.\nAC:L - The peer learns the sink tag, address, and length from the RREAD and can deterministically send oversized continuation segments; no race or uncontrollable condition is required.\nPR:N - The MPA/siw data path performs no credential or capability check on the connected peer, and an unauthenticated RDMA service can accept the connection and issue attacker-induced RREADs.\nUI:N - The overflow is triggered through an automated RDMA protocol exchange and requires no human action.\nS:U - The corruption compromises resources within the affected host's kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The global DMA/KVA sink case exposes the sink address and permits attacker-controlled kernel memory corruption, which can enable control-flow hijacking and arbitrary kernel-memory disclosure.\nI:H - Attacker-chosen response bytes are written beyond the validated sink into adjacent kernel memory, providing an exploitable out-of-bounds write capable of modifying objects or achieving kernel code execution.\nA:H - The overwrite can corrupt critical kernel objects or reach invalid memory, causing an oops or panic; bounded FRWR sinks still permit connection-terminating denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64268","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64304","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An unprivileged local process can add a crafted PKCS#8 RSA private key to its own keyring and invoke KEYCTL_PKEY_QUERY, which selects qat-rsa and reaches the vulnerable key setup path.\nAC:L - With an active QAT asymmetric service and PKCS#8 parser, an oversized CRT integer deterministically causes unsigned offset underflow and an out-of-bounds memcpy. No race or attacker-uncontrollable condition is required.\nPR:L - An ordinary user can create, search, and use keys in a personal process, thread, or session keyring. No capability, administrator privilege, or user namespace is required.\nUI:N - The attacker directly performs the add_key and keyctl system calls without any victim action.\nS:U - The vulnerable QAT driver and the corrupted kernel resources share the same security authority. Ordinary kernel privilege escalation does not cross a CVSS scope boundary.\nC:H - The controlled kernel-memory overwrite can corrupt page tables, credentials, or control-flow objects and plausibly yield code execution with access to protected kernel memory.\nI:H - Attacker-controlled CRT bytes are written outside the coherent DMA allocation, potentially through multiple CRT components. This can provide powerful kernel-memory corruption and control-flow hijacking primitives.\nA:H - The invalid destination can cause an immediate kernel fault or corrupt unrelated kernel memory and subsequently panic or hang the system. The attack is repeatable."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64312","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - pcrypt is designed for network-facing IPsec use, and an inbound ESP packet can traverse xfrm_input(), esp_input(), crypto_aead_decrypt(), and pcrypt_aead_decrypt().\nAC:L - In load-responsive CPU-hotplug deployments, an attacker can flood qualifying ESP requests across repeated PADATA_RESET windows without precise timing or an uncontrollable memory-layout condition.\nPR:N - The ESP SPI is transmitted in clear, and the faulty path is reached before the child AEAD validates the integrity tag, so an unauthenticated on-path attacker needs no target-system privileges.\nUI:N - Packet delivery and asynchronous completion require no victim action.\nS:U - The failure affects the same kernel security authority processing the request and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The rejected request retains a zero padata->pd pointer, producing a NULL dereference without an out-of-bounds read or information disclosure.\nI:N - The callback writes only the completion status into its valid request context before dereferencing NULL; it provides no attacker-directed corruption or write primitive.\nA:H - padata_do_serial() dereferences the uninitialized padata->pd pointer, causing a kernel oops or panic that can terminate the system and can be retriggered."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64312","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64355","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A remote peer can send an oversized packet that a fragment-capable NIC represents as a multi-buffer XDP frame, reaching the vulnerable devmap broadcast clone path on a configured forwarding host.\nAC:L - No race or uncontrollable timing condition is required; fragmented packets reliably enter the faulty clone path and can be sent repeatedly.\nPR:N - Although initial-namespace CAP_BPF and CAP_NET_ADMIN are needed to configure the XDP deployment, the attacker sending packets through the already-configured unauthenticated data path needs no privileges.\nUI:N - Packet reception and XDP processing occur automatically without victim action.\nS:U - The corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other distinct boundary.\nC:H - Uninitialized fragment descriptors are consumed as page references and can be used by scatter-gather transmitters for unintended DMA mappings, potentially exposing arbitrary kernel memory.\nI:H - An uninitialized fragment count can overrun fixed-size driver arrays, while bogus page references can cause invalid refcount decrements, premature frees, and exploitable kernel memory corruption.\nA:H - Invalid fragment metadata can fault during DMA mapping, transmission, or frame return and cause a kernel oops or panic; an attacker can trigger this repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64355","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64383","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB server can trigger the flaw through crafted replayable responses and connection failures over the network.\nAC:L - The server controls both the replayable error and subsequent reconnect failure, allowing repeated triggering without an uncontrollable race.\nPR:N - The attacking SMB endpoint requires no privileges on the client system once an SMB session and file handle exist.\nUI:N - An automatically mounted share and routine service-generated fsync, truncate, timestamp, or seek operations can reach SMB2_flush() without human participation.\nS:U - The memory corruption compromises resources governed by the same host kernel security authority.\nC:H - The response-buffer double-free can create overlapping CIFS slab allocations and use-after-free primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and attacker-influenced overlapping network buffers can provide arbitrary-write or control-flow-hijacking primitives.\nA:H - The double-free can immediately trigger an allocator BUG, kernel oops, or panic and can be invoked repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64383","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64384","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious SMB server can return a replayable response and then force reconnect failure over the network, causing the client to free stale response state twice.\nAC:L - The peer controls both prerequisites by returning a status such as STATUS_RETRY and then disconnecting or refusing reconnection; repeated attempts make the scheduling window attacker-controllable.\nPR:N - The malicious SMB peer requires no account, capability, or other privilege on the vulnerable client; the established client session does not grant the attacker privileges on that host.\nUI:N - An ordinary automated CIFS workload can maintain an outstanding change-notify request, after which the remote peer completes the trigger without human involvement.\nS:U - Exploitation compromises the kernel and resources governed by the same host security authority, without crossing a separate virtualization or sandbox boundary.\nC:H - The double-free corrupts the CIFS response-buffer slab or mempool, permitting overlapping live objects and freelist manipulation that can support disclosure of arbitrary kernel memory.\nI:H - The heap corruption can provide attacker-influenced writes through aliased request and response buffers or freelist poisoning, potentially enabling kernel control-flow hijacking.\nA:H - Hardened allocators can immediately panic on the consecutive double-free, while unhardened allocators can crash later through freelist corruption."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64384","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64385","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - An attacker-controlled SMB server can deliver crafted SMB2 IOCTL responses over TCP, including through the kernel's periodic interface-query FSCTL on an existing SMB3 mount.\nAC:L - On a hard or retrans-enabled mount, the server controls replayable statuses, response contents, disconnects, reconnects, and repeated attempts, allowing it to drive both sides of the triggering sequence.\nPR:N - The malicious SMB server needs no account or privilege on the target; victim mounting authority and client authentication do not grant or require attacker-side target privileges.\nUI:N - Once the share is mounted, kernel delayed work can automatically issue the affected FSCTL when the server advertises multichannel support, requiring no user action during exploitation.\nS:U - The memory corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, container, or IOMMU boundary.\nC:H - The response-buffer double-free can corrupt SLUB or mempool state and create dangling or overlapping live buffers, enabling use-after-free exploitation and kernel-memory disclosure.\nI:H - Attacker-controlled network data can overwrite aliased or freed buffers and poison allocator state, supporting arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can trigger an allocator BUG or corrupt kernel heap state, causing an oops, panic, or complete system crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64385","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64386","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB2/3 server can remotely return a response-bearing replayable error and manipulate the subsequent connection state, reaching the vulnerable client over TCP.\nAC:L - The server controls the error response, disconnect, and reconnection sequence and can repeat it until the stale free occurs. Replay-enabled hard or retrans-configured SMB mounts are a reasonable deployment.\nPR:N - The malicious SMB peer needs no privileges or credentials on the client; SMB session setup authenticates the client to the server, not the attacker to the victim kernel.\nUI:N - Once the share is mounted, ordinary or automated file and metadata operations issue query-info requests, and exploitation requires no human action during the crafted response and reconnect sequence.\nS:U - The corruption and resulting impacts occur within the same Linux kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:H - The double-free corrupts SMB response-buffer slab and mempool state, enabling aliased or use-after-free buffers that can be leveraged to expose kernel memory.\nI:H - Allocator freelist corruption and reuse of one buffer by concurrent SMB operations can provide attacker-controlled modification of live kernel memory and support control-flow hijacking.\nA:H - The repeated free can immediately cause allocator corruption, a BUG, kernel oops, or panic, and the malicious server can trigger the sequence repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64386","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64387","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious remote SMB server can trigger the flaw through crafted responses to SMB2 QUERY_DIRECTORY requests over the established network connection.\nAC:L - On a hard/retrans-enabled mount, the server controls the replayable error and can repeatedly induce disconnect/reconnect conditions before request reinitialization, without relying on an uncontrollable race.\nPR:N - The attacker needs no account or privilege on the client; the client authenticates to the attacker-controlled SMB server, and ordinary accessible-share enumeration reaches the code.\nUI:N - In a reasonable auto-mounted deployment, routine directory enumeration can be performed automatically by a daemon or application without human participation.\nS:U - The corruption occurs within the client kernel and compromises resources governed by that same kernel security authority.\nC:H - Double-freeing the attacker-influenced CIFS response object can poison the slab freelist or create overlapping allocations, providing UAF-style primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and aliased CIFS buffers can enable attacker-influenced writes and potentially control-flow hijacking or kernel code execution.\nA:H - The double-free can immediately trigger allocator diagnostics, an oops, or a kernel panic, and corrupted freelists can cause subsequent fatal faults."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64387","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64423","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An end-to-end attacker-controlled trigger requires local socket and netlink operations to create multicast memberships and concurrently destroy IPv4 device state; received multicast packets alone cannot initiate the necessary teardown. These operations are reachable inside an attacker-created user and network namespace.\nAC:L - The attacker can populate mc_hash, generate continuous multicast traffic, and repeatedly tear down IPv4 state, controlling both sides of the race. No victim-dependent timing or secret state is required.\nPR:L - Device teardown or invalid-MTU configuration requires CAP_NET_ADMIN in the target network namespace, while multicast joins and UDP sends are unprivileged. An ordinary user can obtain this namespace-scoped capability through unprivileged user and network namespaces.\nUI:N - Exploitation requires no action by another user once the attacker can execute locally and create the required namespace and traffic.\nS:U - The vulnerable code and resulting host-kernel compromise remain within the same security authority; this is conventional kernel privilege escalation rather than a guest-to-host escape.\nC:H - The stale kmalloc-256 ip_mc_list entry exposes reuse-controlled fields and pointers to kernel reads, making kernel-memory disclosure and broader read primitives plausible.\nI:H - Reallocation permits attacker-influenced object contents to drive spinlock writes and pointer traversal on freed memory, making heap corruption and control-flow hijacking defensible.\nA:H - The confirmed slab use-after-free can dereference corrupted hash pointers or operate on an invalid spinlock, causing a kernel oops, panic, general-protection fault, or hang."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64423","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64450","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - TIPC packets can arrive through an IP/UDP bearer from a routable remote source, and the receive callback does not restrict packets to configured remote addresses. An attacker can also establish or spoof the required TIPC neighbour state without credentials.\nAC:L - The attacker controls capability advertisement, link establishment, broadcast synchronization, and the malformed STATE message; one packet then reliably performs the out-of-bounds copy without a race or uncontrollable condition.\nPR:N - The packet-receive path performs no capability or user-credential check, and TIPC discovery and link negotiation are unauthenticated when optional cryptographic keys are not configured. The vulnerable broadcast processing also precedes normal STATE-session validation.\nUI:N - No victim action is required after the TIPC bearer is active; receipt of the crafted STATE message directly invokes the vulnerable code.\nS:U - The vulnerability compromises availability and potentially confidentiality within the receiving kernel's existing security authority, without crossing a VM, IOMMU, or comparable scope boundary.\nC:H - The attacker-controlled count makes the kernel copy up to 1,024 bytes from a much smaller skb, incorporating substantial adjacent slab contents rather than a strictly bounded few-byte read.\nI:N - The defect performs an out-of-bounds read into a correctly sized new allocation; investigation found no out-of-bounds write, arbitrary-write primitive, or control-flow corruption.\nA:H - The demonstrated 1,024-byte slab-out-of-bounds access produces a KASAN BUG and can panic or fault hardened kernels, and an unauthenticated attacker can trigger it repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64450","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64481","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the vulnerable callbacks through ALSA control ioctls on /dev/snd/controlC*. No network or physical protocol directly exposes this path.\nAC:L - After teardown, stale controls can repeatedly dereference the freed object or queue its embedded work item, so exploitation does not require winning a narrow race. A queued work_struct also remains directly usable after its containing allocation is freed.\nPR:L - An unprivileged user with ordinary audio-device access can invoke the control callbacks. The ioctl path contains no capability, namespace, or administrative privilege check.\nUI:N - Exploitation requires no victim to open content or perform an interactive action.\nS:U - The vulnerable driver and the affected kernel resources are governed by the same kernel security authority.\nC:H - The heap use-after-free permits attacker-influenced reuse and disclosure of freed kernel object contents, potentially supporting arbitrary kernel memory reads.\nI:H - The freed object embeds mutable workqueue list state and a function pointer that is subsequently invoked, making kernel memory corruption and control-flow hijacking defensible.\nA:H - Stale control accesses or corrupted queued work can cause a kernel oops, panic, or workqueue corruption, resulting in complete system unavailability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64481","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64524","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The malicious resolution response must originate from the local Hyper-V synthetic-video backend over VMBus; it is not reachable through a network protocol or guest userspace ioctl.\nAC:L - The backend can deterministically trigger the flaw by returning a resolution_count from 65 through 255 during the normal WIN10+ probe or resume exchange, without a race or unpredictable condition.\nPR:N - The guest accepts the VMBus response without authentication, capability checks, or guest credentials; a malicious or compromised backend requires no privileges within the vulnerable guest.\nUI:N - The response is processed automatically during device probing or resume, without any victim action.\nS:U - The vulnerable parser and the affected DRM and kernel resources are within the same guest-kernel security authority; this does not produce a guest-to-host escape.\nC:H - A count of 255 causes 191 additional four-byte entries to be read beyond the declared array, substantially exceeding a small bounded disclosure and allowing out-of-bounds kernel data to influence observable display state.\nI:N - The invalid accesses are reads, and their results are written only to the intended resolution fields; no out-of-bounds write, use-after-free, or control-flow corruption was found.\nA:H - Bounds-instrumented hardened kernels can oops when index 64 is reached, while a failed or malformed resolution probe can leave zero maximum dimensions and make every userspace framebuffer creation fail."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64524","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64541","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable handler is driven entirely by a CDC control message sent by the remote SMC-R peer over the RDMA link, with an attacker-chosen `token` field and no local syscall involvement. SMC-R runs over RoCEv2 (IP/UDP-routable, port 4791) with the CLC handshake over plain TCP, and SMC-Rv2 explicitly supports non-local/routed peers, so the attacker need not share an L2 segment.\nAC:L - The attacker controls both sides of the race: it chooses when to emit CDC messages and which connection to target (the alert token is disclosed to it in the CLC accept/confirm), and it can drive the teardown side itself via CDC close/abort flags into `smc_close_passive_work()` or a stale seqno with `failover_validation` into `abort_work` -> `smc_conn_kill()`. The race can be retried indefinitely across many connections in the same link group, and was reproduced in practice with soft-RoCE.\nPR:N - Establishing an SMC-R connection to a listening SMC socket requires no credentials — SMC has no authentication layer of its own, exactly like plain TCP. Everything after connection establishment (sending CDC messages with a chosen token, signalling close/abort) is available to an unauthenticated peer.\nUI:N - The CDC message is processed in a softirq tasklet from the RDMA completion queue with no involvement from any local user or application action. No victim interaction of any kind is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard in-kernel use-after-free.\nC:H - The freed `smc_sock` is reused type-safely as another live socket, so attacker-supplied cursors applied by `smc_cdc_msg_recv_action()` break the `0 <= bytes_to_rcv <= rmb_desc->len` invariant and make `smc_rx_recvmsg()` hand stale RMB contents to userspace, while the urgent-data path reads `*(base + conn->urg_curs.count - 1)` at an attacker-chosen offset. Once the slab page is reclaimed after the RCU grace period, reuse is unconstrained, giving a general kernel-memory read primitive.\nI:H - `sock_hold()` on an already-zero refcount followed by `sock_put()` re-enters `sk_free()`, yielding a double free, and the handler additionally writes `sk_err`/`sk_shutdown`, makes indirect calls through `sk_data_ready()`/`sk_write_space()`, and `queue_work()`s a freed `work_struct`. These are classic heap-spray and control-flow-hijack primitives leading to arbitrary kernel write.\nA:H - The reported symptom is `refcount_warn_saturate` from `smc_cdc_msg_recv()`, which is an immediate kernel panic on `panic_on_warn` systems, and dereferencing freed memory in softirq context otherwise oopses. The attacker can trigger it repeatedly without authentication."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64541","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64543","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The free side is only reachable through the local TIPCv2 generic-netlink `BEARER_DISABLE` command (or netns teardown); a remote peer can supply the discovery packet that performs the use-after-free access but cannot itself cause `bearer_disable()` to run, so the complete attack requires local access.\nAC:L - The attacker controls both sides of the race — one thread floods TIPC discovery packets at the bearer's UDP port while another disables the bearer — and `bearer_disable()` clears `b->up` and then `kfree()`s the discoverer with no synchronization whatsoever, leaving a wide window that a multi-CPU packet flood hits reliably (a working PoC exists).\nPR:L - `tipc_genl_family` is `.netnsok = true` and the bearer enable/disable ops carry no `GENL_ADMIN_PERM` or other capability check, so an unprivileged user can do everything inside `unshare -Urn` after autoloading tipc via `socket(AF_TIPC, ...)`.\nUI:N - The attacking process performs both the bearer disable and the packet injection itself; no victim action or cooperating user is involved.\nS:U - The corruption stays within the kernel's own security authority — no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - `d->net` is read from the freed slab object and dereferenced as a `struct net *`; after reclaiming the kmalloc-192 allocation with sprayed data the attacker gains a controlled-pointer dereference chain usable for arbitrary kernel memory disclosure.\nI:H - `msg_set_prevnode(buf_msg(d->skb), sugg_addr)` writes a wire-controlled 32-bit value through the dangling `d->skb` pointer, and `tipc_disc_add_dest()` takes a spinlock and increments a counter in freed memory — together a controlled-address/controlled-value write suitable for control-flow hijacking.\nA:H - The use-after-free reliably produces a KASAN slab-use-after-free in softirq context and, on production kernels, a corrupted-pointer dereference or spinlock manipulation on reclaimed memory leading to kernel panic."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64543","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64562","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local KVM nested VMX: open /dev/kvm, run a nested guest, then tear down nested state (VMXOFF/handle_vmxoff or vmx_leave_nested). It is not reachable via network or adjacent-radio packets.\nAC:L - A KVM VMM attacker controls both sides of the race by driving nested teardown (VMXOFF/vcpu destroy) while forcing vCPU migration via thread affinity/scheduling so __loaded_vmcs_clear() VMCLEARs the dangling shadow VMCS pointer.\nPR:L - Exploitation needs permission to use /dev/kvm and nested VMX (commonly kvm-group or equivalent), not real init-namespace root; KVM create/run ioctls have no CAP_SYS_ADMIN gate on this path.\nUI:N - After the attacker has KVM/nested access, they trigger free_nested and migration themselves; no separate victim action is required.\nS:C - free_nested runs in host KVM while handling L1 nested VMX teardown, and the UAF corrupts host kernel memory, crossing the guest/hypervisor isolation boundary (guest-to-host escape class).\nC:H - The dangling shadow VMCS pointer lets VMCLEAR operate on a freed page that may be reused, yielding a host kernel use-after-free that can be leveraged for arbitrary information disclosure.\nI:H - VMCLEAR writes VMCS state into the freed page; with page reuse this is host heap corruption enabling write primitives and potential host code execution, consistent with UAF guidance.\nA:H - Use-after-free of the shadow VMCS page can oops/panic the host kernel when VMCLEAR or later accessors touch reallocated memory, fully denying host availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64562","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64563","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via local netlink sock_diag dumps (e.g. netlink_diag over NETLINK_SOCK_DIAG) and similar local dump walkers such as TIPC_NL_SOCK_GET; not reachable from remote packet processing.\nAC:L - Attacker controls both sides of the race by running a multi-fragment rhashtable dump while concurrently creating/destroying netlink (or TIPC) sockets to force table resize and free the walked object.\nPR:L - An unprivileged local user can open NETLINK_SOCK_DIAG and dump without CAP_NET_ADMIN; CAP_NET_ADMIN is only required for SOCK_DESTROY, and TIPC_NL_SOCK_GET likewise has no admin permission flag.\nUI:N - Exploitation requires only attacker-issued syscalls (netlink dump plus concurrent socket churn); no victim action is needed.\nS:U - Impact is memory corruption within the host kernel authority (local privilege escalation/crash), not a cross-boundary escape such as guest-to-host or IOMMU bypass.\nC:H - Use-after-free read of a freed hashed object (e.g. netlink_sock) can be reclaimed via heap spray, yielding an arbitrary read primitive through subsequent walk/diag use of the corrupted pointer.\nI:H - UAF on a reclaimable slab object enables heap spraying and fake-object injection into the walk path, which can be leveraged for arbitrary write or control-flow hijacking.\nA:H - The demonstrated KASAN slab-use-after-free in rhashtable_walk_next can oops/panic the kernel, and UAFs remain crashable even when not fully exploited."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64563","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64581","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via setsockopt(IP_XFRM_POLICY/IP_IPSEC_POLICY) on a local socket racing concurrent udp_sendmsg; entry is a local syscall path (do_ip_setsockopt -> xfrm_user_policy), not packet processing.\nAC:L - Attacker controls both sides of the race (one thread setsockopt to clear/apply per-socket xfrm policy, another sendmsg on the same connected UDP socket) and can create the obsolete xfrm_dst precondition in their netns, retrying until the double dst_release wins.\nPR:L - Path requires CAP_NET_ADMIN checked with sockopt_ns_capable(sock_net(sk)->user_ns), which an unprivileged user obtains via user+network namespaces; the fix commit explicitly states this reachability.\nUI:N - Exploitation uses only the attacker's own socket, threads, and setsockopt/sendmsg loops; no victim action or cooperation is required.\nS:U - Double-free/UAF of the socket's dst_entry/xfrm_dst is standard local kernel memory corruption within the host kernel authority, not a VM escape or other cross-boundary impact.\nC:H - Double dst_release frees the xfrm_dst slab object while still referenced, yielding a use-after-free that can be reclaimed/sprayed to disclose kernel memory via corrupted dst contents and ops.\nI:H - The UAF targets a dst_entry with function pointers (ops/input/output) used on transmit, enabling heap reuse for arbitrary write and control-flow hijack consistent with comparable sk_dst_cache races.\nA:H - The KASAN slab-use-after-free in dst_release demonstrates kernel memory corruption that can oops/panic, and the attacker can repeat the race freely."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68121","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in pppoe_sendmsg(), reached only via the local sendmsg() syscall on a PF_PPPOX/PPPoE socket; it is not triggered by remote packet reception or in-kernel PPP transmit paths such as __pppoe_xmit().\nAC:L - Exploitation requires a race between copy_from_user() blocking in sendmsg and changing team header_ops (e.g., adding the first non-Ethernet GRE port), which an attacker can drive with concurrent threads and retries rather than uncontrollable timing.\nPR:L - PPPoE sockets can be created without special privileges, and configuring the team/GRE topology needed to trigger dev_hard_header() head expansion is achievable with CAP_NET_ADMIN inside an unprivileged user/network namespace (unshare -Urn).\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through socket I/O and netlink/rtnl configuration of the team device.\nS:U - Impact is kernel heap corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - Writing PPPoE header fields through a stale pointer after pskb_expand_head() frees the old skb head is a slab use-after-free; freed kmalloc objects can be reclaimed for sensitive data, enabling arbitrary kernel memory disclosure.\nI:H - The post-dev_hard_header() memcpy/ph->length stores up to eight attacker-influenced bytes into freed skb head memory, providing a heap corruption primitive that can be developed into arbitrary kernel writes or code execution.\nA:H - Use-after-free writes into freed slab memory commonly cause kernel oops/panic and can be triggered repeatedly via sendmsg, yielding persistent denial of service even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68121","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68136","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached from the standard NAPI GRO receive path processing remotely originated TCP/IP packets (napi_gro_receive→dev_gro_receive→tcp_gro_receive→skb_gro_receive_list), including tethering/NAT/forwarding scenarios where packets re-enter GRO on a second netdev after driver LRO or prior GRO aggregation.\nAC:L - An attacker can reliably trigger the bug by crafting a TCP stream through a forwarding host with rx-gro-list enabled, without races or victim-specific timing; the commit documents a deterministic tethering/forwarding repro where flush-marked frag_list skbs are re-aggregated and later crash skb_segment.\nPR:N - No local privileges or authentication are required; any remote peer that can send TCP traffic through a vulnerable forwarding/tethering/NAT Linux host can reach the GRO fraglist merge path, which performs no capability or credential checks on the receive path.\nUI:N - Exploitation requires only network-delivered packets and normal kernel forwarding/GRO processing; the victim does not need to open files, mount filesystems, click links, or perform any deliberate action beyond routine network operation.\nS:U - Impact is confined to kernel memory corruption and panic within the same host kernel security domain during packet GRO aggregation and subsequent segmentation on transmit; it does not cross VM, container, or IOMMU boundaries to affect a separate security authority.\nC:H - Double aggregation corrupts the skb frag_list chain (loops, dangling references, NULL/corrupted list_skb pointers), constituting kernel heap memory corruption that can be read during skb_segment processing and is classifiable as a high-impact info-disclosure primitive beyond a simple crash.\nI:H - Re-aggregating flush-marked skbs with existing frag_list corrupts skb linked-list structure and reference relationships in kernel memory, enabling potential control of subsequent skb metadata and write/control-flow primitives during GSO segmentation, not merely integrity-preserving packet drops.\nA:H - Corrupted frag_list state causes skb_segment to dereference a NULL or invalid list_skb via skb_headlen(), producing a kernel panic/oops on the transmit path (sch_direct_xmit/qdisc_run), fully denying availability of the affected system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68136","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68138","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local RTM_NEWTFILTER rtnetlink messages (tc flower filter with police action) through rtnetlink_rcv_msg→tc_new_tfilter→fl_change→tcf_police_init→qdisc_get_rtab/qdisc_put_rtab; no remote packet or network protocol path exists.\nAC:L - cls_flower is TCF_PROTO_OPS_DOIT_UNLOCKED, so concurrent RTM_NEWTFILTER requests run without RTNL; the attacker controls both racing threads/CPUs and can repeatedly install flower filters with identical police rate tables to deterministically hit the global qdisc_rtab_list/refcnt race.\nPR:L - Non-GET rtnetlink handlers require netlink_net_capable(CAP_NET_ADMIN); this is namespace-scoped, so an unprivileged local user obtains CAP_NET_ADMIN via user namespaces (unshare -Urn), sets up clsact/ingress, and installs flower+police rules without init-namespace root.\nUI:N - Exploitation is fully self-contained: the attacker issues the concurrent tc/netlink commands from its own processes and needs no victim to mount filesystems, click links, or perform any other interactive action.\nS:U - Impact is heap corruption and UAF/double-free in kernel kmalloc-2k slabs within the same kernel security authority; although qdisc_rtab_list is global across netns, this is standard kernel memory corruption/privilege escalation, not a VM, IOMMU, or sandbox boundary escape.\nC:H - Concurrent non-atomic refcnt and list updates cause slab use-after-free/double-free of struct qdisc_rate_table (KASAN-confirmed in qdisc_put_rtab); freed 2KB objects are attacker-influenceable via kmalloc timing and are classically weaponizable for arbitrary kernel memory disclosure.\nI:H - The race corrupts a process-global singly linked list and can double-free a kmalloc-2k qdisc_rate_table, yielding classic heap metadata/object corruption primitives that can be developed into arbitrary kernel writes and local privilege escalation/code execution.\nA:H - Demonstrated KASAN slab-use-after-free in qdisc_put_rtab on the error/teardown path, and concurrent double-free of the same rate table can panic the kernel; the trigger is repeatable at will with concurrent netlink requests and causes task death or system-wide instability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68138","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68155","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when libceph decodes CEPH_MSG_MON_MAP from a remote Ceph monitor over the kernel client's established TCP/msgr2 session (mon_dispatch -> ceph_monc_handle_map -> ceph_monmap_decode), which is a network protocol attack surface on CephFS/RBD/cloud nodes.\nAC:L - An attacker who can send monitor protocol messages only needs to set num_mon=0 in the monmap; once accepted, any later session reopen (keepalive timeout, hunt, or connection fault) deterministically hits BUG_ON in pick_new_mon without races or special memory layout.\nPR:N - In the highest-impact scenario a malicious or compromised Ceph monitor (or equivalent authenticated cluster peer) sends the malformed monmap to already-connected kernel clients; the attacker needs no local privileges on the victim host.\nUI:N - After a Ceph client session exists, monmap updates are delivered and processed automatically by the kernel monitor client; no further mount, open, or other victim interaction is required to accept the bad map and later crash on reconnect.\nS:U - Exploitation causes a kernel BUG/panic within the same kernel security domain and does not cross VM, container, IOMMU, or other security boundaries.\nC:N - The failure mode is a BUG_ON assertion in pick_new_mon when num_mon is zero; there is no memory corruption, out-of-bounds access, or other information disclosure primitive on the vulnerable path.\nI:N - Accepting num_mon==0 only stores an empty monmap and later triggers a deliberate kernel BUG; attacker input does not corrupt or modify arbitrary kernel memory or enable code execution.\nA:H - BUG_ON(monc->monmap->num_mon < 1) in pick_new_mon during __open_session causes a kernel oops/panic, fully denying availability of the affected host until reboot."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68155","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68158","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Malformed incremental osdmap data is delivered in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch) to libceph clients (CephFS/RBD), and the overflow is triggered while decoding received network bytes in osdmap_apply_incremental().\nAC:L - A compromised or attacker-controlled monitor/OSD can publish an incremental osdmap with epoch N+1 and a crafted new_state length that wraps the multiply, reliably bypassing bounds checks without races or victim-specific memory layout.\nPR:N - Exploitation requires no privileges on the victim host; a malicious cluster peer or on-path attacker that can deliver forged osdmaps to an already-connected kernel Ceph client needs no local account, capabilities, or user-namespace tricks.\nUI:N - Once a host is a Ceph client, osdmap subscriptions and updates are applied automatically by the kernel; no additional mount, open, or interactive step is needed at exploit time beyond the existing client session.\nS:U - Impact is confined to kernel memory and libceph client state on the Ceph client host (info leak, map corruption, crash, or privilege escalation); it does not cross VM, IOMMU, or sandbox boundaries to another security authority.\nC:H - Integer-overflow bypass lets decode_new_up_state_weight() run bare ceph_decode_32/8 loops past the message end, performing out-of-bounds reads of adjacent kernel heap/slack memory that can disclose pointers and other sensitive data.\nI:H - Misaligned decoding also drives attacker-controlled osd/xorstate/weight values into map->osd_weight[], map->osd_state[], and map->osd_addr[] updates (including memset), corrupting kernel osdmap state in ways usable for further exploitation.\nA:H - Unbounded out-of-bounds reads while parsing osdmaps can fault on unmapped pages and trigger kernel oops/panic; map corruption can also cause persistent client failure, repeatable on each malicious incremental map."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68158","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68159","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Malicious pg_temp/pg_upmap data arrives in CEPH_MSG_OSD_MAP from a Ceph monitor or OSD over TCP, is decoded in libceph, and later triggers stack corruption in ceph_pg_to_up_acting_osds during RBD/CephFS/libceph client I/O.\nAC:L - A compromised or attacker-controlled monitor can publish osdmap entries with length >32 for chosen PGs; once the client subscribes, kernel I/O paths such as RBD mount/probe via calc_target deterministically invoke apply_upmap/get_temp_osds and overflow the stack buffer.\nPR:N - Exploitation requires no privileges on the victim host; any machine acting as a Ceph client that receives a forged osdmap from a cluster peer over the network can be attacked without local user capabilities or namespace tricks.\nUI:N - No victim user action is needed during exploitation beyond the host already being a Ceph client; forged osdmaps are applied automatically and the overflow fires on subsequent kernel client operations without interactive steps.\nS:U - Impact is confined to kernel memory on the Ceph client host (privilege escalation or crash); it does not cross VM, IOMMU, or sandbox boundaries to other security authorities.\nC:H - KASAN-confirmed stack out-of-bounds write in ceph_pg_to_up_acting_osds corrupts adjacent stack memory and can be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Unbounded copy loops in apply_upmap() and get_temp_osds() write attacker-controlled u32 OSD IDs past the fixed osds[CEPH_PG_MAX_SIZE] stack array, enabling control-flow hijack and arbitrary kernel writes.\nA:H - The reported reproducer triggers KASAN stack-out-of-bounds followed by kernel BUG in ceph_pg_to_up_acting_osds, demonstrating a reliable kernel oops or panic from malformed osdmap processing on Ceph clients."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68159","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68160","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - CEPH_MSG_CLIENT_CAPS is received over the kernel Ceph messenger TCP connection from an MDS peer; mds_dispatch() passes it directly to ceph_handle_caps(), so a malicious or compromised MDS (or on-path attacker on an unsigned msgr session) reaches the bug with network data alone.\nAC:L - The attacker fully controls msg->hdr.version and snap_trace_len in the caps header; setting version=1 bypasses all version-gated decoders and snap_trace_len=0xFFFFFFFF yields a fake end pointer that reliably defeats ceph_decode_need(), with no race or memory-layout dependency.\nPR:N - Exploitation requires only the ability to send crafted caps messages as the remote MDS peer on an established session; the attacker needs no account, mount privilege, or other credentials on the victim host beyond the client already being connected to that cluster.\nUI:N - Once CephFS is mounted and the MDS session is open, CEPH_CAP_OP_IMPORT caps messages are delivered and processed automatically during normal cap migration and MDS failover; no additional local user action is needed at exploit time beyond prior cluster connectivity.\nS:U - The out-of-bounds read and resulting snap-realm corruption affect only the kernel CephFS client’s internal state within the same kernel security authority; there is no VM escape, sandbox breakout, or cross-authority boundary crossing.\nC:H - ceph_update_snap_trace() decodes struct ceph_mds_snap_realm and snap arrays using an attacker-supplied fake end pointer, reading sizeof(*ri) and further attacker-influenced extents past the legitimate msg->front buffer into adjacent kernel memory without copying to userspace.\nI:H - Out-of-bounds kernel memory is interpreted as snap-realm metadata and copied via dup_array() into newly allocated kernel heap structures (realm->snaps, realm->prior_parent_snaps), corrupting authoritative snap state and providing a memory-corruption primitive that could be leveraged for further kernel compromise.\nA:H - Out-of-bounds reads can fault on unmapped pages causing a kernel oops; the ceph_update_snap_trace() error path issues WARN(1), fences I/O via CEPH_MOUNT_FENCE_IO, and can close all MDS sessions—effects an attacker can trigger repeatedly at will."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68160","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68202","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through ioctls on the local character device /dev/snd/seq (SNDRV_SEQ_IOCTL_CREATE_QUEUE/DELETE_QUEUE/SET_QUEUE_CLIENT); no network or adjacent-network path exists to the ALSA sequencer.\nAC:L - The attacker controls both sides of the race — one thread deletes the queue while another spins on SET_QUEUE_CLIENT holding a queueptr() reference — and can retry the loop indefinitely on a default kernel with CONFIG_SND_SEQUENCER, so the window is reliably hit.\nPR:L - Only an unprivileged local user able to open /dev/snd/seq is needed; snd_seq_queue_use() performs no owner or access check and no capability is required, as the fix commit states explicitly.\nUI:N - The attacker's own threads create, delete and re-use the queue and the global system timer fires on its own; no victim action is involved.\nS:U - The use-after-free corrupts kernel heap objects within the same kernel security authority, giving at most kernel privilege escalation rather than crossing a VM, IOMMU or sandbox boundary.\nC:H - The stale timer instance dereferences the freed snd_seq_queue and snd_seq_timer, reading tick/time fields and freed prioq pointers that can be reclaimed by attacker-sprayed objects, giving a route to disclose arbitrary kernel memory.\nI:H - snd_seq_timer_interrupt() writes cur_time, tick and last_update into the freed snd_seq_timer slab and snd_seq_check_queue() dispatches events through freed queue pointers, yielding a controllable write primitive on reclaimed heap memory suitable for privilege escalation.\nA:H - Even unexploited, the timer callback derefs freed memory and takes a spinlock in a freed object from interrupt context, causing oops, lock corruption or panic — a repeatable denial of service for any local user."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68202","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68397","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handler is registered via dev_add_pack() for ethertype ETH_P_AF_IUCV (0xFBFB) on every netdevice, so any peer LPAR/guest on the same HiperSockets internal LAN or any host on an attached Ethernet segment can drive afiucv_hs_rcv() with crafted frames; the frames are raw L2 and cannot be routed across an IP hop, so the vector is adjacent rather than network.\nAC:L - The attacker controls the packet side of the race outright (flooding 0xFBFB frames) and can drive the freeing side too, since SYN frames make a listener spawn and enqueue child sockets while FIN/SYN|FIN frames push sockets to IUCV_DISCONN and wake the application into close(), so the read_unlock()-to-handler window can be retried indefinitely until won.\nPR:N - afiucv_hs_rcv() runs from the netif RX softirq and processes any matching frame with no authentication, credential check, or capability test anywhere on the path; the attacker needs no account or privilege on the target s390 system.\nUI:N - No victim action is required: the attacker's own frames both create the AF_IUCV child sockets and trigger the state changes that lead to their teardown, and the packet handler runs unconditionally in softirq context.\nS:U - The freed struct sock and the resulting corruption stay inside the kernel of the affected LPAR or z/VM guest; no hypervisor, IOMMU, or container boundary is crossed.\nC:H - This is a use-after-free on a socket allocated from a generic kmalloc cache (iucv_proto is registered without its own slab), so an attacker who reclaims the object has the kernel read attacker-influenced or stale heap contents through sk fields, sk_filter()'s BPF program pointer, and the iucv backlog queues, yielding kernel memory disclosure.\nI:H - After the free the handlers perform indirect calls through the freed object (sk->sk_data_ready(), sk->sk_state_change(), sk_filter()) and writes into it (sk_state, atomic_sub on iucv->msg_sent, skb_queue_tail() list-pointer updates), giving control-flow hijack and write primitives once the slab object is reclaimed with attacker-controlled data.\nA:H - Dereferencing the freed socket from softirq context reliably produces an oops or \"Fatal exception in interrupt\" panic, and the attacker can repeat the frame flood at will, causing complete loss of availability of the IBM Z LPAR or guest."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68397","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68398","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The free side of the race is a local close() of the pppol2tp socket, which no remote peer can invoke; the full attack (create tunnel/session via AF_PPPOX socket, drive RX with loopback UDP datagrams, close concurrently) is performed entirely through local syscalls.\nAC:L - The attacker controls both sides of the race, feeding the UDP-encap RX softirq from one thread while closing the pppox socket on another, and can retry the loop indefinitely until the window is hit.\nPR:L - No capability check exists on this path: pppox_create()/pppol2tp_connect() and ppp_register_net_channel() need no CAP_NET_ADMIN, and PPPIOCGCHAN is handled by pppox_ioctl() on the socket itself, so /dev/ppp access is not required; the fix commit states the bug is reachable by an unprivileged user.\nUI:N - The attacker performs every step — socket creation, session setup, packet injection and close() — with no action by any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the channel is freed and its slab object reallocated, ppp_input() reads pch->bridge and pch->ppp from attacker-groomed memory and can route received frames to an arbitrary attacker-chosen structure, giving a path to disclosing kernel memory.\nI:H - skb_queue_tail(&pch->file.rq, skb) writes a linked-list insertion into the freed object and wake_up_interruptible(&pch->file.rwait) traverses a freed waitqueue, so heap grooming yields controlled writes and function-pointer traversal usable for privilege escalation.\nA:H - Dereferencing and writing to the kfree()d struct channel from softirq context reliably corrupts the slab and panics or oopses the kernel, and the race can be re-triggered at will."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68398","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68417","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access to the RDMA character devices (/dev/infiniband/uverbsN for create_qp and /dev/infiniband/rdma_cm for the QPN lookup); no network packet reaches the racing code path without a local trigger first.\nAC:L - The attacker controls both sides of the race: one thread issues create_qp while another issues rdma_connect/rdma_accept with an attacker-supplied qp_num, and QPNs from xa_alloc(XA_FLAGS_ALLOC1) are predictable. The post-publish failure can be made deterministic by passing a short udata->outlen, so the window is wide and repeatable at will.\nPR:L - Any unprivileged local user with access to the siw uverbs and rdma_cm character devices can create QPs and issue rdma_connect/rdma_accept with an arbitrary qp_num; no capability check gates siw_create_qp, siw_connect or siw_accept.\nUI:N - The attacker drives both the QP creation and the concurrent QPN lookup from its own threads; no action by any other user or administrator is needed.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU or sandbox boundary.\nC:H - The siw_qp object can be kfree'd by the ib core error path while the CM thread still holds a reference, giving a use-after-free on a slab object the attacker can groom and read back through QP/CM state, enabling disclosure of arbitrary kernel memory.\nI:H - After the free, siw_free_qp() performs list_del(&qp->devq), vfree() of four pointer fields and siw_put_tx_cpu(qp->tx_cpu) using values read from reallocated attacker-controlled memory, yielding arbitrary-pointer free, list-unlink writes and out-of-range per-CPU decrements suitable for control-flow hijacking.\nA:H - Even without exploitation the race reliably causes kernel crashes: NULL sendq/recvq/scq/rcq dereferences, list_del on an uninitialized devq head, waits on an uninitialized qp_free completion, and use-after-free oopses."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68417","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68426","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPsec transmit path (validate_xmit_xfrm) which processes any skb routed into an offloaded SA, including GRO-aggregated traffic forwarded from remote hosts on an IPsec gateway; xfrm_dev_offload_ok() has no socket/local-origin requirement, so a remote peer's packet stream drives the vulnerable GSO segmentation and async-crypto steal directly.\nAC:L - The attacker drives both preconditions with traffic alone: sustained large GSO flows keep the crypto engine backlogged so ->xmit() returns -EINPROGRESS routinely, and packet volume advances xo->seq.low toward the wrap that forces segmentation; each stolen trailing segment reproduces the stale skb->prev, and the subsequent tail->next write is deterministic once it occurs.\nPR:N - On an IPsec gateway the traffic that triggers the path is forwarded from remote, unauthenticated senders — no account, credentials, or capability on the target host is needed, since the SA and offload are pre-existing administrative configuration rather than something the attacker must set up.\nUI:N - No victim action is required; the vulnerable code runs automatically in softirq context on every qualifying transmit, driven purely by the attacker's packet stream.\nS:U - The corruption is of kernel sk_buff list state within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Writing through the stale ->prev is a use-after-free on an skb whose memory the attacker can influence via heap grooming with concurrent traffic; per kernel UAF guidance this yields a high-confidentiality primitive, and the corrupted list can splice engine-owned skbs into the transmit path, exposing freed/reused memory contents on the wire.\nI:H - tail->next = skb is an attacker-influenced pointer write into freed heap memory, and the resulting skb list corruption lets live and engine-owned skbs be chained together; this is classic heap corruption that can be shaped via spraying into an arbitrary write or control-flow hijack.\nA:H - Even without full exploitation the use-after-free write and the double-ownership of a stolen segment cause list corruption, double-free/oops and kernel panic in the softirq transmit path, taking down the gateway."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68426","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72020","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when a host running the IPVS backup sync receiver processes forged UDP sync datagrams (default multicast 224.0.0.81:8848) in ip_vs_process_message(), which is a network packet receive path rather than a local-only ioctl/netlink interface.\nAC:L - Once IPVS backup sync is enabled, an attacker can reliably send IPVS v1 messages that set IP_VS_CONN_F_IN_SEQ/OUT_SEQ while omitting IPVS_OPT_SEQ_DATA; no race, heap grooming, or victim-specific state beyond matching syncid (often 0) is required.\nPR:N - The backup sync socket accepts unauthenticated UDP input with no capability checks; only an optional syncid filter (frequently left at 0) may drop messages, so the attacker needs no Linux privileges to inject the malformed sync records.\nUI:N - No end-user or administrator interaction is required at exploit time; the attacker directly delivers crafted sync messages to the listening backup daemon without victims opening files, clicking links, or changing settings.\nS:U - Exploitation stays within the IPVS load balancer kernel/network authority and affects connections it forwards; it does not constitute a VM escape, sandbox breakout, or cross-security-authority boundary such as guest-to-host.\nC:H - Uninitialized ip_vs_seq init_seq and previous_delta fields retain stale slab data that vs_fix_seq()/vs_fix_ack_seq() apply when rewriting forwarded TCP seq/ack numbers, leaking kernel heap bytes onto the network to clients or backend servers.\nI:H - Those same uninitialized sequence-adjustment fields cause incorrect TCP sequence/ack rewriting in NAT/application-helper paths (ip_vs_app_pkt_in/out), corrupting load-balanced TCP flows and enabling attacker-driven manipulation of forwarded traffic integrity.\nA:H - Corrupted TCP sequence handling breaks or resets connections on the virtual service and can be triggered repeatedly via additional forged sync messages, causing sustained denial of service to load-balanced traffic on the affected backup node."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72020","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72069","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On CONFIG_PREEMPT_RT, every spin_unlock() is substituted by rt_spin_unlock(); network subsystems such as netfilter xt_hashlimit process inbound packets through hashlimit_mt_common(), spin_lock/unlock on RCU-protected dsthash_ent objects concurrently freed via call_rcu by GC—the exact embedded-spinlock UAF pattern from the fix.\nAC:L - The bug is a cross-CPU race where rt_spin_unlock() calls rcu_read_unlock() before releasing the rtmutex, ending the RCU grace period while still dereferencing the lock; syzbot triggered this reliably on PREEMPT_RT via concurrent unlinkat and dentry teardown, and attackers control both sides with parallel syscalls or packet/GC load.\nPR:N - Remote attackers need no account, capability, or authentication to send packets that hit deployed hashlimit rules on internet-facing PREEMPT_RT gateways; the proven syzbot unlinkat path needs only directory write permission (PR:L), but PR:N reflects the highest-severity unauthenticated network packet scenario.\nUI:N - No victim interaction is required; the attacker drives the race through their own concurrent filesystem syscalls (syzbot: unlinkat racing __fput/dentry_kill) or sustained inbound traffic overlapping netfilter GC, without needing another user to open files or mount filesystems.\nS:U - The UAF corrupts kernel slab memory containing embedded spinlock/rtmutex fields and enables privilege escalation within the same kernel security authority; it does not inherently cross VM/guest, container sandbox, or IOMMU hardware isolation boundaries.\nC:H - Syzbot reported KASAN slab-use-after-free Read in rt_mutex_slowunlock during spin_unlock on a freed dentry in shrink_dcache_tree; the systemic UAF lets attackers read freed objects (dentry, dsthash_ent, etc.) after premature RCU grace-period completion, enabling kernel pointer and memory disclosure.\nI:H - UAF on embedded rtmutex fields inside freed slab objects (dentry->d_lock per syzbot) permits heap grooming and reallocation of attacker-controlled data, providing standard kernel heap corruption primitives for arbitrary write and control-flow hijack beyond the immediate crash.\nA:H - Syzbot hit KASAN slab-use-after-free causing kernel fault in shrink_dcache_tree via rt_spin_unlock on PREEMPT_RT; the bug can oops/panic any RT kernel whenever spin_unlock races RCU-deferred free of the containing object, enabling repeatable denial of service via concurrent VFS or netfilter operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72069","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72072","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is reached by racing MACSEC_CMD_DEL_RXSC/ADD_RXSC netlink configuration (GENL_ADMIN_PERM) against mlx5e MACsec RX processing; the privileged genlink/rtnl control path is required to trigger the bug, not remote packets alone.\nAC:L - An attacker with CAP_NET_ADMIN can drive both sides by looping RX SC add/delete while flooding MACsec-offloaded RX traffic on the mlx5e netdev, reliably winning the RCU race between xa_load/dst_hold and metadata_dst_free.\nPR:L - MACsec offload mutations require GENL_ADMIN_PERM (CAP_NET_ADMIN); on Mellanox ConnectX/BlueField systems this is reachable by cloud tenants with SR-IOV VFs, containers, or user/network namespaces without init-namespace root.\nUI:N - No victim user action is needed; automated concurrent netlink MACsec operations and incoming MACsec-offloaded frames on an active mlx5e interface suffice once MACsec offload is configured.\nS:U - Impact is kernel heap use-after-free and memory corruption within the host kernel on the mlx5 NIC; it enables local privilege escalation but does not by itself cross VM, IOMMU, or hypervisor security boundaries.\nC:H - The race calls dst_hold() and skb_dst_set() on a freed metadata_dst, a classic slab UAF that can disclose kernel memory through subsequent dst_entry and MACsec skb metadata handling.\nI:H - Freed metadata_dst objects can be reallocated via heap spraying while the RX datapath still references them, enabling refcount corruption and arbitrary kernel memory writes or control-flow hijack beyond a mere crash.\nA:H - Concurrent use of freed md_dst during mlx5e MACsec RX processing can cause immediate kernel oops, BUG, or panic on datacenter/cloud hosts using mlx5 hardware MACsec offload, fully denying system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72072","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72083","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On LIO/iSCSI storage servers and appliances, a remote initiator sends PERSISTENT_RESERVE_OUT with REGISTER AND MOVE over TCP (port 3260); iscsit_process_scsi_cmd()→target_execute_cmd()→target_scsi3_emulate_pr_out()→core_scsi3_emulate_pro_register_and_move() with no local access required.\nAC:L - The attacker fully controls the PR-OUT parameter list length (>4096 to force vmap/vunmap), iSCSI TransportID format 01b with ISID, and can establish prerequisite PR registration and reservation via prior SCSI commands on the same session; no uncontrollable race or layout dependency exists.\nPR:N - Exploitation requires only the ability to act as a network SCSI/iSCSI client with LUN access to an exported target; no Linux UID, capability, or init-namespace root on the storage server is needed—only standard iSCSI initiator connectivity (CHAP/ACL when configured).\nUI:N - Triggering is fully automated once an iSCSI session exists: the attacker issues scripted REGISTER, RESERVE, then REGISTER AND MOVE commands with a crafted >4 KiB parameter list; no victim mount, click, or other interactive action is required.\nS:U - The UAF corrupts kernel heap state inside the target-core PR handler on the storage host; impact stays within that kernel security domain and does not inherently cross VM, container, or IOMMU boundaries (standard host compromise, not escape).\nC:H - After vunmap(), iport_ptr aliases freed kernel virtual address space and is dereferenced in strcmp(), __core_scsi3_locate_pr_reg(), and snprintf() into pr_reg_isid; per kernel CVSS guidance, UAF reads enable arbitrary kernel memory disclosure when uncertain.\nI:H - UAF reads of attacker-influenced unmapped PR-OUT data drive strcmp-based registration matching and snprintf copies into persistent kernel pr_reg structures; memory corruption/UAF is scored High for integrity because it can be leveraged for control-flow or state manipulation.\nA:H - Dereferencing iport_ptr after transport_kunmap_data_sg() vunmap() on multi-page buffers causes immediate invalid kernel virtual address accesses (oops/panic) on every qualifying REGISTER AND MOVE; UAF availability impact is High per kernel guidance even before full exploit development."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72083","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72084","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered by a PERSISTENT RESERVE OUT SCSI command delivered over the LIO iSCSI target fabric (TCP/3260); remote initiators reach `iscsi_parse_pr_out_transport_id()` after login and normal SCSI command processing, and the fix commit notes the same path via vhost-scsi-backed exports.\nAC:L - An attacker fully controls the PR-OUT parameter list and can reliably supply a FORMAT CODE 01b iSCSI TransportID without a \",i,0x\" separator or NUL terminator and size it past one page so `strstr()` over-reads into the vmalloc guard page; no races or victim-specific memory layout are required.\nPR:N - Exploitation requires only completing iSCSI login to an exported LUN as any initiator client, not host administrator privileges; LIO demo mode auto-provisions initiator ACLs and many storage appliances expose iSCSI targets to the network without mapping this to elevated OS credentials.\nUI:N - No end-user or administrator action beyond normal automated iSCSI target operation is needed; a remote initiator can send the malicious PR OUT command directly once a session to the LUN exists.\nS:U - The flaw corrupts or reads kernel memory and crashes the target host kernel within the same kernel security boundary; it does not by itself cross a VM, container, or IOMMU isolation boundary to another authority.\nC:H - Unbounded `strstr()` and an unbounded `%s` on the error path perform out-of-bounds reads past the received PR-OUT buffer, potentially disclosing adjacent kernel memory before the fault, matching CVSS guidance for out-of-bounds reads beyond a few bytes.\nI:H - A malformed TransportID can leave the ISID pointer one byte past the descriptor so subsequent registration code dereferences out of bounds, and the ISID normalization loop can write with `tolower()` beyond the buffer, giving a memory-corruption primitive in kernel context.\nA:H - The over-read into a multi-page vmalloc mapping hits the guard page and triggers a KASAN vmalloc-out-of-bounds fault and kernel oops, remotely denying service to the host and all consumers of the iSCSI target."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72123","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local BCM socket syscalls (sendmsg with RX_SETUP/SETTIMER/ival2 throttling and RX_DELETE); CAN frames can be injected locally via loopback without physical bus access.\nAC:L - The attacker controls both sides of the race by concurrently issuing RX_DELETE teardown and delivering matching CAN frames (e.g., via threads or paired BCM/RAW sockets), making the thrtimer re-arm UAF reliably triggerable.\nPR:L - No kernel capability check gates AF_CAN/CAN_BCM socket creation or bcm_sendmsg opcodes; any unprivileged local user with socket access (including via user namespaces with vcan) can reach the vulnerable path.\nUI:N - No victim interaction is required; the attacker self-triggers the race through their own BCM socket operations and locally injected CAN traffic.\nS:U - Impact is confined to kernel memory corruption and local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM or IOMMU bypass.\nC:H - The thrtimer UAF dereferences freed bcm_op fields (locks, frame buffers, op->sk) in bcm_rx_thr_handler/bcm_send_to_user, enabling attacker-controlled heap reuse and arbitrary kernel memory disclosure.\nI:H - UAF on the bcm_op slab object allows heap spraying to corrupt function pointers, timers, and sock structures, providing a standard path to arbitrary kernel writes and local privilege escalation.\nA:H - The freed-op dereference in the hrtimer softirq path causes kernel oops/panic under normal exploitation attempts, and successful memory corruption can crash or hang the system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72123","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72135","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local pread()/write() syscalls on /dev/tpm0 or /dev/tpmrm0 character devices; there is no network, Bluetooth, or physical-bus code path to the vulnerable tpm_common_read() handler.\nAC:L - An attacker who can open the device reliably triggers the bug by writing any TPM command to create a pending response, then calling pread() with a large offset; no races or special memory layout are required.\nPR:L - Upstream tpm2-tss udev rules grant non-root users in the tss group read/write access to /dev/tpmrm0 (mode 0660), which is the standard TPM2 user-space interface on laptops and servers with TPM hardware.\nUI:N - No victim interaction is required; the attacker opens the TPM device, submits a command, and issues the malicious pread() themselves without relying on another user to mount, click, or configure anything.\nS:U - The vulnerability corrupts kernel heap memory in the TPM driver on the same host; it does not by itself cross a VM, container, or IOMMU security boundary to affect a different trust domain.\nC:H - Unchecked pread offsets cause copy_to_user() to read beyond the 4096-byte data_buffer into adjacent kmalloc slab memory (including tpm_space pointers), leaking kernel heap contents to userspace.\nI:H - A successful out-of-bounds pread also executes memset() past data_buffer, zeroing adjacent heap objects such as tpm_space session/context pointers and enabling further memory corruption or control-flow manipulation.\nA:H - KASAN reports slab-out-of-bounds faults on both the copy_to_user read and memset write; corrupting adjacent heap structures can oops or panic the kernel during subsequent TPM operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72135","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72221","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Reachable over TCP by any remote peer of an in-kernel NFS/RPC server (nfsd) via the pre-auth RPC_AUTH_TLS NULL-procedure STARTTLS path that invokes svc_tcp_handshake() on the accepted SUNRPC transport.\nAC:L - The attacker controls both sides of the race by timing TLS client handshake messages against the fixed 5-second SVC_HANDSHAKE_TO and opening many parallel connections to reliably hit the cancel-lost window.\nPR:N - No credentials or export authorization are required; svcauth_tls_accept() accepts empty AUTH_TLS on RPC NULL from any TCP client, and svcauth_unix_set_client() skips IP export checks when rq_proc==0.\nUI:N - Exploitation requires only scripted network connections and TLS client traffic to nfsd; no victim user interaction such as mounting a filesystem or opening a file is needed.\nS:U - Memory corruption occurs in nfsd kernel worker context on the same host; impact is kernel privilege compromise within the server security authority, not a VM escape or IOMMU boundary bypass.\nC:H - A second svc_tcp_handshake() can call init_completion() while svc_tcp_handshake_done() concurrently calls complete_all(), corrupting the embedded swait_queue in heap-allocated svc_sock and enabling arbitrary kernel memory disclosure.\nI:H - Corrupting completion wait-queue metadata in the svc_sock heap object can be leveraged for arbitrary kernel writes and control-flow hijacking to achieve local privilege escalation on the NFS server.\nA:H - The swait_queue corruption can trigger kernel oops/panic, and the alternate race path tears down connections whose TLS handshake is about to succeed, enabling repeatable remote denial-of-service against nfsd."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72221","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72222","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in nfsd's server-side SUNRPC/TCP TLS handshake (net/sunrpc/svcsock.c), reached when a remote peer connects to port 2049 and sends a pre-authentication AUTH_TLS NULL STARTTLS probe that triggers svc_tcp_handshake() via svcauth_tls_accept().\nAC:L - The attacker controls both sides of the race by initiating AUTH_TLS handshakes and concurrently resetting/closing TCP or waiting for SVC_HANDSHAKE_TO while tlshd delivers completion; repeated parallel connections make the overlap window reliably reachable.\nPR:N - AUTH_TLS is processed on RPC procedure 0 before credentials are verified, so an unauthenticated remote client can reach svc_tcp_handshake() and the asynchronous callback without any account, export access, or kernel capability.\nUI:N - nfsd worker threads automatically accept the TCP connection, process the STARTTLS probe, run the TLS handshake, and handle teardown/completion callbacks without any local user or administrator action.\nS:U - Exploitation corrupts kernel memory on the NFS server host itself and does not cross a VM-guest/host, sandbox, or IOMMU security boundary; impact stays within the kernel's security authority.\nC:H - svc_tcp_handshake_done() use-after-frees svc_sock and performs set_bit/clear_bit RMW on freed xpt_flags plus complete_all() on freed sk_handshake_done, a slab-corruption UAF that can disclose arbitrary kernel memory.\nI:H - The same UAF delivers attacker-timed writes into reclaimed slab slots through atomic bit operations and wait-queue list updates, enabling heap grooming and further kernel memory corruption for arbitrary modification or code execution.\nA:H - Slab corruption and UAF during handshake completion can cause kernel oops/panic, and unauthenticated remote peers can trigger the fault repeatedly by overlapping TLS handshake completion with connection close."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72222","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72251","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit in nf_nat_sip() from sip_help_udp/tcp() during nf_confirm() on POST_ROUTING/LOCAL_IN while processing attacker-supplied SIP/UDP or SIP/TCP packets traversing a netfilter NAT gateway, so exploitation is via remote network traffic rather than local syscalls or physical access.\nAC:L - Once nf_conntrack_sip and nf_nat_sip are active on a NATed SIP flow, a remote peer can set forced_dport with a crafted Via header and drive the reply-path skb_ensure_writable() reallocation on cloned skbs without races or rare layout luck.\nPR:N - Exploitation needs no privileges on the victim kernel; a remote SIP endpoint only has to send malicious SIP through an already-configured SIP conntrack/NAT helper, with no authentication or local access to the firewall or router.\nUI:N - No victim user action is required beyond normal automated packet forwarding; the SIP helper parses and NAT-rewrites attacker-supplied SIP data in softirq during connection-tracking confirmation without opening files, clicking links, or mounting filesystems.\nS:U - Impact stays within kernel netfilter/conntrack memory on the same security authority (for example a NAT firewall, SBC, or VoIP gateway). This is standard kernel memory corruption, not a VM escape, sandbox breakout, or cross-tenant boundary violation.\nC:H - skb_ensure_writable() can free the old linear buffer while *dptr still points into it; sip_help_tcp() then continues parsing with that stale pointer, giving a use-after-free read of freed skb data and enabling disclosure of adjacent kernel heap contents.\nI:H - The stale dptr UAF and, on TCP flows, mistaken nf_nat_mangle_udp_packet() header rewriting corrupt kernel packet-buffer memory; such heap corruption is exploitable with grooming for arbitrary writes, control-flow hijacking, and kernel code execution.\nA:H - Use-after-free and mis-mangled L4 headers during softirq SIP NAT processing can trigger kernel oops/panic or reliably drop or corrupt in-flight VoIP signaling, causing high availability impact on internet-facing NAT/SBC systems handling SIP."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72251","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72262","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl on /dev/snd/controlC* (SNDRV_CTL_IOCTL_TLV_WRITE/READ) through the ALSA control device; there is no network, adjacent-radio, or physical-bus attack surface for this SOF IPC3 kcontrol path.\nAC:L - On affected SOF IPC3 systems with topology bytes_ext controls, an attacker can deterministically trigger the bug by issuing TLV writes with header.length equal to max_size, causing copy_from_user/memcpy to overrun the kzalloc(max_size) buffer by sizeof(struct sof_ipc_ctrl_data).\nPR:L - The fix commit states the overflow is reachable from unprivileged userspace via ALSA TLV kcontrols; any local user who can open the sound control device (typically membership in the audio group on Linux, or an app with audio access on Android/ChromeOS) can reach the vulnerable code without real root.\nUI:N - Exploitation is performed entirely by the attacker issuing ALSA TLV ioctls against an existing bytes_ext kcontrol; no victim click, mount, or other interactive action beyond the attacker's own access to the sound control interface is required.\nS:U - The vulnerability corrupts kernel heap memory from a local userspace context and enables standard kernel privilege escalation or denial of service; it does not cross a VM, container, or IOMMU security boundary into a separate authority.\nC:H - The get path can copy_to_user up to sizeof(struct sof_ipc_ctrl_data) bytes beyond the allocated ipc_control_data buffer, leaking adjacent kernel heap contents; combined with the controllable overflow, this is an out-of-bounds read/memory corruption primitive consistent with arbitrary disclosure potential.\nI:H - The put path performs an out-of-bounds heap write of up to sizeof(struct sof_ipc_ctrl_data) bytes past the kzalloc(max_size) allocation (including via the err_restore memcpy), enabling heap metadata/object corruption that can be developed into arbitrary kernel write or code execution.\nA:H - Heap out-of-bounds writes of roughly 96 bytes into adjacent slab objects can corrupt kernel structures and trigger oops/panic or wedged audio/subsystem state; repeated TLV operations make denial of service reliably achievable even without full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72262","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72288","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached only from KVM guest MMIO traps on GICv3 redistributor GICR_CTLR LPI-disable writes, ITS MOVI affinity changes, and vCPU-exit paths into vgic_prune_ap_list(); no network-facing host protocol is involved.\nAC:L - A guest controls all three racing vCPUs by pinning threads to concurrently issue ITS MOVI, cross-vCPU GICR_CTLR LPI-disable writes, and vCPU exits that invoke vgic_prune_ap_list(); the attacker creates and wins the race rather than depending on uncontrollable host timing.\nPR:N - No host privileges are required beyond running code in an assigned KVM guest (e.g. a cloud VM tenant on arm64); exploitation needs guest-kernel access to GIC/ITS MMIO, not host root or capabilities in the init namespace.\nUI:N - Exploitation is fully attacker-driven from within a multi-vCPU guest VM and does not require any victim user or administrator action on the host.\nS:C - The use-after-free corrupts host-kernel heap memory (struct vgic_irq) from guest-controlled VGIC operations, crossing the guest-to-host virtualization security boundary with VM-escape impact.\nC:H - vgic_flush_pending_lpis() can free the LPI vgic_irq while vgic_prune_ap_list() still dereferences it after reacquiring dropped locks, yielding a kernel heap use-after-free exploitable for arbitrary host memory disclosure via heap grooming.\nI:H - The dangling vgic_irq pointer permits attacker-influenced writes through irq_lock, list_head, vcpu, and target_vcpu fields during ap_list migration, enabling host control-flow or data corruption primitives.\nA:H - The race frees live kernel objects still referenced by the ap_list migration path, causing host kernel oops, panic, or hang during list_del, lock operations, or subsequent LPI delivery on arm64 KVM hosts."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72288","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72289","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only from KVM guest execution paths—GICv3 redistributor GICR_CTLR LPI-disable MMIO traps into vgic_flush_pending_lpis() and vCPU exit/sync paths into vgic_prune_ap_list()—not from any remote network, adjacent-radio, or physical-device interface on the host.\nAC:L - A malicious multi-vCPU guest controls both racing sides by pinning threads, changing LPI affinity via ITS so an interrupt must migrate off one vCPU's ap_list, and concurrently disabling LPIS on that redistributor; the attacker creates the window rather than depending on uncontrollable host timing or memory layout.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant on arm64 KVM who needs no host privileges beyond code already running inside the assigned guest; exploitation uses guest-kernel GIC MMIO/ITS operations, not host root, CAP_SYS_ADMIN in the init namespace, or additional /dev/kvm access beyond having a VM.\nUI:N - Exploitation is fully attacker-driven from within the guest VM through deliberate LPI setup, affinity changes, and timed GICR_CTLR writes; no victim user or administrator action on the host is required beyond normal VM operation.\nS:C - Double list_del()/list_add_tail() on host-kernel ap_list linkages corrupts KVM VGIC state from guest-controlled interrupt operations, crossing the guest-to-host virtualization security boundary with VM-escape-class impact rather than confining damage to the attacker's VM.\nC:H - Corrupting detached ap_list pointers and inserting them into another vCPU's ap_list_head enables out-of-bounds kernel linked-list traversal and disclosure of adjacent kmalloc slab memory (struct vgic_irq and neighboring objects); per kernel guidance, this list corruption is leverageable for arbitrary host memory read primitives.\nI:H - The vulnerable path performs list_del() on an already removed entry and may follow with list_add_tail() onto another vCPU's ap_list, letting a guest steer kernel list pointers and overwrite adjacent vgic_irq/host heap metadata for control-flow or data corruption on the hypervisor.\nA:H - Re-running list_del() on an entry already removed by vgic_flush_pending_lpis() dereferences poisoned list pointers and corrupts live ap_list_heads, causing immediate host kernel BUG/oops/panic or persistent interrupt-delivery failure during subsequent VGIC processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72289","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72317","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in the SUNRPC TCP-with-TLS client connect_worker processing a remote NFS server's TLS handshake; a malicious or misconfigured server can induce fatal handshake failure over the network before the delayed worker runs, matching network-reachable kTLS/RPC-with-TLS client paths.\nAC:L - An attacker operating a reachable NFS endpoint can reliably cause fatal TLS handshake failure (e.g., reject mTLS client certificates or send TLS alerts) and influence reconnect timing/backoff so client teardown frees rpc_clnt before the queued connect_worker executes.\nPR:N - Exploitation requires no privileges on the victim host; a remote peer only needs the client kernel to initiate or re-establish an NFS RPC-with-TLS connection, and TLS handshake processing occurs before NFS authentication completes.\nUI:N - No further victim action is needed once an NFS xprtsec=tls/mtls mount exists because automatic reconnect after server-induced disconnect or handshake failure can trigger the race without additional user interaction.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is standard local kernel compromise rather than crossing VM, container, or IOMMU security scopes.\nC:H - This is a kernel heap use-after-free where xs_tcp_tls_setup_socket reads multiple fields from a freed rpc_clnt (including cl_cred and cl_program), enabling information disclosure and further exploitation beyond a simple crash.\nI:H - Use-after-free of rpc_clnt permits corrupting allocator metadata and adjacent kernel objects; freed-object reuse can yield arbitrary write or control-flow hijack primitives, not merely authenticated data alteration.\nA:H - Accessing the freed rpc_clnt produces a refcount_t underflow and kernel oops/panic; even unsuccessful exploitation typically crashes or hangs the system, and repeated reconnect attempts can deny availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72317","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72339","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the qede NIC RX fastpath reached when remote Ethernet frames are received, hardware posts completion queue entries, and NAPI runs qede_poll() -> qede_rx_int() -> qede_rx_process_cqe()/qede_tpa_start() into qede_rx_build_skb() or qede_tpa_rx_build_skb().\nAC:L - An attacker can reliably trigger build_skb() NULL returns by flooding the interface with frames larger than rx_copybreak (256 bytes) to exhaust GFP_ATOMIC skb slab allocations, then the off-by-one BD consumption desynchronizes the ring without races or victim-specific state.\nPR:N - No local account, capability, or authentication is required; any unauthenticated remote host that can send IP/Ethernet traffic to a server using a Marvell/QLogic FastLinQ qede NIC can hit the vulnerable RX/TPA handlers.\nUI:N - Exploitation requires no victim interaction beyond normal network operation; packet reception, MSI-X interrupt handling, and NAPI polling process attacker-supplied frames automatically in kernel context.\nS:U - The flaw corrupts kernel heap metadata (DMA page refcounts and SLUB freelists) within the host kernel security boundary; it does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - BD ring desynchronization corrupts DMA page reference counts and can corrupt SLUB freelists; this class of kernel heap corruption is exploitable for arbitrary kernel memory reads and information disclosure beyond a simple crash.\nI:H - SLUB freelist corruption from mismatched BD ring consumption enables arbitrary kernel memory writes and control-flow hijacking primitives, supporting local privilege escalation or arbitrary code execution in kernel context.\nA:H - Reference-count and SLUB corruption from the desynchronized BD ring can cause kernel BUG/oops/panic or a wedged RX datapath, resulting in complete loss of host availability on affected systems."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72339","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72389","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation is via local RTNETLINK/ioctl to create a down bridge, enable kernel STP, enslave ports, and delete the bridge; remote STP BPDU handling is blocked when IFF_UP is clear, so the arming path that leaves timers active on a down bridge is local.\nAC:L - The public PoC uses a reliable, attacker-controlled netlink sequence (down bridge + kernel STP + port state progression + dellink) without winning races; per-port forward-delay timers deterministically reach br_topology_change_detection and arm topology_change_timer before deletion.\nPR:L - All reachable paths (RTM_NEWLINK/DELLINK, IFLA_BR_STP_STATE, enslaving ports) require CAP_NET_ADMIN, which unprivileged users can obtain in user/network namespaces (unshare -Urn, Kubernetes NET_ADMIN, LXC/libvirt network namespaces).\nUI:N - Triggering requires only programmatic bridge configuration by the attacker; no victim must click, mount, or open anything beyond the attacker's own netlink operations.\nS:U - Impact is kernel memory corruption and privilege escalation within the same kernel/host security domain; it does not cross a VM, container-to-host, or IOMMU boundary by itself.\nC:H - Use-after-free of the net_device/net_bridge kmalloc object lets an attacker reclaim freed slab memory and obtain arbitrary kernel read/disclosure primitives from corrupted timer and bridge structures.\nI:H - Disclosed analysis and PoC show the dangling timer callback can hijack control flow by reclaiming the freed object with attacker-controlled data, replacing the timer function pointer for arbitrary kernel code execution.\nA:H - Deleting the bridge with active STP timers queued causes the per-CPU timer wheel to invoke callbacks on freed memory, producing kernel BUG/oops/panics and denial of service even if full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72389","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74345","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit while processing attacker-supplied MPA/TCP data on an inbound SIW listener socket during connection establishment, which is a standard network protocol path analogous to other in-kernel TCP service handlers.\nAC:L - An attacker fully controls the TCP connection and malformed MPA request bytes that deterministically fail parsing and drive the endpoint teardown path where the refcount bug frees the cep before it is accessed again.\nPR:N - Exploitation requires only the ability to open a TCP connection to a host running an SIW RDMA listener; the MPA handshake is unauthenticated and occurs before any RDMA credentials or local privileges are established.\nUI:N - No end-user action is required at exploit time; the kernel processes the malicious inbound connection automatically once an administrator has started an RDMA listener service.\nS:U - Impact is confined to kernel memory corruption and potential host privilege escalation within the same kernel security authority, not a VM escape or cross-authority boundary such as guest-to-hypervisor.\nC:H - The vulnerability is a slab use-after-free on a freed siw_cep object; UAF on attacker-influenced connection teardown enables heap grooming and arbitrary kernel memory read primitives beyond a simple crash.\nI:H - Use-after-free of the connection endpoint structure in kernel heap can be leveraged for controlled writes and code execution via object reuse and function pointer/callback corruption, not merely data integrity of a single field.\nA:H - The bug was reproduced as a KASAN slab-use-after-free in siw_cm_work_handler during malformed MPA processing, which can cause kernel oops/panic and denial of service on the target host."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74345","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74377","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires mutating mmap'd receive WQEs through /dev/infiniband/uverbs; inbound RoCE packets (rxe_udp_encap_recv→rxe_rcv→rxe_receiver) only trigger processing and cannot alter WQE fields without local control of the userspace-mapped receive queue.\nAC:L - The attacker controls both sides of the TOCTOU—userspace threads racing num_sge/sge edits while posting recv WRs and driving inbound RoCE SEND/WRITE traffic—so out-of-bounds reads in rxe_resp_check_length() and copy_data() are reliably triggerable with retries.\nPR:L - uverbs_devnode() publishes /dev/infiniband/uverbsN as mode 0666, letting any local account create userspace QPs and mmap receive queues; rxe link setup needs CAP_NET_ADMIN obtainable in a user+network namespace via unshare -Urn, matching PR:L kernel guidance.\nUI:N - Exploitation is entirely self-driven from the attacker's own RDMA verbs client and concurrent userspace threads; no victim user action, mount, or file open is required.\nS:U - Impact is kernel memory corruption and local privilege escalation within the host kernel security authority, not a VM guest-to-host escape, IOMMU/DMA boundary bypass, or other cross-scope compromise.\nC:H - Inflating num_sge or rewriting sge entries during processing causes out-of-bounds reads in rxe_resp_check_length() and copy_data() beyond the allocated WQE slot, potentially into adjacent vmalloc/kernel memory, enabling arbitrary kernel information disclosure.\nI:H - copy_data() walks attacker-forged out-of-bounds sge entries and performs rxe_mr_copy writes of incoming RDMA payload into MR-backed memory; combined with queue overruns this yields controlled memory corruption exploitable for arbitrary write and code execution.\nA:H - Processing a WQE with an attacker-inflated num_sge causes the kernel to walk far past valid sge slots, dereferencing invalid pointers and corrupting memory, reliably producing kernel oops/panic and total loss of availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74377","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74378","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local process with mmap write access to the SRQ receive queue shared with the kernel; although incoming RoCE/UDP packets trigger get_srq_wqe(), a remote peer cannot modify num_sge in the victim's userspace-mapped WQE buffer, so the TOCTOU overflow cannot be achieved from the network alone.\nAC:L - The attacker controls both sides of the race: a userspace thread that repeatedly rewrites num_sge in the mmap'd SRQ entry and the thread/process that posts recv WQEs and receives the triggering RoCE Send/Write packet, making the TOCTOU window reliably winnable without external timing luck.\nPR:L - An unprivileged local user with access to /dev/infiniband/uverbs can create an SRQ (mmap'd queue), associate a QP, and post recv buffers via ibverbs; rxe device setup via \"rdma link add type rxe\" is reachable with CAP_NET_ADMIN inside a user namespace (unshare -Urn).\nUI:N - No victim user interaction is required; the attacker operates their own malicious RDMA userspace process and can self-trigger the vulnerable responder path with RoCE request packets once SRQ/QP resources are configured.\nS:U - The heap overflow corrupts kernel memory within the rxe_qp responder context on the same host kernel, enabling local privilege escalation rather than crossing a VM, container, or IOMMU security boundary to impact a different authority.\nC:H - The attacker-controlled memcpy size causes an out-of-bounds copy from the mmap'd SRQ ring buffer and overflows the fixed qp->resp.srq_wqe kernel buffer, enabling adjacent kernel heap data disclosure and providing primitives that can be developed into arbitrary kernel memory reads.\nI:H - Overflowing qp->resp.srq_wqe corrupts subsequent fields in rxe_resp_info/rxe_qp (e.g., responder resource pointers and state), giving a kernel heap buffer overflow that can be leveraged for arbitrary kernel memory writes and local privilege escalation.\nA:H - Corrupting responder state inside rxe_qp can cause kernel oops/panic or wedged RDMA processing during packet handling; even failed exploitation attempts can crash the kernel through use of corrupted function pointers and queue state."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74378","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74390","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl on /dev/infiniband/uverbs to register CQ/QP/SRQ memory via irdma_reg_user_mr; the bug is not reachable from remote iWARP/RoCE packet handling.\nAC:L - An attacker fully controls reg_type, cq_pages/sq_pages/rq_pages, and umem size; triggering lvl==0 with many DMA blocks is deterministic and needs no races or special memory layout.\nPR:L - Any unprivileged local user who can open the uverbs device (mode 0666) and use the RDMA NIC—typical on cloud/HPC RDMA nodes—can invoke the vulnerable MR registration path without real root.\nUI:N - No victim interaction is required; the attacker triggers the overflow directly through their own RDMA verbs memory registration calls.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel security boundary, not a cross-VM or cross-IOMMU sandbox escape.\nC:H - The out-of-bounds write of attacker-influenced DMA addresses into adjacent irdma_mr/iwpbl heap metadata can be leveraged for arbitrary kernel memory read primitives, not merely a bounded leak.\nI:H - Controlled out-of-bounds u64 writes past pgaddrmem[4] corrupt adjacent kernel heap structures and are suitable for control-flow or arbitrary kernel write exploitation.\nA:H - Heap corruption in a kzalloc'd irdma_mr can cause immediate kernel oops/panic during registration or on subsequent use of corrupted queue memory metadata."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74390","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74394","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - SRPT is an in-kernel SCSI RDMA target reached by remote initiators over InfiniBand/RoCE via RDMA/IB CM; malicious SRP_CMD IUs are delivered through `srpt_recv_done()` without any local syscall or physical access.\nAC:L - Once connected on an immediate-data SRPT target (use_srq=0), a malicious initiator deterministically sets `imm_buf->len=0xFFFFFFFF` to wrap `req_size` and bypass checks; no race or attacker-uncontrollable condition is required.\nPR:N - SRPT enables LIO demo mode (`srpt_check_true`), so any remote initiator that completes SRP login on an enabled target gets a dynamic ACL without target-local credentials, root, or CAP_NET_ADMIN on the victim host.\nUI:N - Exploitation requires only attacker-initiated RDMA connection, SRP login, and crafted SRP_CMD traffic; no administrator or other user must mount storage or perform any action on the target.\nS:U - The integer overflow corrupts kernel heap memory and SCSI-target processing within the host kernel's own security authority; it does not cross VM, IOMMU, or container sandbox boundaries.\nC:H - Passing a ~4GB length to `sg_init_one()` on a small receive buffer creates a massive out-of-bounds scatterlist; subsequent target-core DMA/map operations can read far beyond the buffer, enabling arbitrary kernel memory disclosure.\nI:H - The bogus scatterlist gives the block/SCSI target path an attacker-controlled ~4GB kernel memory write/read primitive over adjacent heap objects, exploitable for control-flow hijacking and privilege escalation.\nA:H - Out-of-bounds access from a ~4GB scatterlist on a kilobyte-scale receive buffer readily triggers kernel oops, KASAN faults, or panic, denying availability even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74394","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74488","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when the mwifiex driver processes attacker-supplied A-MSDU TDLS frames received over WiFi from a nearby peer, AP, or injector on the same wireless segment, which is an adjacent RF attack vector rather than remote Internet or local syscall access.\nAC:L - Once TDLS-capable mwifiex firmware receives an A-MSDU, the attacker fully controls subframe sizes and TDLS content to trigger either the skb use-after-free or the overstated-length out-of-bounds parse reliably without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation requires only the ability to deliver crafted 802.11 data frames to the victim radio; it does not require any local account, capability, or root access on the Linux host and is not gated by user-namespace privilege boundaries.\nUI:N - No victim user action beyond normal wireless operation is required; the driver parses malicious TDLS subframes automatically during receive and A-MSDU decomposition before forwarding traffic to the network stack.\nS:U - Impact is confined to kernel memory corruption and driver state within the host kernel security authority; it does not by itself cross a VM, container, or IOMMU boundary to affect a separate security domain.\nC:H - The skb use-after-free reads freed sk_buff metadata and the inflated length drives an out-of-bounds IE walk that reads kernel memory beyond the subframe, including attacker-positioned bytes from subsequent A-MSDU subframes, enabling substantial information disclosure.\nI:H - The same out-of-bounds parse copies attacker-controlled IE data from beyond the subframe into heap-allocated sta_node/tdls_cap structures via memcpy, providing a memory-corruption primitive that can be developed into arbitrary kernel write or code execution.\nA:H - Reading skb->len after the parent A-MSDU skb may already be freed can immediately fault or corrupt memory, and the out-of-bounds TDLS element parsing can provoke kernel oopses or panics even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74488","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74496","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is opened only via local FOU_CMD_ADD genetlink into fou_create(); remote UDP can race the dangling sk_user_data read in fou_udp_recv/gue_udp_recv but cannot alone reach the erroneous teardown path.\nAC:L - An attacker with CAP_NET_ADMIN controls both sides: issue a second FOU_CMD_ADD with port 0 to force -EALREADY on fou_add_to_port_list while concurrently sending UDP/GRO traffic to the just-bound ephemeral socket during the kfree window.\nPR:L - FOU_CMD_ADD is gated by GENL_ADMIN_PERM (CAP_NET_ADMIN); the fou genl family is netnsok, so a user with CAP_NET_ADMIN inside unshare -Urn can configure FOU and trigger the failing add path without init-namespace root.\nUI:N - Exploitation is fully programmatic via concurrent netlink FOU_CMD_ADD requests and attacker-controlled UDP packets; no victim mount, file open, or other interactive action is required.\nS:U - Impact is kernel heap corruption and privilege escalation within the same security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Concurrent readers call fou_from_sock() and dereference freed struct fou fields (family, protocol, flags); reclaimed slab contents give attacker-controlled reads and kernel pointer disclosure primitives typical of UAF.\nI:H - Freed struct fou is attacker-reclaimable kmalloc memory; fou_gro_receive indexes inet_offloads[fou->protocol] from the dangling pointer, enabling heap grooming for arbitrary writes and control-flow hijack.\nA:H - Use-after-free in UDP receive/GRO softirq reliably causes KASAN violations and, on production kernels, invalid pointer dereferences or panics when accessing the freed fou object during packet processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74496","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74516","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires triggering KVM nested SVM/AVIC paths via local /dev/kvm ioctls (KVM_CREATE_VM, KVM_CREATE_VCPU, KVM_RUN) from L1; there is no network, adjacent, or physical packet/device path to the vulnerable code.\nAC:L - An L1 attacker fully controls nested VM configuration (x2APIC, AVIC, L2 MSR bitmap, IRQ-window/ExtINT conditions) and can reliably reproduce AVIC inhibition while L2 is active without races or uncontrollable host state.\nPR:H - Reaching the bug requires running nested AMD KVM as L1 (nested virtualization enabled and control of a guest hypervisor), which is not available to an unprivileged host user or via user-namespace capabilities alone without delegated /dev/kvm access.\nUI:N - No victim interaction is required; exploitation is driven entirely by the attacker’s nested hypervisor configuration and KVM_RUN operations once nested virtualization is available.\nS:C - The flaw lets an L1 nested guest hypervisor access the host’s physical x2APIC MSRs, crossing the VM/host security boundary rather than staying within the guest’s own security scope.\nC:H - With x2APIC MSR intercepts left disabled, L1 can read most of the host APIC state (IDs, IRR/ISR, timers, ICR), leaking sensitive host interrupt-controller information beyond the guest boundary.\nI:H - L1 can write host x2APIC MSRs to send arbitrary IPIs, change task priority, and invoke host interrupt vectors (e.g. posted-interrupt wakeup), enabling host integrity compromise beyond mere guest-local effects.\nA:H - Host availability is trivially impacted by injecting spurious or high-priority interrupts to host CPUs; the fix commit demonstrates host kernel warnings and spurious interrupt storms causing denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74516","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74518","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local hugetlb reservation paths (mmap/memfd_create/fault syscalls into region_chg/region_add/region_del); no network protocol or remote packet handler invokes allocate_file_region_entries().\nAC:L - Exploitation needs a race while resv->lock is dropped during GFP_KERNEL allocation, but an attacker can spawn concurrent MAP_SHARED mappers/faulters on one hugetlb inode and controls both sides of that race.\nPR:L - Unprivileged local users can trigger this via memfd_create(MFD_HUGETLB) plus MAP_SHARED mmap/fault activity, or by mapping accessible shared hugetlbfs files, without init-namespace root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the needed concurrent syscalls and shared hugetlb mappings themselves to hit the corrupted list splice retry path.\nS:U - Impact is kernel hugetlb resv_map list/memory corruption on the host; it does not by itself cross a VM, IOMMU, or separate security-authority boundary even though KVM/DPDK hosts are a prime deployment.\nC:H - Without CONFIG_DEBUG_LIST, stale list_splice leaves a kernel-stack pointer in resv->region_cache, producing later use-after-free that can be turned into arbitrary kernel memory read/disclosure primitives.\nI:H - Corrupted region_cache pointers let subsequent region_add/region_del/cache operations write through attacker-influenced list links, enabling heap metadata corruption and potential arbitrary kernel write or code execution.\nA:H - Real host panics were reported on dense KVM hugetlb workloads; DEBUG_LIST kernels BUG on list_add corruption, and default builds can crash from UAF while walking the poisoned region_cache."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74518","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74537","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the Bluetooth ISO stack; iso_conn_ready runs from HCI connection-confirmation events (CIS/BIS/PA sync) driven by LE isochronous traffic from Bluetooth peers within radio range, which is an adjacent attack surface (phones, earbuds, automotive, embedded).\nAC:L - This is a use-after-free race between iso_conn_ready and iso_sock_release/iso_sock_kill; an attacker who controls both an ISO socket close and concurrent HCI completion (e.g., dual-thread connect/close or rapid adjacent CIS/BIS establish-teardown) can reliably trigger it without uncontrollable conditions.\nPR:N - Exploitation requires no elevated credentials on the victim: HCI events are processed for any Bluetooth-enabled device in range, and the racing socket close can occur from automatic stack/daemon teardown during connection setup without the victim performing privileged local actions.\nUI:N - No victim interaction is required when the OS Bluetooth stack (e.g., LE Audio on Android phones or bluetoothd on Linux) automatically manages ISO sockets during pairing, reconnection, or broadcast sync while processing peer-initiated CIS/BIS traffic.\nS:U - The UAF corrupts kernel socket memory and can enable local privilege escalation within the kernel; it does not cross a VM, container, or IOMMU security boundary, so scope remains unchanged.\nC:H - Use-after-free on struct sock after iso_sock_kill frees the socket lets an attacker dereference attacker-influenced freed heap memory, enabling arbitrary kernel memory disclosure via heap grooming and reuse of the sock object.\nI:H - The UAF touches sk->sk_state and sk->sk_state_change during iso_sock_ready on a freed sock, providing a standard kernel heap corruption primitive that can be leveraged for arbitrary write and control-flow hijack.\nA:H - Concurrent iso_sock_kill and iso_conn_ready can dereference freed socket memory, causing kernel oops/panic from invalid lock_sock/sk_state access; UAF in the Bluetooth ISO path is inherently a high-availability risk even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74537","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74556","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised iSCSI target delivers crafted SCSI Command Response PDUs over the established TCP iSCSI session; reception flows through iscsi_sw_tcp_recv/iscsi_tcp_recv_skb into iscsi_tcp_hdr_dissect without local access.\nAC:L - The attacker controls the target and can set DataSegmentLength between 8193 and negotiated max_recv_dlength (open-iscsi commonly 262144) on SCSI_CMD_RSP for any outstanding command ITT; no races or victim-specific heap layout are required.\nPR:N - No privileges on the victim host are needed; a remote attacker acting as or MITMing the iSCSI target sends malicious responses after session login, independent of victim user accounts or capabilities.\nUI:N - On systems with persistent iSCSI sessions (cloud VMs, SAN-boot hosts, Kubernetes iSCSI volumes), exploitation triggers automatically during normal SCSI I/O when command responses are received; no victim action is needed at attack time.\nS:U - Heap corruption is confined to the kernel iSCSI initiator on the affected host; successful exploitation yields kernel compromise or DoS within the same security authority, not a VM escape or cross-boundary scope change.\nC:H - iscsi_tcp_segment_recv memcpy writes up to max_recv_dlength bytes into an 8192-byte conn->data buffer, causing a large heap overflow whose controlled corruption can be leveraged for arbitrary kernel memory disclosure.\nI:H - Attacker-controlled response data is copied past the fixed conn->data allocation via iscsi_tcp_data_recv_prep/iscsi_segment_init_linear, enabling heap metadata/object corruption exploitable for arbitrary kernel write and privilege escalation.\nA:H - Overflowing the conn->data heap buffer can immediately corrupt adjacent kernel allocations and cause oops/panic; a malicious target can repeatedly trigger this on active sessions to deny storage availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74556","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74581","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - fib6_rule_suppress() runs on every IPv6 route lookup via fib6_rule_lookup(), including ip6_route_input() for received packets and icmp6/icmpv6 redirect handlers; WireGuard/VPN servers commonly deploy suppress_prefixlength rules (wg-quick), so remote IPv6 traffic to those hosts reaches the bug.\nAC:L - Once suppress_prefixlength IPv6 policy routing rules exist, any matching packet deterministically triggers fib6_rule_suppress() to release the route while leaving a stale res->rt6 pointer; no race or uncontrollable memory layout is required.\nPR:N - Remote exploitation needs only the ability to send IPv6 packets through a host whose operator already configured suppress rules (e.g., wg-quick); CAP_NET_ADMIN is an admin deployment prerequisite, not attacker privilege on the target.\nUI:N - No victim action is required beyond normal delivery of attacker-generated IPv6 traffic (or ICMPv6 redirect) to a host performing policy-route lookup.\nS:U - The stale rt6_info/dst_entry UAF corrupts kernel heap memory within the same host security boundary; it is not a VM escape or cross-authority sandbox break.\nC:H - Returning a released rt6_info leaves a dangling dst_entry in ip6_dst_cache; subsequent reads through ip6_dst_idev(), dst metrics, or error paths are classic slab UAF with attacker-influencable heap reuse via sustained IPv6 traffic.\nI:H - Double-free/imbalanced rcuref put and post-free use of rt6_info fields give heap corruption primitives; UAF on dst/route cache objects is routinely leveraged for kernel write and control-flow hijack.\nA:H - Commit explicitly reports rcuref_put_slowpath() WARN from dst_release() on the freed route; UAF and refcount corruption can oops/panic the kernel, fully denying availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74582","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb->data before skb->head, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74612","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":10,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Remote packets routed through container/host veth pairs reach veth_xdp_rcv_skb() after veth_xmit on the peer; cloud and edge nodes routinely forward Internet traffic across veth links with XDP attached, matching the reproduced UDP receive path.\nAC:L - The fix commit shows 10/10 reliable reproduction with a 60000-byte UDP datagram and XDP bpf_xdp_adjust_tail()/bpf_xdp_pull_data() fragment shrink; the attacker controls packet size, timing, and both veth ends without races or uncontrollable kernel state.\nPR:N - Exploitation only requires an XDP program using bpf_xdp_adjust_tail or bpf_xdp_pull_data to already be attached on a reachable veth peer; the remote packet sender needs no local account, capabilities, or authentication to trigger the bad skb length accounting.\nUI:N - No victim interaction is needed beyond normal always-on packet reception and socket delivery; corrupted payloads and leaked kernel metadata are produced automatically when a userspace process reads the affected datagram.\nS:C - veth links intentionally cross container/host network namespaces on multi-tenant servers, and skb_shared_info metadata plus kernel pointers leaked into a tenant userspace recv buffer exceed that tenant's authorized security boundary.\nC:H - Desynchronized skb->len makes skb_headlen() exceed the real linear tail, so __skb_datagram_iter() copies up to 1024 bytes past the skb into userspace, exposing nr_frags, xdp_frags_size, and a kernel pointer from skb_shinfo(skb)->frags[0].\nI:H - The same length mismatch inflates the linear region, displacing and truncating real datagram bytes in the delivered UDP buffer and corrupting application-visible data beyond intended packet bounds while compounding misuse of leaked kernel metadata.\nA:H - bpf_xdp_pull_data() can leave frags present while the old __skb_put() path hits SKB_LINEAR_ASSERT()/BUG_ON on nonlinear skbs; the commit reports deterministic kernel asserts and crashes in addition to datagram corruption."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74612","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74669","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74669","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74695","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug fires in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS when remotely sourced IPv4/IPv6 packets matching an offloaded flow are received on nftables flowtable-bound interfaces, not via netlink configuration APIs.\nAC:L - Once a flowtable ingress hook and offloaded TCP/UDP flow exist, an attacker can reliably send matching traffic that reaches FLOW_OFFLOAD_XMIT_NEIGH or the XFRM offload path with a ref-counted skb dst; syzbot reproduced this without uncontrollable races.\nPR:N - Exploitation requires only sending network traffic through an already deployed nftables flow-offload path on an ingress device; no local account, authentication, or CAP_NET_ADMIN on the victim is needed to trigger the leak.\nUI:N - No victim interaction is required beyond normal network delivery; packets are processed automatically in softirq on the netdev ingress netfilter hook without opening files or mounting filesystems.\nS:U - Impact is confined to kernel refcount imbalance and availability degradation on the affected host; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:N - The flaw leaks a dst_entry reference by overwriting skb->_skb_refdst without releasing the prior dst; it does not expose kernel memory or provide an arbitrary read primitive.\nI:N - No unauthorized data modification occurs; the skb is forwarded using the intended flowtable destination while the previous dst reference is orphaned, not corrupted into a controllable write primitive.\nA:H - Each matching packet leaks a dst_entry refcount on the flowtable fast path, enabling sustained unauthenticated remote memory exhaustion on high-volume routers; CONFIG_DEBUG_NET builds also emit WARN_ON_ONCE during the overwrite."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74695","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-80722","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - Malformed S1G TWT setup action frames reach mac80211 via normal WiFi RX (driver -> ieee80211_rx_h_action -> ieee80211_process_rx_twt_action -> ieee80211_s1g_rx_twt_setup); an adjacent attacker within radio range sends crafted 802.11 management frames to a vulnerable AP.\nAC:L - The attacker fully controls the TWT element length and payload; ieee80211_process_rx_twt_action() only validates two bytes of req_type before queueing, so a short individual agreement reliably reaches drv_add_twt_setup() without races or victim-specific timing.\nPR:N - No Linux privileges on the victim AP are required; exploitation needs only normal 802.11 association as a WiFi client to an S1G AP with twt_responder enabled and a driver implementing add_twt_setup (e.g. MediaTek mt7915/mt7996).\nUI:N - No deliberate victim action is needed beyond operating an S1G AP that accepts associated stations; the attacker directly injects the malformed TWT setup frame and mac80211 processes it automatically on receive.\nS:U - Impact is kernel/driver heap memory corruption on the AP host within the same security authority; it does not cross VM, IOMMU, or sandbox boundaries (standard kernel compromise scope).\nC:H - drv_add_twt_setup(), its tracepoint, and driver callbacks read the full ieee80211_twt_params (twt, min_twt_dur, mantissa, channel) beyond the validated skb bounds, causing out-of-bounds reads of adjacent skb/heap memory that can disclose kernel data.\nI:H - MediaTek add_twt_setup() handlers write twt_agrt fields (req_type, min_twt_dur, twt) past the undersized params block into skb tail/heap memory, providing out-of-bounds write primitives exploitable for further memory corruption or code execution.\nA:H - Out-of-bounds access in mac80211/driver TWT setup can kernel-oops the AP or hang/crash WiFi firmware when corrupted parameters are programmed into hardware TWT state from attacker-controlled short frames."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80722","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4369-1","advisory_id":"ddb2c304-0ccc-4573-96b3-606b178f0dff","event_types":["advisory"],"published_at":"2026-10-25T22:45:55.826745+00:00","technologies":["core-osv","kernel-64kb","kernel-default","kernel-default-base","kernel-docs","kernel-livepatch-sle15-sp6-update-31","kernel-obs-build","kernel-source","kernel-syms","kernel-zfcpdump"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:46:28+00:00","detail_url":"/advisories/advisory%3Addb2c304-0ccc-4573-96b3-606b178f0dff","group":{"id":"advisory:ddb2c304-0ccc-4573-96b3-606b178f0dff","revision":1,"primary_event_id":71343,"change":"published","superseded_by":[],"changed":{"id":71343,"cve_ids":["CVE-2024-44981","CVE-2024-57841","CVE-2025-38469","CVE-2025-40022","CVE-2025-68179","CVE-2025-68214","CVE-2025-71104","CVE-2026-23210","CVE-2026-23230","CVE-2026-23451","CVE-2026-23454","CVE-2026-31502","CVE-2026-43147","CVE-2026-43456","CVE-2026-45968","CVE-2026-52910","CVE-2026-52912","CVE-2026-52929","CVE-2026-52977","CVE-2026-52994","CVE-2026-53059","CVE-2026-53110","CVE-2026-53163","CVE-2026-53260","CVE-2026-53264","CVE-2026-53365","CVE-2026-53366","CVE-2026-53381","CVE-2026-63801","CVE-2026-63823","CVE-2026-63827","CVE-2026-63879","CVE-2026-63881","CVE-2026-63886","CVE-2026-63887","CVE-2026-63888","CVE-2026-63920","CVE-2026-63944","CVE-2026-63970","CVE-2026-63972","CVE-2026-63973","CVE-2026-63992","CVE-2026-64000","CVE-2026-64002","CVE-2026-64007","CVE-2026-64010","CVE-2026-64011","CVE-2026-64015","CVE-2026-64018","CVE-2026-64029","CVE-2026-64034","CVE-2026-64048","CVE-2026-64098","CVE-2026-64109","CVE-2026-64114","CVE-2026-64115","CVE-2026-64121","CVE-2026-64217","CVE-2026-64247","CVE-2026-64266","CVE-2026-64268","CVE-2026-64304","CVE-2026-64312","CVE-2026-64355","CVE-2026-64383","CVE-2026-64384","CVE-2026-64385","CVE-2026-64386","CVE-2026-64387","CVE-2026-64423","CVE-2026-64450","CVE-2026-64481","CVE-2026-64524","CVE-2026-64527","CVE-2026-64541","CVE-2026-64543","CVE-2026-64562","CVE-2026-64563","CVE-2026-64572","CVE-2026-64577","CVE-2026-64581","CVE-2026-64593","CVE-2026-68121","CVE-2026-68133","CVE-2026-68136","CVE-2026-68138","CVE-2026-68155","CVE-2026-68158","CVE-2026-68159","CVE-2026-68160","CVE-2026-68202","CVE-2026-68397","CVE-2026-68398","CVE-2026-68417","CVE-2026-68426","CVE-2026-68428","CVE-2026-68480","CVE-2026-72020","CVE-2026-72069","CVE-2026-72072","CVE-2026-72083","CVE-2026-72084","CVE-2026-72123","CVE-2026-72135","CVE-2026-72221","CVE-2026-72222","CVE-2026-72251","CVE-2026-72262","CVE-2026-72288","CVE-2026-72289","CVE-2026-72317","CVE-2026-72339","CVE-2026-72389","CVE-2026-74345","CVE-2026-74377","CVE-2026-74378","CVE-2026-74390","CVE-2026-74394","CVE-2026-74454","CVE-2026-74488","CVE-2026-74496","CVE-2026-74516","CVE-2026-74518","CVE-2026-74537","CVE-2026-74556","CVE-2026-74581","CVE-2026-74582","CVE-2026-74612","CVE-2026-74669","CVE-2026-74695","CVE-2026-80722"],"payload":{"kind":"advisory","title":"Security update for the Linux Kernel","summary":"The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731). - CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225). - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604). - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072). - CVE-2026-43147: Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (bsc#1264642). - CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734). - CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023). - CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659). - CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000). - CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004). - CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242). - CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126). - CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655). - CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985). - CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqu","evidence":"osv:SUSE-SU-2026:4369-1","products":[{"name":{"value":"kernel-default","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-livepatch-SLE15-SP6_Update_31","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1-150600.13.3.4","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-64kb","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1.150600.12.62.4","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-zfcpdump","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1.150600.12.62.4","evidence":"/affected/12/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/13/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/13/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/14/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/14/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/15/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/15/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/16/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/16/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4369-1","aliases":["SUSE-SU-2026:4369-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.135.1","kernel-default-livepatch-devel":"6.4.0-150600.23.135.1","kernel-livepatch-6_4_0-150600_23_135-default":"1-150600.13.3.4"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.3.4"}]}],"package":{"name":"kernel-livepatch-SLE15-SP6_Update_31","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_31&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.135.1","kernel-default-livepatch-devel":"6.4.0-150600.23.135.1","kernel-livepatch-6_4_0-150600_23_135-default":"1-150600.13.3.4"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-64kb","purl":"pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-zfcpdump","purl":"pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}}],"modified":"2026-10-02T18:42:50.599983491Z","provider":"osv","upstream":["CVE-2024-44981","CVE-2024-57841","CVE-2025-38469","CVE-2025-40022","CVE-2025-68179","CVE-2025-68214","CVE-2025-71104","CVE-2026-23210","CVE-2026-23230","CVE-2026-23451","CVE-2026-23454","CVE-2026-31502","CVE-2026-43147","CVE-2026-43456","CVE-2026-45968","CVE-2026-52910","CVE-2026-52912","CVE-2026-52929","CVE-2026-52977","CVE-2026-52994","CVE-2026-53059","CVE-2026-53110","CVE-2026-53163","CVE-2026-53260","CVE-2026-53264","CVE-2026-53365","CVE-2026-53366","CVE-2026-53381","CVE-2026-63801","CVE-2026-63823","CVE-2026-63827","CVE-2026-63879","CVE-2026-63881","CVE-2026-63886","CVE-2026-63887","CVE-2026-63888","CVE-2026-63920","CVE-2026-63944","CVE-2026-63970","CVE-2026-63972","CVE-2026-63973","CVE-2026-63992","CVE-2026-64000","CVE-2026-64002","CVE-2026-64007","CVE-2026-64010","CVE-2026-64011","CVE-2026-64015","CVE-2026-64018","CVE-2026-64029","CVE-2026-64034","CVE-2026-64048","CVE-2026-64098","CVE-2026-64109","CVE-2026-64114","CVE-2026-64115","CVE-2026-64121","CVE-2026-64217","CVE-2026-64247","CVE-2026-64266","CVE-2026-64268","CVE-2026-64304","CVE-2026-64312","CVE-2026-64355","CVE-2026-64383","CVE-2026-64384","CVE-2026-64385","CVE-2026-64386","CVE-2026-64387","CVE-2026-64423","CVE-2026-64450","CVE-2026-64481","CVE-2026-64524","CVE-2026-64527","CVE-2026-64541","CVE-2026-64543","CVE-2026-64562","CVE-2026-64563","CVE-2026-64572","CVE-2026-64577","CVE-2026-64581","CVE-2026-64593","CVE-2026-68121","CVE-2026-68133","CVE-2026-68136","CVE-2026-68138","CVE-2026-68155","CVE-2026-68158","CVE-2026-68159","CVE-2026-68160","CVE-2026-68202","CVE-2026-68397","CVE-2026-68398","CVE-2026-68417","CVE-2026-68426","CVE-2026-68428","CVE-2026-68480","CVE-2026-72020","CVE-2026-72069","CVE-2026-72072","CVE-2026-72083","CVE-2026-72084","CVE-2026-72123","CVE-2026-72135","CVE-2026-72221","CVE-2026-72222","CVE-2026-72251","CVE-2026-72262","CVE-2026-72288","CVE-2026-72289","CVE-2026-72317","CVE-2026-72339","CVE-2026-72389","CVE-2026-74345","CVE-2026-74377","CVE-2026-74378","CVE-2026-74390","CVE-2026-74394","CVE-2026-74454","CVE-2026-74488","CVE-2026-74496","CVE-2026-74516","CVE-2026-74518","CVE-2026-74537","CVE-2026-74556","CVE-2026-74581","CVE-2026-74582","CVE-2026-74612","CVE-2026-74669","CVE-2026-74695","CVE-2026-80722"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264369-1/","https://bugzilla.suse.com/1230238","https://bugzilla.suse.com/1235944","https://bugzilla.suse.com/1247455","https://bugzilla.suse.com/1250748","https://bugzilla.suse.com/1252682","https://bugzilla.suse.com/1254306","https://bugzilla.suse.com/1255225","https://bugzilla.suse.com/1255250","https://bugzilla.suse.com/1256708","https://bugzilla.suse.com/1257154","https://bugzilla.suse.com/1258430","https://bugzilla.suse.com/1258517","https://bugzilla.suse.com/1260522","https://bugzilla.suse.com/1261604","https://bugzilla.suse.com/1261780","https://bugzilla.suse.com/1263072","https://bugzilla.suse.com/1264642","https://bugzilla.suse.com/1264734","https://bugzilla.suse.com/1265449","https://bugzilla.suse.com/1265928","https://bugzilla.suse.com/1266402","https://bugzilla.suse.com/1267023","https://bugzilla.suse.com/1268659","https://bugzilla.suse.com/1269000","https://bugzilla.suse.com/1269004","https://bugzilla.suse.com/1269126","https://bugzilla.suse.com/1269238","https://bugzilla.suse.com/1269242","https://bugzilla.suse.com/1269306","https://bugzilla.suse.com/1269655","https://bugzilla.suse.com/1269731","https://bugzilla.suse.com/1269792","https://bugzilla.suse.com/1269981","https://bugzilla.suse.com/1269985","https://bugzilla.suse.com/1271365","https://bugzilla.suse.com/1271366","https://bugzilla.suse.com/1271830","https://bugzilla.suse.com/1272179","https://bugzilla.suse.com/1272182","https://bugzilla.suse.com/1272230","https://bugzilla.suse.com/1272381","https://bugzilla.suse.com/1272385","https://bugzilla.suse.com/1272390","https://bugzilla.suse.com/1272569","https://bugzilla.suse.com/1272571","https://bugzilla.suse.com/1272662","https://bugzilla.suse.com/1272673","https://bugzilla.suse.com/1272680","https://bugzilla.suse.com/1272682","https://bugzilla.suse.com/1272756","https://bugzilla.suse.com/1272798","https://bugzilla.suse.com/1272868","https://bugzilla.suse.com/1272877","https://bugzilla.suse.com/1273030","https://bugzilla.suse.com/1273053","https://bugzilla.suse.com/1273054","https://bugzilla.suse.com/1273105","https://bugzilla.suse.com/1273276","https://bugzilla.suse.com/1273303","https://bugzilla.suse.com/1273311","https://bugzilla.suse.com/1273422","https://bugzilla.suse.com/1273426","https://bugzilla.suse.com/1273484","https://bugzilla.suse.com/1273488","https://bugzilla.suse.com/1273523","https://bugzilla.suse.com/1273555","https://bugzilla.suse.com/1273578","https://bugzilla.suse.com/1273742","https://bugzilla.suse.com/1273743","https://bugzilla.suse.com/1273745","https://bugzilla.suse.com/1273748","https://bugzilla.suse.com/1273762","https://bugzilla.suse.com/1273766","https://bugzilla.suse.com/1273774","https://bugzilla.suse.com/1273869","https://bugzilla.suse.com/1273882","https://bugzilla.suse.com/1273891","https://bugzilla.suse.com/1273903","https://bugzilla.suse.com/1273930","https://bugzilla.suse.com/1273944","https://bugzilla.suse.com/1273968","https://bugzilla.suse.com/1273995","https://bugzilla.suse.com/1274014","https://bugzilla.suse.com/1274031","https://bugzilla.suse.com/1274041","https://bugzilla.suse.com/1274208","https://bugzilla.suse.com/1274226","https://bugzilla.suse.com/1274274","https://bugzilla.suse.com/1274497","https://bugzilla.suse.com/1274539","https://bugzilla.suse.com/1274541","https://bugzilla.suse.com/1274543","https://bugzilla.suse.com/1274545","https://bugzilla.suse.com/1274547","https://bugzilla.suse.com/1274550","https://bugzilla.suse.com/1274620","https://bugzilla.suse.com/1274696","https://bugzilla.suse.com/1274699","https://bugzilla.suse.com/1274705","https://bugzilla.suse.com/1274752","https://bugzilla.suse.com/1274753","https://bugzilla.suse.com/1274754","https://bugzilla.suse.com/1274888","https://bugzilla.suse.com/1274898","https://bugzilla.suse.com/1274902","https://bugzilla.suse.com/1274908","https://bugzilla.suse.com/1274941","https://bugzilla.suse.com/1275161","https://bugzilla.suse.com/1275304","https://bugzilla.suse.com/1275307","https://bugzilla.suse.com/1275470","https://bugzilla.suse.com/1275472","https://bugzilla.suse.com/1275474","https://bugzilla.suse.com/1275506","https://bugzilla.suse.com/1275528","https://bugzilla.suse.com/1275535","https://bugzilla.suse.com/1275540","https://bugzilla.suse.com/1275555","https://bugzilla.suse.com/1275665","https://bugzilla.suse.com/1275669","https://bugzilla.suse.com/1275687","https://bugzilla.suse.com/1275696","https://bugzilla.suse.com/1275782","https://bugzilla.suse.com/1275784","https://bugzilla.suse.com/1275797","https://bugzilla.suse.com/1275798","https://bugzilla.suse.com/1275827","https://bugzilla.suse.com/1275867","https://bugzilla.suse.com/1275886","https://bugzilla.suse.com/1275905","https://bugzilla.suse.com/1275925","https://bugzilla.suse.com/1276006","https://bugzilla.suse.com/1276350","https://bugzilla.suse.com/1276665","https://bugzilla.suse.com/1276931","https://bugzilla.suse.com/1277073","https://bugzilla.suse.com/1277155","https://bugzilla.suse.com/1277254","https://bugzilla.suse.com/1277285","https://bugzilla.suse.com/1277391","https://bugzilla.suse.com/1277408","https://bugzilla.suse.com/1277505","https://bugzilla.suse.com/1277523","https://bugzilla.suse.com/1277571","https://bugzilla.suse.com/1277678","https://bugzilla.suse.com/1277860","https://bugzilla.suse.com/1278088","https://bugzilla.suse.com/1278233","https://bugzilla.suse.com/1278236","https://bugzilla.suse.com/1279813","https://www.suse.com/security/cve/CVE-2024-44981","https://www.suse.com/security/cve/CVE-2024-57841","https://www.suse.com/security/cve/CVE-2025-38469","https://www.suse.com/security/cve/CVE-2025-40022","https://www.suse.com/security/cve/CVE-2025-68179","https://www.suse.com/security/cve/CVE-2025-68214","https://www.suse.com/security/cve/CVE-2025-71104","https://www.suse.com/security/cve/CVE-2026-23210","https://www.suse.com/security/cve/CVE-2026-23230","https://www.suse.com/security/cve/CVE-2026-23451","https://www.suse.com/security/cve/CVE-2026-23454","https://www.suse.com/security/cve/CVE-2026-31502","https://www.suse.com/security/cve/CVE-2026-43147","https://www.suse.com/security/cve/CVE-2026-43456","https://www.suse.com/security/cve/CVE-2026-45968","https://www.suse.com/security/cve/CVE-2026-52910","https://www.suse.com/security/cve/CVE-2026-52912","https://www.suse.com/security/cve/CVE-2026-52929","https://www.suse.com/security/cve/CVE-2026-52977","https://www.suse.com/security/cve/CVE-2026-52994","https://www.suse.com/security/cve/CVE-2026-53059","https://www.suse.com/security/cve/CVE-2026-53110","https://www.suse.com/security/cve/CVE-2026-53163","https://www.suse.com/security/cve/CVE-2026-53260","https://www.suse.com/security/cve/CVE-2026-53264","https://www.suse.com/security/cve/CVE-2026-53365","https://www.suse.com/security/cve/CVE-2026-53366","https://www.suse.com/security/cve/CVE-2026-53381","https://www.suse.com/security/cve/CVE-2026-63801","https://www.suse.com/security/cve/CVE-2026-63823","https://www.suse.com/security/cve/CVE-2026-63827","https://www.suse.com/security/cve/CVE-2026-63879","https://www.suse.com/security/cve/CVE-2026-63881","https://www.suse.com/security/cve/CVE-2026-63886","https://www.suse.com/security/cve/CVE-2026-63887","https://www.suse.com/security/cve/CVE-2026-63888","https://www.suse.com/security/cve/CVE-2026-63920","https://www.suse.com/security/cve/CVE-2026-63944","https://www.suse.com/security/cve/CVE-2026-63970","https://www.suse.com/security/cve/CVE-2026-63972","https://www.suse.com/security/cve/CVE-2026-63973","https://www.suse.com/security/cve/CVE-2026-63992","https://www.suse.com/security/cve/CVE-2026-64000","https://www.suse.com/security/cve/CVE-2026-64002","https://www.suse.com/security/cve/CVE-2026-64007","https://www.suse.com/security/cve/CVE-2026-64010","https://www.suse.com/security/cve/CVE-2026-64011","https://www.suse.com/security/cve/CVE-2026-64015","https://www.suse.com/security/cve/CVE-2026-64018","https://www.suse.com/security/cve/CVE-2026-64029","https://www.suse.com/security/cve/CVE-2026-64034","https://www.suse.com/security/cve/CVE-2026-64048","https://www.suse.com/security/cve/CVE-2026-64098","https://www.suse.com/security/cve/CVE-2026-64109","https://www.suse.com/security/cve/CVE-2026-64114","https://www.suse.com/security/cve/CVE-2026-64115","https://www.suse.com/security/cve/CVE-2026-64121","https://www.suse.com/security/cve/CVE-2026-64217","https://www.suse.com/security/cve/CVE-2026-64247","https://www.suse.com/security/cve/CVE-2026-64266","https://www.suse.com/security/cve/CVE-2026-64268","https://www.suse.com/security/cve/CVE-2026-64304","https://www.suse.com/security/cve/CVE-2026-64312","https://www.suse.com/security/cve/CVE-2026-64355","https://www.suse.com/security/cve/CVE-2026-64383","https://www.suse.com/security/cve/CVE-2026-64384","https://www.suse.com/security/cve/CVE-2026-64385","https://www.suse.com/security/cve/CVE-2026-64386","https://www.suse.com/security/cve/CVE-2026-64387","https://www.suse.com/security/cve/CVE-2026-64423","https://www.suse.com/security/cve/CVE-2026-64450","https://www.suse.com/security/cve/CVE-2026-64481","https://www.suse.com/security/cve/CVE-2026-64524","https://www.suse.com/security/cve/CVE-2026-64527","https://www.suse.com/security/cve/CVE-2026-64541","https://www.suse.com/security/cve/CVE-2026-64543","https://www.suse.com/security/cve/CVE-2026-64562","https://www.suse.com/security/cve/CVE-2026-64563","https://www.suse.com/security/cve/CVE-2026-64572","https://www.suse.com/security/cve/CVE-2026-64577","https://www.suse.com/security/cve/CVE-2026-64581","https://www.suse.com/security/cve/CVE-2026-64593","https://www.suse.com/security/cve/CVE-2026-68121","https://www.suse.com/security/cve/CVE-2026-68133","https://www.suse.com/security/cve/CVE-2026-68136","https://www.suse.com/security/cve/CVE-2026-68138","https://www.suse.com/security/cve/CVE-2026-68155","https://www.suse.com/security/cve/CVE-2026-68158","https://www.suse.com/security/cve/CVE-2026-68159","https://www.suse.com/security/cve/CVE-2026-68160","https://www.suse.com/security/cve/CVE-2026-68202","https://www.suse.com/security/cve/CVE-2026-68397","https://www.suse.com/security/cve/CVE-2026-68398","https://www.suse.com/security/cve/CVE-2026-68417","https://www.suse.com/security/cve/CVE-2026-68426","https://www.suse.com/security/cve/CVE-2026-68428","https://www.suse.com/security/cve/CVE-2026-68480","https://www.suse.com/security/cve/CVE-2026-72020","https://www.suse.com/security/cve/CVE-2026-72069","https://www.suse.com/security/cve/CVE-2026-72072","https://www.suse.com/security/cve/CVE-2026-72083","https://www.suse.com/security/cve/CVE-2026-72084","https://www.suse.com/security/cve/CVE-2026-72123","https://www.suse.com/security/cve/CVE-2026-72135","https://www.suse.com/security/cve/CVE-2026-72221","https://www.suse.com/security/cve/CVE-2026-72222","https://www.suse.com/security/cve/CVE-2026-72251","https://www.suse.com/security/cve/CVE-2026-72262","https://www.suse.com/security/cve/CVE-2026-72288","https://www.suse.com/security/cve/CVE-2026-72289","https://www.suse.com/security/cve/CVE-2026-72317","https://www.suse.com/security/cve/CVE-2026-72339","https://www.suse.com/security/cve/CVE-2026-72389","https://www.suse.com/security/cve/CVE-2026-74345","https://www.suse.com/security/cve/CVE-2026-74377","https://www.suse.com/security/cve/CVE-2026-74378","https://www.suse.com/security/cve/CVE-2026-74390","https://www.suse.com/security/cve/CVE-2026-74394","https://www.suse.com/security/cve/CVE-2026-74454","https://www.suse.com/security/cve/CVE-2026-74488","https://www.suse.com/security/cve/CVE-2026-74496","https://www.suse.com/security/cve/CVE-2026-74516","https://www.suse.com/security/cve/CVE-2026-74518","https://www.suse.com/security/cve/CVE-2026-74537","https://www.suse.com/security/cve/CVE-2026-74556","https://www.suse.com/security/cve/CVE-2026-74581","https://www.suse.com/security/cve/CVE-2026-74582","https://www.suse.com/security/cve/CVE-2026-74612","https://www.suse.com/security/cve/CVE-2026-74669","https://www.suse.com/security/cve/CVE-2026-74695","https://www.suse.com/security/cve/CVE-2026-80722"]},"related_cves":[{"value":"CVE-2024-44981","evidence":"/upstream"},{"value":"CVE-2024-57841","evidence":"/upstream"},{"value":"CVE-2025-38469","evidence":"/upstream"},{"value":"CVE-2025-40022","evidence":"/upstream"},{"value":"CVE-2025-68179","evidence":"/upstream"},{"value":"CVE-2025-68214","evidence":"/upstream"},{"value":"CVE-2025-71104","evidence":"/upstream"},{"value":"CVE-2026-23210","evidence":"/upstream"},{"value":"CVE-2026-23230","evidence":"/upstream"},{"value":"CVE-2026-23451","evidence":"/upstream"},{"value":"CVE-2026-23454","evidence":"/upstream"},{"value":"CVE-2026-31502","evidence":"/upstream"},{"value":"CVE-2026-43147","evidence":"/upstream"},{"value":"CVE-2026-43456","evidence":"/upstream"},{"value":"CVE-2026-45968","evidence":"/upstream"},{"value":"CVE-2026-52910","evidence":"/upstream"},{"value":"CVE-2026-52912","evidence":"/upstream"},{"value":"CVE-2026-52929","evidence":"/upstream"},{"value":"CVE-2026-52977","evidence":"/upstream"},{"value":"CVE-2026-52994","evidence":"/upstream"},{"value":"CVE-2026-53059","evidence":"/upstream"},{"value":"CVE-2026-53110","evidence":"/upstream"},{"value":"CVE-2026-53163","evidence":"/upstream"},{"value":"CVE-2026-53260","evidence":"/upstream"},{"value":"CVE-2026-53264","evidence":"/upstream"},{"value":"CVE-2026-53365","evidence":"/upstream"},{"value":"CVE-2026-53366","evidence":"/upstream"},{"value":"CVE-2026-53381","evidence":"/upstream"},{"value":"CVE-2026-63801","evidence":"/upstream"},{"value":"CVE-2026-63823","evidence":"/upstream"},{"value":"CVE-2026-63827","evidence":"/upstream"},{"value":"CVE-2026-63879","evidence":"/upstream"},{"value":"CVE-2026-63881","evidence":"/upstream"},{"value":"CVE-2026-63886","evidence":"/upstream"},{"value":"CVE-2026-63887","evidence":"/upstream"},{"value":"CVE-2026-63888","evidence":"/upstream"},{"value":"CVE-2026-63920","evidence":"/upstream"},{"value":"CVE-2026-63944","evidence":"/upstream"},{"value":"CVE-2026-63970","evidence":"/upstream"},{"value":"CVE-2026-63972","evidence":"/upstream"},{"value":"CVE-2026-63973","evidence":"/upstream"},{"value":"CVE-2026-63992","evidence":"/upstream"},{"value":"CVE-2026-64000","evidence":"/upstream"},{"value":"CVE-2026-64002","evidence":"/upstream"},{"value":"CVE-2026-64007","evidence":"/upstream"},{"value":"CVE-2026-64010","evidence":"/upstream"},{"value":"CVE-2026-64011","evidence":"/upstream"},{"value":"CVE-2026-64015","evidence":"/upstream"},{"value":"CVE-2026-64018","evidence":"/upstream"},{"value":"CVE-2026-64029","evidence":"/upstream"},{"value":"CVE-2026-64034","evidence":"/upstream"},{"value":"CVE-2026-64048","evidence":"/upstream"},{"value":"CVE-2026-64098","evidence":"/upstream"},{"value":"CVE-2026-64109","evidence":"/upstream"},{"value":"CVE-2026-64114","evidence":"/upstream"},{"value":"CVE-2026-64115","evidence":"/upstream"},{"value":"CVE-2026-64121","evidence":"/upstream"},{"value":"CVE-2026-64217","evidence":"/upstream"},{"value":"CVE-2026-64247","evidence":"/upstream"},{"value":"CVE-2026-64266","evidence":"/upstream"},{"value":"CVE-2026-64268","evidence":"/upstream"},{"value":"CVE-2026-64304","evidence":"/upstream"},{"value":"CVE-2026-64312","evidence":"/upstream"},{"value":"CVE-2026-64355","evidence":"/upstream"},{"value":"CVE-2026-64383","evidence":"/upstream"},{"value":"CVE-2026-64384","evidence":"/upstream"},{"value":"CVE-2026-64385","evidence":"/upstream"},{"value":"CVE-2026-64386","evidence":"/upstream"},{"value":"CVE-2026-64387","evidence":"/upstream"},{"value":"CVE-2026-64423","evidence":"/upstream"},{"value":"CVE-2026-64450","evidence":"/upstream"},{"value":"CVE-2026-64481","evidence":"/upstream"},{"value":"CVE-2026-64524","evidence":"/upstream"},{"value":"CVE-2026-64527","evidence":"/upstream"},{"value":"CVE-2026-64541","evidence":"/upstream"},{"value":"CVE-2026-64543","evidence":"/upstream"},{"value":"CVE-2026-64562","evidence":"/upstream"},{"value":"CVE-2026-64563","evidence":"/upstream"},{"value":"CVE-2026-64572","evidence":"/upstream"},{"value":"CVE-2026-64577","evidence":"/upstream"},{"value":"CVE-2026-64581","evidence":"/upstream"},{"value":"CVE-2026-64593","evidence":"/upstream"},{"value":"CVE-2026-68121","evidence":"/upstream"},{"value":"CVE-2026-68133","evidence":"/upstream"},{"value":"CVE-2026-68136","evidence":"/upstream"},{"value":"CVE-2026-68138","evidence":"/upstream"},{"value":"CVE-2026-68155","evidence":"/upstream"},{"value":"CVE-2026-68158","evidence":"/upstream"},{"value":"CVE-2026-68159","evidence":"/upstream"},{"value":"CVE-2026-68160","evidence":"/upstream"},{"value":"CVE-2026-68202","evidence":"/upstream"},{"value":"CVE-2026-68397","evidence":"/upstream"},{"value":"CVE-2026-68398","evidence":"/upstream"},{"value":"CVE-2026-68417","evidence":"/upstream"},{"value":"CVE-2026-68426","evidence":"/upstream"},{"value":"CVE-2026-68428","evidence":"/upstream"},{"value":"CVE-2026-68480","evidence":"/upstream"},{"value":"CVE-2026-72020","evidence":"/upstream"},{"value":"CVE-2026-72069","evidence":"/upstream"},{"value":"CVE-2026-72072","evidence":"/upstream"},{"value":"CVE-2026-72083","evidence":"/upstream"},{"value":"CVE-2026-72084","evidence":"/upstream"},{"value":"CVE-2026-72123","evidence":"/upstream"},{"value":"CVE-2026-72135","evidence":"/upstream"},{"value":"CVE-2026-72221","evidence":"/upstream"},{"value":"CVE-2026-72222","evidence":"/upstream"},{"value":"CVE-2026-72251","evidence":"/upstream"},{"value":"CVE-2026-72262","evidence":"/upstream"},{"value":"CVE-2026-72288","evidence":"/upstream"},{"value":"CVE-2026-72289","evidence":"/upstream"},{"value":"CVE-2026-72317","evidence":"/upstream"},{"value":"CVE-2026-72339","evidence":"/upstream"},{"value":"CVE-2026-72389","evidence":"/upstream"},{"value":"CVE-2026-74345","evidence":"/upstream"},{"value":"CVE-2026-74377","evidence":"/upstream"},{"value":"CVE-2026-74378","evidence":"/upstream"},{"value":"CVE-2026-74390","evidence":"/upstream"},{"value":"CVE-2026-74394","evidence":"/upstream"},{"value":"CVE-2026-74454","evidence":"/upstream"},{"value":"CVE-2026-74488","evidence":"/upstream"},{"value":"CVE-2026-74496","evidence":"/upstream"},{"value":"CVE-2026-74516","evidence":"/upstream"},{"value":"CVE-2026-74518","evidence":"/upstream"},{"value":"CVE-2026-74537","evidence":"/upstream"},{"value":"CVE-2026-74556","evidence":"/upstream"},{"value":"CVE-2026-74581","evidence":"/upstream"},{"value":"CVE-2026-74582","evidence":"/upstream"},{"value":"CVE-2026-74612","evidence":"/upstream"},{"value":"CVE-2026-74669","evidence":"/upstream"},{"value":"CVE-2026-74695","evidence":"/upstream"},{"value":"CVE-2026-80722","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ddb2c304-0ccc-4573-96b3-606b178f0dff","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-23230","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerability is in the SMB client code (fs/smb/client/). The race is triggered between processing a server's create response (setting is_open) and the server sending a lease break notification. A malicious SMB server can trigger this remotely over the network.\nAC:L - The attacker (malicious SMB server) controls when lease breaks are sent and can time them immediately after the create response. The attacker can retry many times across many directory opens, and the RMW race window is inherent to every bitfield write, making it reliably triggerable.\nPR:N - The attacker is the SMB server, requiring no privileges on the victim system. The lease break is processed as part of normal SMB protocol handling with no additional authentication check beyond the existing session.\nUI:R - The victim must mount an SMB share from the attacker's server (or a compromised server), which requires explicit user or administrator action.\nS:U - The vulnerability impacts the kernel where the SMB client runs; it does not cross a security boundary such as a VM or sandbox.\nC:H - The race can restore has_lease after the lease reference was dropped, leading to reference count corruption and use-after-free. UAF on heap objects gives the attacker read primitives over arbitrary kernel memory through heap spraying.\nI:H - The use-after-free from reference count corruption allows the attacker to reclaim the freed cached_fid object with controlled data, enabling arbitrary kernel write primitives and potential code execution.\nA:H - The reference count corruption and list corruption caused by the restored stale flags will lead to double-free, use-after-free, or list corruption, all of which reliably cause kernel panics/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-23230","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-31502","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the vulnerable team header_ops path by locally creating/enslaving network devices through rtnetlink and then triggering dev_hard_header()/dev_parse_header() via local packet/socket or network-stack activity on the malformed team device. The required setup is a local kernel networking configuration path rather than an unauthenticated packet-processing path.\nAC:L - The vulnerable topology, such as GRE -> bond -> team, is fully attacker-controlled once the required namespace capabilities are available, and triggering the bad callback is deterministic. There is no race or external timing condition required.\nPR:L - Creating team/bond/GRE devices and enslaving them requires CAP_NET_ADMIN, and packet sockets require CAP_NET_RAW, but both are available to an unprivileged user inside a user and network namespace on systems permitting unprivileged user namespaces. This is therefore low privileges, not real init-namespace root.\nUI:N - No victim interaction is required after the attacker has local access and namespace capabilities. The attacker can configure the devices and trigger the callback directly.\nS:U - The impact is within the same kernel security authority. This is a kernel crash/type-confusion or privilege-impact issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a header_ops type confusion where callbacks interpret team private data as another subsystem's private structure, causing attacker-influenced kernel pointer dereferences and potential kernel memory exposure. Following the higher-severity rule for type confusion, confidentiality impact is high.\nI:H - Type confusion in kernel callback dispatch can lead to misinterpreted object pointers and potentially control-flow or write-primitive exploitation beyond the observed crash. Kernel type confusion is scored as high integrity impact.\nA:H - The reported and expected failure mode is a kernel oops/BUG/crash when the inherited callback uses the wrong net_device private layout. This gives high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31502","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43456","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local rtnetlink/AF_PACKET operations: creating/enslaving a non-Ethernet slave to a bond and then causing `dev_hard_header()` on the bond device. Remote packets are not sufficient without the vulnerable local device configuration.\nAC:L - No race or special external timing is required; the attacker can deterministically create the bond/GRE setup and trigger the confused header callback. Required modules/configuration are common and autoloadable through rtnetlink in normal deployments.\nPR:L - The setup requires `CAP_NET_ADMIN` and the AF_PACKET trigger requires `CAP_NET_RAW`, but both are obtainable by an unprivileged local user inside a user/network namespace. Therefore this is low privilege rather than real init-namespace root only.\nUI:N - Exploitation does not require a victim user to perform an action. The attacker can perform the setup and trigger locally.\nS:U - The impact is within the kernel security authority on the same system. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug is kernel type confusion where bonding private data is interpreted as another device's private structure, and the confused callback can read kernel data using the wrong layout. Following the required higher-severity rule for type confusion, confidentiality impact is High.\nI:H - The confused header callback uses bogus private-data fields to construct and push protocol headers into an skb, making this a kernel memory/type confusion condition rather than a pure NULL dereference. Type confusion is scored as High integrity impact.\nA:H - The reported failure is a kernel BUG/oops in `pskb_expand_head()` reachable through the confused `ipgre_header()` call. This provides a reliable local kernel crash/DoS."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43456","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52910","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable attach/detach operation is reached through local `setsockopt()` on an `SO_REUSEPORT` socket with `SO_ATTACH_REUSEPORT_CBPF` or `SO_DETACH_REUSEPORT_BPF`. Although packet receive executes the stale program, the attacker-controlled trigger for freeing/replacing it is a local socket API path.\nAC:L - The race is attacker-controlled: a local attacker can create the UDP reuseport group, replace/detach the cBPF program, and concurrently send packets to drive `reuseport_select_sock()`. No rare external condition is required.\nPR:L - A basic unprivileged local user can create UDP sockets on an unprivileged port, set `SO_REUSEPORT`, and attach a classic reuseport BPF filter; this path does not require `CAP_NET_ADMIN`. User namespaces are not needed to make the path reachable.\nUI:N - No victim user action is required once the attacker runs the local reproducer. The attacker controls the sockets, the filter replacement, and the packet generation.\nS:U - The bug is a kernel memory lifetime error used for local kernel compromise or crash within the same host security authority. It does not cross a VM, IOMMU, or similar security boundary.\nC:H - This is a use-after-free of a `bpf_prog` object that is dereferenced after reclamation while selecting a reuseport socket. Per kernel CVSS guidance, UAFs are treated as enabling high confidentiality impact through potential kernel memory disclosure.\nI:H - The stale freed `bpf_prog` can be reused while the receive path reads and runs through the program object, making control-flow or data corruption plausible. Per kernel CVSS guidance, UAF memory corruption warrants high integrity impact.\nA:H - The reported reproducer triggers a KASAN vmalloc out-of-bounds/use-after-free splat in the packet receive path. Such kernel memory corruption can reliably crash or destabilize the kernel."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52912","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local control of netfilter/NFQUEUE, bridge device lifecycle, and verdict reinjection through netlink/rtnetlink paths. Remote packets alone cannot force the needed bridge teardown and userspace verdict sequence.\nAC:L - A local attacker can deterministically create a namespace, bridge/veth setup, NFQUEUE rule, queued packet, bridge teardown, and reinjection. There is no race dependent on conditions outside attacker control.\nPR:L - The setup requires CAP_NET_ADMIN, but netfilter and bridge configuration are reachable with CAP_NET_ADMIN inside a user-created network namespace on systems allowing unprivileged user namespaces. This is Low, not High.\nUI:N - No victim action is required once the local attacker runs the exploit sequence. The attacker controls packet injection, queueing, device teardown, and verdict delivery.\nS:U - The impact is kernel memory corruption within the same host security authority. This is a standard local kernel privilege escalation/DoS scenario, not a VM or hardware boundary escape.\nC:H - The bug is a use-after-free of the bridge master net_device retained in skb->dev across NFQUEUE. Kernel UAFs can be leveraged for kernel memory disclosure, so confidentiality impact is High.\nI:H - The stale net_device pointer is dereferenced after free in the receive path and can plausibly be combined with heap reclaim/spraying for memory corruption or control-flow impact. As a kernel UAF, integrity impact is High.\nA:H - At minimum, reinjection can dereference freed net_device memory in netif_receive_skb and crash/oops the kernel. Repeated local triggering makes availability impact High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52912","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52929","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached while processing an SCTP RE-CONFIG response chunk received from a remote SCTP peer on an established association. A malicious peer can send a denied ADD_OUT_STREAMS response over the network once stream reconfiguration is negotiated.\nAC:L - The packet/state sequence is protocol-controlled and reproducible: negotiate SCTP RE-CONFIG, trigger an ADD_OUT_STREAMS request, deny it, then cause later reuse of the stale stream state. Although RE-CONFIG must be enabled by the application, there is no race or condition outside the attacker's reasonable influence in a deployment using this feature.\nPR:N - A remote SCTP peer does not need local kernel privileges or authenticated OS privileges to send the denial response. The path is gated by SCTP association state, verification tag, and matching outstanding request sequence, not by credentials.\nUI:N - No human user interaction is required once the SCTP service/association is operating with stream reconfiguration. The triggering input is network protocol traffic from the peer.\nS:U - The vulnerability affects kernel SCTP state within the same host security authority. It does not cross a VM, IOMMU, or other separate authorization boundary.\nC:N - The investigated failure mode is stale SCTP stream scheduler metadata leading to a NULL pointer dereference in scheduler value retrieval. I did not find evidence of an attacker-controlled memory read or information disclosure primitive.\nI:N - The bug leaves scheduler-private stream state inconsistent but the demonstrated impact is a NULL dereference/crash, not controlled data modification or code execution. No arbitrary write primitive was evident from the rollback path.\nA:H - The stale stream extension state can lead to a kernel NULL pointer dereference/oops in the SCTP scheduler path. A remotely reachable kernel crash is a high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52929","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53110","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached by locally loading or attaching BPF programs through the bpf() syscall and then executing the JITed program or generated trampoline. It is not directly reachable from remote network packets without prior local BPF program installation.\nAC:L - An attacker can craft BPF bytecode/attachments that exercise unsigned kfunc arguments or trampoline return values, and there is no race or external timing condition required. The bug is a deterministic ABI/JIT miscompilation on affected s390 systems.\nPR:L - Loading kfunc/tracing BPF normally requires BPF-related capabilities, but BPF token delegation can evaluate these in a non-init user namespace in delegated/containerized deployments. Following the higher-severity rule, this is scored as low privileges rather than requiring real init-namespace root.\nUI:N - No victim action is needed after the attacker can issue the relevant bpf() syscalls. The attacker loads/attaches and triggers the affected BPF program path directly.\nS:U - The vulnerability affects kernel execution in the same security authority as the vulnerable component. It is a local kernel compromise/DoS style issue, not a VM escape or separate security-scope boundary bypass.\nC:H - The missing zero-extension lets attacker-controlled high bits cross the verifier/native ABI boundary for kfunc calls and trampoline returns. This can plausibly turn verifier-assumed bounded values into unsafe kernel values, matching prior BPF JIT verifier-bypass classes with kernel memory disclosure potential.\nI:H - Incorrect unsigned argument or return extension can corrupt kernel control/data flow through kfuncs or BPF modify-return trampolines. Under the required higher-severity assumption, this is treated as exploitable for kernel memory modification or privilege escalation.\nA:H - At minimum, passing ABI-invalid kfunc arguments or malformed trampoline return values can trigger kernel oops/panic paths, as similar BPF JIT argument-extension bugs have done. The attacker can repeatedly load/trigger the crafted BPF program."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53110","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53260","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable TCP request-socket path is reached by unauthenticated IPv4 or IPv6 SYN packets delivered to a listening socket over the network. This occurs before any application-level authentication.\nAC:L - Although the bug is a PREEMPT_RT timing race, an attacker can repeatedly create request sockets and timer/drop races by driving TCP connection attempts; under the required higher-severity rule this is treated as attacker-controllable rather than an uncontrollable environmental condition.\nPR:N - No credentials, capabilities, or prior authentication are required to send SYN packets to an exposed TCP listener and reach `tcp_conn_request()` and `reqsk_queue_hash_req()`. The path is in the generic TCP receive stack.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform an interactive action. Network traffic alone can exercise the vulnerable path on an affected listening service.\nS:U - The impact is within the kernel/network stack security authority on the same host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The failure is explicitly reported as a refcount underflow/use-after-free in a kernel heap object. Per the required guidance, UAF-class lifetime corruption is scored as high confidentiality impact because it can potentially be shaped into memory disclosure.\nI:H - The corrupted request-socket lifetime can leave stale kernel objects reachable through ehash/timer paths. Per the required guidance, UAF-class kernel memory corruption is scored as high integrity impact because it may be exploitable for write or control-flow manipulation.\nA:H - The observed failure triggers a kernel refcount warning with use-after-free semantics in timer context and can destabilize networking or the kernel. Kernel warnings/oopses, hangs, or UAF-triggered crashes are high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53260","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53264","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local rtnetlink `RTM_NEWTFILTER`/`RTM_DELTFILTER` traffic-control netlink messages, not by remote packet input.\nAC:L - The race is attacker-controlled because the same local actor can issue concurrent filter creation and deletion operations against the same action index. No external victim timing or rare environmental condition is required.\nPR:L - The operations require `CAP_NET_ADMIN` for non-GET rtnetlink messages, but traffic control is reachable with `CAP_NET_ADMIN` inside a user-created network namespace. Under the provided kernel guidance, this is Low privileges rather than High.\nUI:N - No victim interaction is needed; exploitation consists of the attacker sending crafted concurrent rtnetlink requests.\nS:U - The impact is within the kernel security authority and is a standard local kernel memory-corruption/privilege-escalation class issue. It does not cross a VM, IOMMU, or separate authorization scope boundary.\nC:H - The bug is a use-after-free of a `tc_action` object during action lookup/refcounting. A kernel heap UAF can be shaped into disclosure primitives, so confidentiality impact is High.\nI:H - The stale freed action pointer can be reused after heap reallocation and then modified/dereferenced through refcount, bind count, ops, and action lifecycle fields. This is memory corruption that can plausibly support arbitrary write or code execution, so integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or mutate freed/reused kernel memory and can crash or oops the kernel. Availability impact is therefore High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53366","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached while a local process constructs outgoing IPv4 UDP/raw/ping datagrams through sendmsg/splice/sendfile-style socket paths. I did not find a defensible received-packet or unauthenticated remote path that supplies the required cork/MSG_MORE-style fraggap conditions.\nAC:L - The attacker can choose UDP socket options/flags, payload sizes, corking/MSG_MORE behavior, and splice/zerocopy-style paged sends to reach the fraggap paged-allocation path. There is no race or external timing condition required.\nPR:L - A normal unprivileged local user can create IPv4 UDP sockets and use UDP_CORK/MSG_MORE/splice or related paged send paths; raw sockets are CAP_NET_RAW-gated but are not needed for the strongest local trigger. This is therefore basic local user privilege, not real administrator privilege.\nUI:N - No victim interaction is required once the attacker can run the local send/splice sequence. The vulnerable skb construction happens synchronously in the attacker-driven socket send path.\nS:U - The impact is within the same kernel security authority as the vulnerable IPv4 networking code. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug under-allocates/accounting for the linear skb area and can copy attacker-controlled fraggap bytes past skb->end into trailing skb_shared_info metadata. Kernel memory corruption of this kind is reasonably capable of being developed into information disclosure, so the higher severity confidentiality value is appropriate.\nI:H - The copied fraggap bytes corrupt kernel skb metadata past the intended buffer boundary. This is an out-of-bounds write in kernel heap/networking structures and is scored as high integrity impact.\nA:H - The corrupted skb metadata can crash or destabilize the kernel networking stack, and related negative-copy accounting can also produce severe send-path failure behavior. Kernel crash or oops potential is high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53366","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53381","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local VFS operations (open/write/close) on a virtiofs mount with FUSE submounts; exploitation is in the guest FUSE client during file release and submount umount, not via remote network packets.\nAC:L - This is a use-after-free where the attacker controls file close (async FUSE RELEASE) and can drive or coincide with submount umount; Kata Containers reproduces it reliably with virtiofsd --announce-submounts (default).\nPR:L - An unprivileged local process with access to the virtiofs mount can trigger it; virtiofs defaults to allow_other and normal POSIX permissions, and no real root or init-namespace capabilities are required.\nUI:N - Exploitation needs no victim interaction beyond the attacker (or their container workload) performing normal filesystem I/O while submount teardown occurs during pod/container lifecycle.\nS:U - Impact stays within the guest kernel security boundary (crash or guest kernel compromise); it does not by itself cross a VM/host or IOMMU boundary.\nC:H - The flaw is a use-after-free in fuse_release_end() calling iput() on an inode after its superblock is destroyed, which can be turned into arbitrary kernel memory read via heap manipulation.\nI:H - Use-after-free on a struct inode in the kernel heap provides a standard path to controlled memory corruption, heap spraying, and arbitrary write or code execution in kernel context.\nA:H - Confirmed kernel general protection fault/oops in iput() from fuse_release_end during virtio_fs request completion, and UAF bugs inherently threaten kernel stability even without full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53381","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63801","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached from the TIPC packet receive path (UDP bearer on port 6118 or L2 bearer) when encrypted frames arrive from a remote peer; no local syscall is required to enter tipc_aead_decrypt().\nAC:L - The attacker can reliably win the race by flooding packets to queue async decrypt completions while repeatedly destroying the network namespace; the repro demonstrates full control of both sides of the timing window.\nPR:L - Reliable exploitation is demonstrated via unshare-created user/network namespaces where the attacker gains CAP_NET_ADMIN-equivalent control to configure TIPC crypto and cycle namespace teardown, which per kernel CNA guidance maps to Low rather than High.\nUI:N - Exploitation requires only sending network packets and namespace lifecycle manipulation; no victim user action such as opening a file or mounting a filesystem is needed.\nS:U - Impact is confined to kernel memory within the same security authority; this is a standard kernel UAF/privilege-escalation class bug, not a VM escape or cross-authority boundary bypass.\nC:H - The UAF reads freed slab memory including aead->crypto->stats, aead->crypto->net, and aead[] pointers in tipc_crypto_rcv_complete, enabling arbitrary kernel memory disclosure via controlled reuse of the freed tipc_crypto object.\nI:H - Use-after-free of tipc_crypto structures can be leveraged for heap spraying and arbitrary write primitives, and tipc_crypto_rcv_complete continues processing with freed pointers including key attachment and node table operations.\nA:H - KASAN confirmed slab-use-after-free in tipc_aead_decrypt_done on a workqueue thread; UAF on this path causes kernel oops/panic even when not fully exploited for code execution."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63801","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63823","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local `request_key()` and `keyctl()` syscalls (`KEYCTL_ASSUME_AUTHORITY`, `KEYCTL_INSTANTIATE`, `KEYCTL_INSTANTIATE_IOV`, `KEYCTL_REJECT`); there is no network, adjacent-radio, or physical-device entry path.\nAC:L - Exploitation is a race the attacker orchestrates by calling `request_key()` and concurrently driving `KEYCTL_INSTANTIATE_IOV` with a user buffer that page-faults during `copy_from_iter_full()`, while a second helper thread or completion path revokes/frees the auth payload.\nPR:L - Any unprivileged local user can invoke `request_key()` and the affected `keyctl` instantiate/reject operations in the spawned helper context; no real-root or non-userns capability is required.\nUI:N - Exploitation does not depend on a victim performing an action beyond the attacker’s own syscall activity and helper process setup.\nS:U - Impact is kernel memory corruption and local privilege escalation within the same kernel security domain, not a VM-guest-to-host or IOMMU boundary escape.\nC:H - This is a heap use-after-free of `struct request_key_auth`; after free the code dereferences `rka->target_key` and related fields, enabling attacker-controlled reuse and arbitrary kernel memory disclosure.\nI:H - The UAF corrupts trusted kernel pointers (`target_key`, `dest_keyring`) used in `key_instantiate_and_link()`, which can be turned into arbitrary kernel writes and local privilege escalation.\nA:H - Use-after-free of kernel heap objects can cause kernel oops/panic during post-fault dereferences, and is independently severe even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63823","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63879","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local AMDGPU DRM ioctls (e.g., AMDGPU_GEM_USERPTR, AMDGPU_CS) and KFD ioctls on /dev/kfd that call amdgpu_hmm_range_get_pages(); there is no network-facing entry point.\nAC:L - Exploitation requires a >2GB userptr/SVM mapping and a concurrent munmap/remap during the multi-chunk HMM walk, but the attacker controls both the ioctl thread and the address-space manipulation, so the race is attacker-driven rather than dependent on uncontrollable conditions.\nPR:L - Any unprivileged local user with access to the AMDGPU render node or /dev/kfd (typically render/video group membership) can create large userptr buffers and submit GPU work that triggers the vulnerable HMM path; root or init-namespace capabilities are not required.\nUI:N - Exploitation is fully attacker-driven through GPU memory registration and command submission ioctls and does not require any action from another user or administrator.\nS:U - The flaw corrupts or misuses kernel-tracked page metadata and enables standard local kernel memory safety impact and privilege escalation within the same kernel security domain, not a VM escape or IOMMU boundary bypass.\nC:H - Re-reading the MMU notifier sequence per 2GB chunk lets later validation pass while earlier PFNs may reference unmapped or freed pages, giving the GPU (and kernel DMA helpers) a stale-page/use-after-free primitive that can disclose arbitrary physical memory contents.\nI:H - Stale PFNs from invalidated mappings can be DMA-mapped and written by GPU operations, enabling arbitrary memory corruption and potential control-flow hijacking via repurposed physical pages rather than a bounded or crash-only effect.\nA:H - Operating on invalid struct page pointers during pinning/DMA mapping can trigger kernel oopses or panics, and the underlying use-after-free class of bug inherently threatens system availability even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63879","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63881","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local `ioctl()` on `/dev/kfd` via `AMDKFD_IOC_DBG_TRAP` with `KFD_IOC_DBG_TRAP_SUSPEND_QUEUES` or `KFD_IOC_DBG_TRAP_RESUME_QUEUES`; there is no network, adjacent-radio, or physical-access path to the vulnerable code.\nAC:L - On affected 32-bit `size_t` kernel builds, an attacker fully controls `num_queues` in the ioctl and can reliably force the multiply overflow (e.g. `num_queues >= 0x40000001`) to trigger undersized `memdup_user()` followed by unbounded kernel heap corruption.\nPR:L - A local unprivileged user with AMDGPU/KFD device access can open `/dev/kfd`, enable the debug runtime and debug trap on their own process (no ptrace or root required), then invoke suspend/resume with a malicious `num_queues` value.\nUI:N - Exploitation is achieved entirely through attacker-initiated ioctl calls in an established KFD debug session; no victim interaction is required.\nS:U - Impact is kernel heap corruption and potential local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - The integer overflow causes a heap buffer far smaller than `num_queues`, and subsequent `q_array_get_index()`/`copy_to_user()` operations perform out-of-bounds kernel reads that can disclose adjacent heap memory and be leveraged for arbitrary read primitives.\nI:H - `q_array_invalidate()` and per-queue status updates write attacker-influenced values (`KFD_DBG_QUEUE_INVALID_MASK`/`KFD_DBG_QUEUE_ERROR_MASK`) far beyond the allocated buffer, constituting an out-of-bounds heap write exploitable for control-flow hijacking and arbitrary kernel modification.\nA:H - Writing billions of 32-bit values past a 4-byte kmalloc object corrupts adjacent kernel heap metadata and objects, readily causing kernel oops/panic and complete loss of availability even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63881","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63886","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered by a remote iSCSI initiator sending crafted CHAP login PDUs over TCP to the in-kernel LIO iSCSI target during the network login/authentication handshake.\nAC:L - Once an iSCSI target with CHAP is reachable, an attacker can reliably trigger the overflow by sending CHAP_R with a 0b-prefixed base64 string up to 127 characters; no race or special memory layout is required.\nPR:N - The heap overflow occurs during the CHAP authentication handshake before the password hash comparison succeeds, so exploitation is reachable by an unauthenticated remote network attacker who knows a configured CHAP username.\nUI:N - Exploitation requires only the attacker initiating an iSCSI login connection and sending malicious CHAP PDUs; no action from a victim user is needed.\nS:U - Successful exploitation corrupts kernel heap memory within the same kernel security boundary, enabling denial of service or kernel privilege escalation, not a cross-boundary escape such as VM guest-to-host.\nC:H - The out-of-bounds heap write corrupts adjacent kmalloc objects and can be leveraged for arbitrary kernel memory disclosure through heap grooming, consistent with heap overflow impact guidance.\nI:H - A controlled kernel heap out-of-bounds write of up to 79 bytes past a digest-sized buffer can corrupt adjacent structures and be developed into arbitrary code execution or kernel privilege escalation.\nA:H - The overflow causes slab-out-of-bounds writes confirmed by KASAN and can crash or destabilize the kernel during login processing, constituting high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63886","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63887","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The Linux iSCSI target (LIO) is an in-kernel SCSI target that accepts remote TCP connections on the iSCSI portal (typically port 3260); crafted Login PDUs reach the vulnerable encoder via the normal network receive and login-negotiation path.\nAC:L - Once an iSCSI target portal is reachable, an attacker can reliably trigger the overflow by sending a single Login PDU packed with unknown key=value pairs; no races or victim-dependent timing are required.\nPR:N - The heap overflow occurs during login negotiation before iSCSI authentication completes; a discovery-session login requires only InitiatorName and SessionType with no credentials, initiator ACL, or local privileges.\nUI:N - Exploitation requires only network packets sent by the attacker; no action from a legitimate user or administrator is needed beyond the target already exposing its iSCSI portal.\nS:U - The corruption is confined to kernel heap memory in the iSCSI target/login context and does not cross a VM, container, or IOMMU security boundary by itself.\nC:H - A ~24 KiB out-of-bounds write into the kmalloc-8k slab can corrupt adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - The unbounded sprintf heap overrun is a large out-of-bounds write that can corrupt adjacent heap metadata or objects to achieve arbitrary kernel memory modification and potential code execution.\nA:H - Corrupting kmalloc-8k heap objects during login response encoding can cause kernel oops, BUG, or panic, and the attack can be repeated against an exposed iSCSI target."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63887","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63888","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the in-kernel LIO iSCSI target, reachable by sending iSCSI Text PDUs over TCP after connection setup on the network-facing iSCSI portal (typically port 3260), analogous to nfsd/ksmbd network exposure.\nAC:L - An attacker fully controls login parameter negotiation (DataDigest=CRC32C) and subsequent Text PDU content; the CRC overread fires deterministically on every qualifying Text PDU, and the double-free is reliably triggered by sending a bad DataDigest followed by another Text PDU on the same ITT when ERL>0.\nPR:N - No Linux OS privileges are required; the default discovery session permits unauthenticated login (AuthMethod=None, authentication disabled), after which SendTargets Text requests reach the vulnerable handler without any credentials.\nUI:N - Exploitation requires only crafted iSCSI protocol traffic from the attacker; no victim user action such as mounting a filesystem or clicking a link is needed.\nS:U - The vulnerability corrupts kernel heap memory within the iSCSI target subsystem on the host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The CRC path performs a slab out-of-bounds read past the text_in allocation, and the double-free is a use-after-free class bug that reads freed heap metadata; per kernel guidance both OOB reads and UAFs warrant High confidentiality impact.\nI:H - The double-free corrupts the slab freelist (triggering CONFIG_SLAB_FREELIST_HARDENED BUG() on hardened kernels), providing a classic heap corruption primitive that can be leveraged for arbitrary kernel memory writes and code execution.\nA:H - The double-free provably crashes the kernel (KASAN splat or SLAB_FREELIST_HARDENED BUG()), and the heap corruption can cause kernel panics; any UAF is scored as High availability impact per kernel guidance."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63888","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63920","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (nftables netlink to install a payload-set rule, setsockopt for IPV6_RECV* options, and recvmsg). Although the trigger packet is received over IPv6, the mandatory nftables corruption step is classified as Local per kernel guidance.\nAC:L - The attacker fully controls the nftables payload-set rule, the on-wire extension header, socket receive options, and the recvmsg call, making the slab out-of-bounds read reliably reproducible without races or external conditions.\nPR:L - An unprivileged local user can create a user+network namespace, obtain CAP_NET_ADMIN there, configure nftables, open a UDPv6/raw socket with extension-header cmsg options, and trigger the bug without real root in the initial namespace.\nUI:N - No victim interaction is required; the attacker can send the crafted IPv6 datagram and call recvmsg on their own socket to trigger the out-of-bounds read.\nS:U - Impact is confined to kernel memory disclosure and potential kernel instability within the same kernel security domain; it does not cross a VM/host or IOMMU boundary.\nC:H - put_cmsg() can copy up to 2040 bytes past the actual extension header into userspace ancillary data, leaking adjacent slab/kernel memory (confirmed by KASAN slab-out-of-bounds in put_cmsg).\nI:N - The bug is an out-of-bounds read that copies kernel data to userspace; it does not modify kernel memory, corrupt control structures, or provide a write primitive.\nA:H - The out-of-bounds slab read can provoke a KASAN fault/kernel oops during put_cmsg(), and repeated triggering can deny availability of the affected system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63920","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63944","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the Bluetooth HCI ISO/CIS path (`hci_le_create_cis_sync`), reachable only via the Bluetooth radio interface. Per kernel CVSS guidance, Bluetooth vulnerabilities are scored as Adjacent, including on phones and LE Audio devices in public spaces.\nAC:L - The UAF is a race between `hci_le_create_cis_sync` dropping locks and a concurrent `hci_conn_del`. An attacker who controls one side of the CIS setup (local ISO socket threads or a remote peer timing ACL/CIS teardown) can repeatedly trigger the race; success does not depend on uncontrollable conditions like kernel memory layout.\nPR:N - No local Unix privileges are required for the highest-impact scenario: a remote Bluetooth peer in range can provoke CIS teardown/disconnect events while the victim host is performing normal LE Audio CIS establishment (e.g., phone connecting to earbuds). Local exploitation via ISO sockets also requires no special capabilities at the kernel level.\nUI:N - Both sides of the race run inside the kernel's own HCI event handling: hci_le_create_cis_pending() queues the vulnerable work from hci_le_cis_established_evt(), hci_cs_le_create_cis(), hci_unbound_cis_failed() and iso_connect_cfm(), all driven by controller events and remote peer traffic, while the freeing side is a peer-initiated disconnect reaching hci_conn_del(). On an LE Audio host the CIS establishment happens by itself when the earbuds connect and the attacker supplies the disconnect, so nothing is asked of the person holding the device; the existing pairing is a precondition of the deployment, not an in-attack user step.\nS:U - Impact is confined to kernel memory corruption within the Bluetooth subsystem on the host; this is standard kernel compromise, not a cross-boundary escape (KVM guest-to-host, IOMMU bypass, or sandbox breakout).\nC:H - This is a slab use-after-free read of `conn->conn_timeout` on a freed `hci_conn` (kmalloc-8k object). UAF reads against attacker-influencable freed objects can disclose kernel heap contents and are scored as High per kernel CVSS guidance.\nI:H - Although the immediate bug is a post-unlock dereference of a freed `hci_conn`, UAF on large `hci_conn` kmalloc objects enables heap grooming and control of freed memory contents, which can be chained into arbitrary kernel writes or code execution; UAF class bugs are scored I:H.\nA:H - Use-after-free access to a freed connection object can cause kernel oops/panic (as demonstrated by the same bug class in the related `le_read_features_complete` fix found by syzkaller). Even without full exploitation, triggering the UAF reliably causes High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63944","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63970","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local AF_VSOCK transmission (syscall/io_uring send on a connected virtio vsock socket), not by processing remote network packets. Per kernel CVSS guidance, vsock is Local.\nAC:L - An attacker fully controls the trigger: SO_ZEROCOPY, io_uring IORING_OP_SEND_ZC with IORING_RECVSEND_FIXED_BUF and a vectored iov exceeding MAX_SKB_FRAGS (17), causing io_sg_from_iter() to return -EMSGSIZE on a deterministic error rollback path.\nPR:L - Exploitation requires only an unprivileged local process that can open a vsock connection and use io_uring zerocopy send; no CAP_NET_ADMIN or real root is needed beyond ordinary local user access in a virtio-vsock environment (KVM/Firecracker/cloud microVMs).\nUI:N - No victim interaction is required; the attacker triggers the bug directly through their own socket send/io_uring operation.\nS:U - Impact is kernel memory corruption and privilege escalation within the same security domain where the send occurs (guest kernel or host kernel). It is not a cross-boundary VM escape on the receive path; the flaw is in the sender's local skb teardown.\nC:H - Incorrect __skb_frag_unref() on SKBFL_MANAGED_FRAG_REFS pages without a bound uarg corrupts refcount/lifetime of io_uring registered buffer pages, yielding use-after-free and arbitrary kernel memory read primitives.\nI:H - The refcount corruption is a memory-safety bug in kernel heap/page management that can be leveraged for arbitrary write and control-flow hijacking, not merely a bounded data change.\nA:H - The erroneous frag unref on managed zerocopy pages can cause immediate kernel oops/panic from refcount underflow or use-after-free during skb teardown, independent of full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63970","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63992","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code runs on the VXLAN/GENEVE transmit path when processing remotely received UDP-encapsulated tunnel traffic (or L2 frames forwarded through a bridge port), which is reachable by sending crafted packets over the network to the victim VTEP.\nAC:L - The attacker fully controls the inner IPv4 header fields (DF bit, length, addresses) and can reliably craft oversized packets that exceed the tunnel-adjusted PMTU on bridge-port tunnel devices without depending on race timing or uncontrollable system state.\nPR:N - Exploitation requires only the ability to send network packets to a host with VXLAN/GENEVE bridged; no local account, authentication, or capabilities on the victim are needed.\nUI:N - No victim user action is required; the kernel processes attacker-supplied packets automatically through the tunnel receive, bridge forward, and re-encapsulation path.\nS:U - The out-of-bounds read and resulting kernel oops occur within the kernel network stack on the same host; there is no crossing of a VM, container, or IOMMU security boundary beyond standard kernel memory safety failure.\nC:H - Reading through `icmp_hdr(skb)` when `transport_header` is unset causes an out-of-bounds read at `skb->head + 65535`, potentially disclosing adjacent kernel memory beyond the skb buffer before any bounds checking occurs.\nI:N - The flaw is an out-of-bounds read of the ICMP type field; it does not directly modify or write kernel memory, though it may cause a kernel fault.\nA:H - The invalid pointer dereference at offset 65535 can trigger a kernel oops or panic when accessing unmapped memory, causing denial of service on the affected host."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63992","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64000","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached when the kernel processes received Ethernet frames via the netdev RX handler in net/hsr, and a remote attacker on the HSR/PRP ring can deliver a crafted supervision frame without any local access to the victim host.\nAC:L - The attacker fully controls the malformed frame content and length; a precisely truncated supervision frame reliably passes existing TLV validation and triggers the out-of-bounds read with no races or attacker-uncontrollable conditions.\nPR:N - Exploitation requires only the ability to inject L2 HSR/PRP supervision frames onto the ring segment; no local account, capabilities, or authentication on the target kernel is needed.\nUI:N - No victim user action is required beyond normal operation of an HSR/PRP-configured node; the attacker triggers the bug solely by sending a malicious frame.\nS:U - Impact is confined to kernel memory safety within the same security authority; there is no VM escape, IOMMU bypass, or cross-security-boundary scope change.\nC:H - The bug is an out-of-bounds read of supervision TLV header fields past the skb tail, which can disclose adjacent kernel heap/skb memory and is not strictly bounded to a few attacker-uncontrolled bytes.\nI:H - Out-of-bounds access in kernel packet parsing can supply attacker-influenced TLV type/length values that drive further skb_pull arithmetic and extended parsing, creating a plausible path to memory corruption and control-flow hijacking.\nA:H - Reading beyond the skb buffer boundary during softirq packet processing can cause a kernel oops/panic, and the attacker can repeatedly trigger the condition with crafted frames."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64000","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64002","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls—network namespace teardown via unshare/setns/put_net, sysctl access to /proc/sys/net/ipv4/ip_local_reserved_ports, and/or local socket bind/connect—not remote packet delivery.\nAC:L - The attacker can control both sides of the race by concurrently tearing down a network namespace while hammering the sysctl or triggering socket port selection in that namespace.\nPR:L - An unprivileged local user can reach this via user namespaces (CAP_SYS_ADMIN within the user_ns for CLONE_NEWNET) and world-writable sysctl access (mode 0644) during namespace destruction.\nUI:N - No victim interaction is required beyond the attacker's own concurrent namespace teardown and sysctl or socket activity.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it is standard local kernel memory corruption, not a VM/hypervisor boundary escape.\nC:H - Freed 8 KiB bitmap memory remains reachable via sysctl reads (find_next_bit) and inet_is_local_reserved_port() (test_bit), enabling heap information disclosure through a use-after-free.\nI:H - Sysctl writes via proc_do_large_bitmap perform bitmap_copy/bitmap_or into the freed allocation, providing a heap write primitive exploitable for control-flow hijacking.\nA:H - Concurrent access to the freed bitmap can cause kernel oops/panic from invalid memory access, and UAF exploitation inherently threatens kernel availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64002","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64007","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered when remote TCP packets traverse SYNPROXY netfilter hooks (NF_INET_LOCAL_IN / NF_INET_POST_ROUTING) on a host with SYNPROXY configured, which is the standard internet-facing firewall/router deployment for this subsystem.\nAC:L - An attacker who controls a TCP session through SYNPROXY can reliably send timestamp-bearing packets to hit the vulnerable path; the stale-pointer UAF write occurs whenever skb_ensure_writable() must expand a cloned skb, which the attacker can influence by sustaining traffic on the proxied connection.\nPR:N - Exploitation requires only that the victim already runs SYNPROXY (normal for protected services); the remote attacker needs no credentials or local privileges on the target system to send the triggering TCP packets.\nUI:N - No victim user action is required beyond normal network operation; exploitation is fully automated via crafted or sustained TCP traffic through the SYNPROXY session.\nS:U - Impact is confined to kernel memory on the affected host running SYNPROXY; this is standard kernel privilege escalation/memory corruption, not a cross-VM or cross-security-boundary escape.\nC:H - The stale tcphdr pointer causes inet_proto_csum_replace4() to write into freed slab memory, a use-after-free class bug that can be leveraged for arbitrary kernel memory read via heap grooming techniques.\nI:H - The out-of-bounds write into freed slab memory via a stale tcphdr pointer is a use-after-free write primitive that can be developed into arbitrary kernel memory writes and local privilege escalation.\nA:H - Writing into freed slab memory can corrupt adjacent kernel objects and cause kernel oops, panic, or crash, and UAF conditions are inherently capable of destabilizing the system even during exploitation attempts."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64007","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64015","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through find_key_to_update() on the persistent keyring register, which is invoked from keyctl_get_persistent() via the keyctl(2) syscall. There is no network, adjacent-radio, or physical-device path to this code.\nAC:L - Exploitation is a race between assoc_array_find() and assoc_array_gc() on the .persistent_register keyring; the attacker controls both sides by repeatedly calling KEYCTL_GET_PERSISTENT (including from multiple threads) while driving key expiry/GC via keyctl timeouts or natural garbage collection. Per kernel guidance, attacker-controlled races are AC:L.\nPR:L - Any unprivileged local user who can invoke keyctl() can call KEYCTL_GET_PERSISTENT for their own UID (-1) with a writable destination keyring (e.g., session keyring). No real-root or CAP_SETUID capability is required for the vulnerable lookup path; this remains PR:L even inside user namespaces.\nUI:N - Exploitation requires only the attacker's own keyctl syscalls and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary on its own.\nC:H - assoc_array_find() is documented to require an RCU read lock, but the persistent-keyring path called it without one while assoc_array_gc() frees tree nodes via call_rcu(), yielding a use-after-free on assoc_array nodes/leaves. UAF on kernel heap objects can be turned into arbitrary kernel memory reads.\nI:H - The freed assoc_array nodes can be reallocated and corrupted through concurrent GC versus lookup, providing a standard kernel heap UAF primitive that can be developed into arbitrary write or code-execution primitives.\nA:H - Dereferencing RCU-freed assoc_array tree nodes during lookup can cause kernel oops/panic from invalid pointer access, and UAF exploitation commonly destabilizes or crashes the kernel even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64015","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64018","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached via MSI-driven hardware completion processing in the MANA HWC control path (not netdev packet receive), triggered when the Azure hypervisor/host tampers with guest-visible DMA-coherent WQE memory on the same physical compute node.\nAC:L - A malicious host or NIC firmware that can modify shared unencrypted DMA buffers controls both the forged sge->address and the timing of HWC RX completions, allowing reliable out-of-bounds indexing without winning a race or depending on guest state.\nPR:N - Exploitation requires no privileges on the victim guest VM; the attacker operates from the Azure hypervisor/host side by modifying DMA-coherent memory that the guest kernel trusts during HWC response handling.\nUI:N - No victim user action is required; exploitation occurs automatically when the driver processes a hardware completion event on the HWC receive queue.\nS:C - In Confidential VMs the guest relies on host isolation guarantees, but shared unencrypted DMA memory lets a hostile hypervisor cross that CVM security boundary to corrupt guest kernel memory and confidentiality.\nC:H - An out-of-bounds rx_req_idx yields a corrupted hwc_work_request whose buf_va is dereferenced and copied via memcpy in mana_hwc_handle_resp(), enabling arbitrary kernel memory disclosure.\nI:H - The out-of-bounds hwc_work_request supplies attacker-controlled pointers and SGE fields used to repost RX WQEs via mana_hwc_post_rx_wqe(), enabling kernel heap corruption and exploitable memory writes.\nA:H - Indexing reqs[] out of bounds with attacker-controlled values can dereference invalid kernel pointers and corrupt adjacent heap objects, causing kernel oops/panic and denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64018","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64029","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access via the ALSA sequencer device node (/dev/snd/seq) using write(2) and port-subscription ioctls; there is no network, Bluetooth, or physical-device attack surface on the vulnerable code path.\nAC:L - The race is between concurrent UMP event delivery and the last output-port unsubscribe/close path, and a local attacker can control both sides with parallel threads (flood write() while repeatedly subscribing/unsubscribing to the UMP port).\nPR:L - Any local unprivileged user who can open /dev/snd/seq (typically membership in the audio group on desktop/workstation systems where UMP MIDI hardware is present) can create sequencer clients, subscribe to UMP kernel ports, and trigger the bug without real root or init-namespace capabilities.\nUI:N - Exploitation is fully attacker-driven through sequencer writes and subscription management; no victim interaction such as opening files, mounting filesystems, or plugging in devices is required beyond the UMP endpoint already being present on the system.\nS:U - Impact is confined to kernel memory corruption and potential local privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary bypass.\nC:H - KASAN confirmed a slab use-after-free on freed substream runtime metadata in snd_rawmidi_kernel_write1(); UAF on kernel heap objects enables controlled reallocation and arbitrary kernel memory disclosure primitives.\nI:H - The UAF occurs inside snd_rawmidi_kernel_write1(), which performs memcpy() into runtime->buffer using attacker-supplied UMP event payload, providing a plausible path to arbitrary kernel memory corruption and code execution beyond a simple crash.\nA:H - The confirmed KASAN slab-use-after-free in kernel write path causes kernel oops/panic; even without full exploitation, the bug reliably threatens system availability through kernel crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64029","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64034","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a malicious hypervisor or host that can modify MANA HWC DMA-coherent response buffers between guest kernel loads; it is not reachable by sending network packets to the guest's data path.\nAC:L - The attacker controlling the hypervisor fully controls DMA buffer contents and can reliably flip hwc_msg_id between the validation read and the use in mana_hwc_handle_resp() on uncacheable coherent memory.\nPR:N - The attacking hypervisor needs no guest OS credentials or capabilities; exploitation targets the guest kernel through the virtual device DMA path while the MANA driver is active.\nUI:N - No victim user action is required beyond normal Azure VM operation with the MANA driver loaded and HWC receive buffers posted.\nS:C - The vulnerability crosses the VM/DMA security boundary by allowing a hostile hypervisor to corrupt guest kernel memory that the confidential-guest threat model assumes is protected from host tampering.\nC:H - Out-of-bounds indexing via bypassed hwc_msg_id validation enables reading adjacent kernel heap objects through misdirected caller_ctx access and test_bit() on the inflight bitmap.\nI:H - Host-controlled response data is copied with memcpy() to an out-of-bounds output_buf pointer, enabling arbitrary kernel memory corruption and potential control-flow hijacking.\nA:H - Out-of-bounds caller_ctx access and corrupted completion signaling can cause kernel oops, panic, or hang during HWC response handling."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64034","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64048","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The fault is triggered while processing a malicious CLC ACCEPT message received from a remote TCP peer during the SMC-D handshake; the attacker controls the server response over the network.\nAC:L - Once a victim with SMC-Dv2 hardware initiates an SMC connection, a malicious peer can reliably send `d1.chid == 0` in the CLC ACCEPT to match the empty reserved slot 0 without races or special timing.\nPR:N - No local privileges are required on the victim host; an unauthenticated remote attacker operating a malicious SMC server can crash connecting clients, and unprivileged users can create SMC sockets without capability checks.\nUI:N - Exploitation requires only that a victim application initiate a normal outbound SMC connection to the attacker's server, which occurs automatically in enterprise middleware without per-connection user action.\nS:U - The vulnerability causes a kernel crash on the victim host but does not cross a security boundary such as VM escape or sandbox breakout.\nC:N - The bug is a null pointer dereference when taking `ism_dev[0]->lgr_lock`; it causes an immediate kernel fault with no information disclosure.\nI:N - The attempted write at address 0x68 is a spinlock operation on a NULL `smcd_dev` pointer, not a controlled or arbitrary memory modification primitive.\nA:H - A successful trigger causes a kernel null pointer dereference (KASAN-reported oops/panic), crashing the affected system or at minimum the connecting process's kernel context."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64048","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64098","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through local DRM ioctl syscalls (DRM_IOCTL_MODE_CURSOR and DRM_MASTER modesetting ioctls) on /dev/dri/card0, not via any network-facing kernel service.\nAC:L - An attacker can reliably trigger the bug by signaling a thread blocked in dma_resv_lock_interruptible (-EINTR), forcing memory pressure for -ENOMEM, or running concurrent plane updates to race the unlocked fence-list mutation.\nPR:L - Exploitation requires DRM master on the virtio-gpu device, which a local user with standard DRI access (video/render group membership on typical virtio-gpu VMs) can obtain when no compositor holds master; this is not init-namespace root.\nUI:N - Triggering the bug requires only attacker-initiated DRM ioctl calls (cursor/plane updates); no action by another user or victim is needed.\nS:U - The corruption occurs within the same kernel security domain (guest or host) that issued the ioctl; virtio-gpu runs in the guest kernel and this does not cross a VM/hypervisor boundary to the host.\nC:H - Mutating the dma_resv fence list without holding the lock races with concurrent readers and can corrupt kernel heap metadata, which is reasonably leverageable for arbitrary memory disclosure.\nI:H - The same unlocked fence-list corruption can corrupt kernel pointers and synchronization state, providing a plausible path to arbitrary kernel writes or control-flow hijacking.\nA:H - The bug produces kernel WARN/oops under lockdep and fence-list corruption can cause kernel crashes, hangs, or panics during subsequent dma_resv operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64098","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64109","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local syscalls on AF_UNIX SOCK_STREAM sockets (recvmsg, splice_read, setsockopt SO_PEEK_OFF), not via any network protocol handler.\nAC:L - The attacker controls both racing threads on the same socket fd and can retry the peek/normal-recv interleaving; this is a self-induced race, not one dependent on uncontrollable kernel state.\nPR:L - Any unprivileged local user can create AF_UNIX socketpairs, set SO_PEEK_OFF, and run concurrent recv operations without capabilities, including from within user namespaces.\nUI:N - Exploitation requires no victim interaction; the attacker sets up and races their own socket endpoints programmatically.\nS:C - Successful kernel heap UAF exploitation from an unprivileged container, Android app sandbox, or user-namespace tenant crosses the sandbox boundary to compromise the host kernel.\nC:H - This is a slab use-after-free read of sk_buff->len on freed memory, which per UAF guidance enables arbitrary kernel memory disclosure and heap layout leaks.\nI:H - UAF on sk_buff objects in the kernel heap can be leveraged through heap grooming and spraying to obtain arbitrary write and kernel code execution primitives.\nA:H - The UAF read can trigger KASAN slab-use-after-free faults, kernel oops, or panic during the dereference, and repeated triggering causes denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64109","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64114","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (socket/sendmsg on a raw IP_HDRINCL socket); malformed packets are injected locally into the output path, not via remote network ingress which validates ihl >= 5.\nAC:L - The attacker fully controls the crafted header ihl value and can install the required xfrm AH policy and route via CAP_NET_ADMIN in their own network namespace, making exploitation reliable without conditions outside attacker control.\nPR:L - Triggering requires CAP_NET_RAW for raw sockets and CAP_NET_ADMIN to install xfrm AH policy, both obtainable by an unprivileged user via user+network namespaces or a container granted NET_ADMIN without init-namespace root.\nUI:N - No victim interaction is required; the attacker sends the malformed packet directly through their own raw socket and configured IPsec policy.\nS:U - Impact is kernel memory corruption and panic within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The integer underflow in ah_output() memcpy length produces an out-of-bounds read of near SIZE_MAX bytes, providing an arbitrary kernel memory read primitive beyond any bounded disclosure.\nI:H - The same memcpy with underflowed length causes a massive out-of-bounds write that can corrupt adjacent kernel heap memory and be leveraged for control-flow hijacking.\nA:H - The OOB memcpy reliably causes a kernel-mode fault and host panic, as reproduced with KASAN and in a rootless Docker container, denying all system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64114","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64115","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local AF_VSOCK syscalls (connect/close) to drive VMCI control packets; per kernel CVSS guidance, vsock is scored Local even when the peer is a VM guest reaching a host listener.\nAC:L - The attacker controls both sides of the handshake race by initiating a connection and aborting it with RST during TCP_SYN_SENT; KASAN testing showed 52/100 repro without conditions outside attacker control.\nPR:L - Any unprivileged local user inside a VM (or on the same host) can open AF_VSOCK sockets and connect to a listening peer without CAP_NET_ADMIN or other elevated privileges.\nUI:N - Exploitation requires only a victim service with a bound/listening vsock socket, which is normal background operation; no interactive victim action is needed.\nS:C - In the most severe reasonable VMware deployment, an unprivileged guest VM triggers kernel memory corruption on the hypervisor host via VMCI vsock, crossing the guest-to-host virtualisation security boundary analogous to KVM/Xen VM escape.\nC:H - The bug is a slab use-after-free on struct sock; UAF on kernel heap objects enables arbitrary memory read primitives through controlled reuse of the freed socket structure.\nI:H - The UAF involves a write to a freed object's refcount field and corrupts kernel heap metadata, providing a foundation for arbitrary write and kernel code execution via heap grooming.\nA:H - The vulnerability reliably triggers kernel UAF detected by KASAN (refcount write to freed memory on a kworker), which causes kernel oops/panic and denial of host availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64115","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64247","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggering requires a Hyper-V TLB-flush hypercall from an L2 vCPU under KVM, ultimately reached through the local KVM_RUN ioctl; no network path reaches it.\nAC:L - A malicious nested-virtualization tenant controls both the unchecked enlightened-VMCS/VMCB VP ID and the sparse-bank hypercall data, with no uncontrollable race required.\nPR:L - The attacker needs control of a KVM guest with nested virtualization, or ordinary /dev/kvm access to create one, but requires neither host root nor an init-namespace capability.\nUI:N - Once the crafted nested guest executes, no action by another user is required.\nS:C - The out-of-bounds access occurs in the host kernel from attacker-controlled guest state, crossing the KVM guest-to-host isolation boundary.\nC:H - The attacker-selected VP ID makes test_bit() query selectable bits far beyond the stack-resident 64-bit mask, and the resulting TLB-flush decision can provide an oracle for host kernel memory.\nI:N - The primitive performs reads only; a set result merely selects a legitimate L2 vCPU for an extra TLB flush, with no out-of-bounds write or unsafe mapping change.\nA:H - The selectable access can reach a VMAP_STACK guard or another unmapped page and oops the host; KASAN already detects the access as an eight-byte invalid read, which can become a host-wide denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64247","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64266","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - A local attacker reaches the flaw by serving a self-created FUSE mount and invoking splice() on its associated /dev/fuse descriptor.\nAC:L - The attacker controls writeback generation, splice processing, and concurrent connection abort, allowing repeated attempts at the race without an uncontrollable prerequisite.\nPR:L - FUSE supports user-namespace mounts, and an unprivileged mount owner can operate /dev/fuse and abort their own connection without init-namespace root.\nUI:N - The attacker can create and exercise their own FUSE connection without any victim action.\nS:U - Exploitation compromises the kernel within the same operating-system security authority and does not inherently cross a virtualization boundary.\nC:H - The freed argument and folio arrays are subsequently dereferenced, permitting attacker-influenced stale folio pointers and potential arbitrary kernel-memory disclosure through pipe buffers.\nI:H - Heap reclamation can replace the freed folio pointers and loop metadata, enabling attacker-directed memory or refcount operations that may support arbitrary writes and kernel code execution.\nA:H - The repeatable use-after-free and invalid folio operations can cause an oops, panic, or other complete system failure."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64266","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64268","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - siw carries iWARP over ordinary routable TCP, and the vulnerable receive callback processes crafted Read Response FPDUs from the remote endpoint of an established RDMA connection.\nAC:L - The peer learns the sink tag, address, and length from the RREAD and can deterministically send oversized continuation segments; no race or uncontrollable condition is required.\nPR:N - The MPA/siw data path performs no credential or capability check on the connected peer, and an unauthenticated RDMA service can accept the connection and issue attacker-induced RREADs.\nUI:N - The overflow is triggered through an automated RDMA protocol exchange and requires no human action.\nS:U - The corruption compromises resources within the affected host's kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The global DMA/KVA sink case exposes the sink address and permits attacker-controlled kernel memory corruption, which can enable control-flow hijacking and arbitrary kernel-memory disclosure.\nI:H - Attacker-chosen response bytes are written beyond the validated sink into adjacent kernel memory, providing an exploitable out-of-bounds write capable of modifying objects or achieving kernel code execution.\nA:H - The overwrite can corrupt critical kernel objects or reach invalid memory, causing an oops or panic; bounded FRWR sinks still permit connection-terminating denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64268","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64304","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An unprivileged local process can add a crafted PKCS#8 RSA private key to its own keyring and invoke KEYCTL_PKEY_QUERY, which selects qat-rsa and reaches the vulnerable key setup path.\nAC:L - With an active QAT asymmetric service and PKCS#8 parser, an oversized CRT integer deterministically causes unsigned offset underflow and an out-of-bounds memcpy. No race or attacker-uncontrollable condition is required.\nPR:L - An ordinary user can create, search, and use keys in a personal process, thread, or session keyring. No capability, administrator privilege, or user namespace is required.\nUI:N - The attacker directly performs the add_key and keyctl system calls without any victim action.\nS:U - The vulnerable QAT driver and the corrupted kernel resources share the same security authority. Ordinary kernel privilege escalation does not cross a CVSS scope boundary.\nC:H - The controlled kernel-memory overwrite can corrupt page tables, credentials, or control-flow objects and plausibly yield code execution with access to protected kernel memory.\nI:H - Attacker-controlled CRT bytes are written outside the coherent DMA allocation, potentially through multiple CRT components. This can provide powerful kernel-memory corruption and control-flow hijacking primitives.\nA:H - The invalid destination can cause an immediate kernel fault or corrupt unrelated kernel memory and subsequently panic or hang the system. The attack is repeatable."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64312","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - pcrypt is designed for network-facing IPsec use, and an inbound ESP packet can traverse xfrm_input(), esp_input(), crypto_aead_decrypt(), and pcrypt_aead_decrypt().\nAC:L - In load-responsive CPU-hotplug deployments, an attacker can flood qualifying ESP requests across repeated PADATA_RESET windows without precise timing or an uncontrollable memory-layout condition.\nPR:N - The ESP SPI is transmitted in clear, and the faulty path is reached before the child AEAD validates the integrity tag, so an unauthenticated on-path attacker needs no target-system privileges.\nUI:N - Packet delivery and asynchronous completion require no victim action.\nS:U - The failure affects the same kernel security authority processing the request and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The rejected request retains a zero padata->pd pointer, producing a NULL dereference without an out-of-bounds read or information disclosure.\nI:N - The callback writes only the completion status into its valid request context before dereferencing NULL; it provides no attacker-directed corruption or write primitive.\nA:H - padata_do_serial() dereferences the uninitialized padata->pd pointer, causing a kernel oops or panic that can terminate the system and can be retriggered."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64312","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64355","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A remote peer can send an oversized packet that a fragment-capable NIC represents as a multi-buffer XDP frame, reaching the vulnerable devmap broadcast clone path on a configured forwarding host.\nAC:L - No race or uncontrollable timing condition is required; fragmented packets reliably enter the faulty clone path and can be sent repeatedly.\nPR:N - Although initial-namespace CAP_BPF and CAP_NET_ADMIN are needed to configure the XDP deployment, the attacker sending packets through the already-configured unauthenticated data path needs no privileges.\nUI:N - Packet reception and XDP processing occur automatically without victim action.\nS:U - The corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other distinct boundary.\nC:H - Uninitialized fragment descriptors are consumed as page references and can be used by scatter-gather transmitters for unintended DMA mappings, potentially exposing arbitrary kernel memory.\nI:H - An uninitialized fragment count can overrun fixed-size driver arrays, while bogus page references can cause invalid refcount decrements, premature frees, and exploitable kernel memory corruption.\nA:H - Invalid fragment metadata can fault during DMA mapping, transmission, or frame return and cause a kernel oops or panic; an attacker can trigger this repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64355","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64383","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB server can trigger the flaw through crafted replayable responses and connection failures over the network.\nAC:L - The server controls both the replayable error and subsequent reconnect failure, allowing repeated triggering without an uncontrollable race.\nPR:N - The attacking SMB endpoint requires no privileges on the client system once an SMB session and file handle exist.\nUI:N - An automatically mounted share and routine service-generated fsync, truncate, timestamp, or seek operations can reach SMB2_flush() without human participation.\nS:U - The memory corruption compromises resources governed by the same host kernel security authority.\nC:H - The response-buffer double-free can create overlapping CIFS slab allocations and use-after-free primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and attacker-influenced overlapping network buffers can provide arbitrary-write or control-flow-hijacking primitives.\nA:H - The double-free can immediately trigger an allocator BUG, kernel oops, or panic and can be invoked repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64383","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64384","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious SMB server can return a replayable response and then force reconnect failure over the network, causing the client to free stale response state twice.\nAC:L - The peer controls both prerequisites by returning a status such as STATUS_RETRY and then disconnecting or refusing reconnection; repeated attempts make the scheduling window attacker-controllable.\nPR:N - The malicious SMB peer requires no account, capability, or other privilege on the vulnerable client; the established client session does not grant the attacker privileges on that host.\nUI:N - An ordinary automated CIFS workload can maintain an outstanding change-notify request, after which the remote peer completes the trigger without human involvement.\nS:U - Exploitation compromises the kernel and resources governed by the same host security authority, without crossing a separate virtualization or sandbox boundary.\nC:H - The double-free corrupts the CIFS response-buffer slab or mempool, permitting overlapping live objects and freelist manipulation that can support disclosure of arbitrary kernel memory.\nI:H - The heap corruption can provide attacker-influenced writes through aliased request and response buffers or freelist poisoning, potentially enabling kernel control-flow hijacking.\nA:H - Hardened allocators can immediately panic on the consecutive double-free, while unhardened allocators can crash later through freelist corruption."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64384","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64385","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - An attacker-controlled SMB server can deliver crafted SMB2 IOCTL responses over TCP, including through the kernel's periodic interface-query FSCTL on an existing SMB3 mount.\nAC:L - On a hard or retrans-enabled mount, the server controls replayable statuses, response contents, disconnects, reconnects, and repeated attempts, allowing it to drive both sides of the triggering sequence.\nPR:N - The malicious SMB server needs no account or privilege on the target; victim mounting authority and client authentication do not grant or require attacker-side target privileges.\nUI:N - Once the share is mounted, kernel delayed work can automatically issue the affected FSCTL when the server advertises multichannel support, requiring no user action during exploitation.\nS:U - The memory corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, container, or IOMMU boundary.\nC:H - The response-buffer double-free can corrupt SLUB or mempool state and create dangling or overlapping live buffers, enabling use-after-free exploitation and kernel-memory disclosure.\nI:H - Attacker-controlled network data can overwrite aliased or freed buffers and poison allocator state, supporting arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can trigger an allocator BUG or corrupt kernel heap state, causing an oops, panic, or complete system crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64385","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64386","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB2/3 server can remotely return a response-bearing replayable error and manipulate the subsequent connection state, reaching the vulnerable client over TCP.\nAC:L - The server controls the error response, disconnect, and reconnection sequence and can repeat it until the stale free occurs. Replay-enabled hard or retrans-configured SMB mounts are a reasonable deployment.\nPR:N - The malicious SMB peer needs no privileges or credentials on the client; SMB session setup authenticates the client to the server, not the attacker to the victim kernel.\nUI:N - Once the share is mounted, ordinary or automated file and metadata operations issue query-info requests, and exploitation requires no human action during the crafted response and reconnect sequence.\nS:U - The corruption and resulting impacts occur within the same Linux kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:H - The double-free corrupts SMB response-buffer slab and mempool state, enabling aliased or use-after-free buffers that can be leveraged to expose kernel memory.\nI:H - Allocator freelist corruption and reuse of one buffer by concurrent SMB operations can provide attacker-controlled modification of live kernel memory and support control-flow hijacking.\nA:H - The repeated free can immediately cause allocator corruption, a BUG, kernel oops, or panic, and the malicious server can trigger the sequence repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64386","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64387","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious remote SMB server can trigger the flaw through crafted responses to SMB2 QUERY_DIRECTORY requests over the established network connection.\nAC:L - On a hard/retrans-enabled mount, the server controls the replayable error and can repeatedly induce disconnect/reconnect conditions before request reinitialization, without relying on an uncontrollable race.\nPR:N - The attacker needs no account or privilege on the client; the client authenticates to the attacker-controlled SMB server, and ordinary accessible-share enumeration reaches the code.\nUI:N - In a reasonable auto-mounted deployment, routine directory enumeration can be performed automatically by a daemon or application without human participation.\nS:U - The corruption occurs within the client kernel and compromises resources governed by that same kernel security authority.\nC:H - Double-freeing the attacker-influenced CIFS response object can poison the slab freelist or create overlapping allocations, providing UAF-style primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and aliased CIFS buffers can enable attacker-influenced writes and potentially control-flow hijacking or kernel code execution.\nA:H - The double-free can immediately trigger allocator diagnostics, an oops, or a kernel panic, and corrupted freelists can cause subsequent fatal faults."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64387","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64423","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An end-to-end attacker-controlled trigger requires local socket and netlink operations to create multicast memberships and concurrently destroy IPv4 device state; received multicast packets alone cannot initiate the necessary teardown. These operations are reachable inside an attacker-created user and network namespace.\nAC:L - The attacker can populate mc_hash, generate continuous multicast traffic, and repeatedly tear down IPv4 state, controlling both sides of the race. No victim-dependent timing or secret state is required.\nPR:L - Device teardown or invalid-MTU configuration requires CAP_NET_ADMIN in the target network namespace, while multicast joins and UDP sends are unprivileged. An ordinary user can obtain this namespace-scoped capability through unprivileged user and network namespaces.\nUI:N - Exploitation requires no action by another user once the attacker can execute locally and create the required namespace and traffic.\nS:U - The vulnerable code and resulting host-kernel compromise remain within the same security authority; this is conventional kernel privilege escalation rather than a guest-to-host escape.\nC:H - The stale kmalloc-256 ip_mc_list entry exposes reuse-controlled fields and pointers to kernel reads, making kernel-memory disclosure and broader read primitives plausible.\nI:H - Reallocation permits attacker-influenced object contents to drive spinlock writes and pointer traversal on freed memory, making heap corruption and control-flow hijacking defensible.\nA:H - The confirmed slab use-after-free can dereference corrupted hash pointers or operate on an invalid spinlock, causing a kernel oops, panic, general-protection fault, or hang."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64423","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64450","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - TIPC packets can arrive through an IP/UDP bearer from a routable remote source, and the receive callback does not restrict packets to configured remote addresses. An attacker can also establish or spoof the required TIPC neighbour state without credentials.\nAC:L - The attacker controls capability advertisement, link establishment, broadcast synchronization, and the malformed STATE message; one packet then reliably performs the out-of-bounds copy without a race or uncontrollable condition.\nPR:N - The packet-receive path performs no capability or user-credential check, and TIPC discovery and link negotiation are unauthenticated when optional cryptographic keys are not configured. The vulnerable broadcast processing also precedes normal STATE-session validation.\nUI:N - No victim action is required after the TIPC bearer is active; receipt of the crafted STATE message directly invokes the vulnerable code.\nS:U - The vulnerability compromises availability and potentially confidentiality within the receiving kernel's existing security authority, without crossing a VM, IOMMU, or comparable scope boundary.\nC:H - The attacker-controlled count makes the kernel copy up to 1,024 bytes from a much smaller skb, incorporating substantial adjacent slab contents rather than a strictly bounded few-byte read.\nI:N - The defect performs an out-of-bounds read into a correctly sized new allocation; investigation found no out-of-bounds write, arbitrary-write primitive, or control-flow corruption.\nA:H - The demonstrated 1,024-byte slab-out-of-bounds access produces a KASAN BUG and can panic or fault hardened kernels, and an unauthenticated attacker can trigger it repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64450","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64481","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the vulnerable callbacks through ALSA control ioctls on /dev/snd/controlC*. No network or physical protocol directly exposes this path.\nAC:L - After teardown, stale controls can repeatedly dereference the freed object or queue its embedded work item, so exploitation does not require winning a narrow race. A queued work_struct also remains directly usable after its containing allocation is freed.\nPR:L - An unprivileged user with ordinary audio-device access can invoke the control callbacks. The ioctl path contains no capability, namespace, or administrative privilege check.\nUI:N - Exploitation requires no victim to open content or perform an interactive action.\nS:U - The vulnerable driver and the affected kernel resources are governed by the same kernel security authority.\nC:H - The heap use-after-free permits attacker-influenced reuse and disclosure of freed kernel object contents, potentially supporting arbitrary kernel memory reads.\nI:H - The freed object embeds mutable workqueue list state and a function pointer that is subsequently invoked, making kernel memory corruption and control-flow hijacking defensible.\nA:H - Stale control accesses or corrupted queued work can cause a kernel oops, panic, or workqueue corruption, resulting in complete system unavailability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64481","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64524","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The malicious resolution response must originate from the local Hyper-V synthetic-video backend over VMBus; it is not reachable through a network protocol or guest userspace ioctl.\nAC:L - The backend can deterministically trigger the flaw by returning a resolution_count from 65 through 255 during the normal WIN10+ probe or resume exchange, without a race or unpredictable condition.\nPR:N - The guest accepts the VMBus response without authentication, capability checks, or guest credentials; a malicious or compromised backend requires no privileges within the vulnerable guest.\nUI:N - The response is processed automatically during device probing or resume, without any victim action.\nS:U - The vulnerable parser and the affected DRM and kernel resources are within the same guest-kernel security authority; this does not produce a guest-to-host escape.\nC:H - A count of 255 causes 191 additional four-byte entries to be read beyond the declared array, substantially exceeding a small bounded disclosure and allowing out-of-bounds kernel data to influence observable display state.\nI:N - The invalid accesses are reads, and their results are written only to the intended resolution fields; no out-of-bounds write, use-after-free, or control-flow corruption was found.\nA:H - Bounds-instrumented hardened kernels can oops when index 64 is reached, while a failed or malformed resolution probe can leave zero maximum dimensions and make every userspace framebuffer creation fail."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64524","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64541","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable handler is driven entirely by a CDC control message sent by the remote SMC-R peer over the RDMA link, with an attacker-chosen `token` field and no local syscall involvement. SMC-R runs over RoCEv2 (IP/UDP-routable, port 4791) with the CLC handshake over plain TCP, and SMC-Rv2 explicitly supports non-local/routed peers, so the attacker need not share an L2 segment.\nAC:L - The attacker controls both sides of the race: it chooses when to emit CDC messages and which connection to target (the alert token is disclosed to it in the CLC accept/confirm), and it can drive the teardown side itself via CDC close/abort flags into `smc_close_passive_work()` or a stale seqno with `failover_validation` into `abort_work` -> `smc_conn_kill()`. The race can be retried indefinitely across many connections in the same link group, and was reproduced in practice with soft-RoCE.\nPR:N - Establishing an SMC-R connection to a listening SMC socket requires no credentials — SMC has no authentication layer of its own, exactly like plain TCP. Everything after connection establishment (sending CDC messages with a chosen token, signalling close/abort) is available to an unauthenticated peer.\nUI:N - The CDC message is processed in a softirq tasklet from the RDMA completion queue with no involvement from any local user or application action. No victim interaction of any kind is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard in-kernel use-after-free.\nC:H - The freed `smc_sock` is reused type-safely as another live socket, so attacker-supplied cursors applied by `smc_cdc_msg_recv_action()` break the `0 <= bytes_to_rcv <= rmb_desc->len` invariant and make `smc_rx_recvmsg()` hand stale RMB contents to userspace, while the urgent-data path reads `*(base + conn->urg_curs.count - 1)` at an attacker-chosen offset. Once the slab page is reclaimed after the RCU grace period, reuse is unconstrained, giving a general kernel-memory read primitive.\nI:H - `sock_hold()` on an already-zero refcount followed by `sock_put()` re-enters `sk_free()`, yielding a double free, and the handler additionally writes `sk_err`/`sk_shutdown`, makes indirect calls through `sk_data_ready()`/`sk_write_space()`, and `queue_work()`s a freed `work_struct`. These are classic heap-spray and control-flow-hijack primitives leading to arbitrary kernel write.\nA:H - The reported symptom is `refcount_warn_saturate` from `smc_cdc_msg_recv()`, which is an immediate kernel panic on `panic_on_warn` systems, and dereferencing freed memory in softirq context otherwise oopses. The attacker can trigger it repeatedly without authentication."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64541","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64543","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The free side is only reachable through the local TIPCv2 generic-netlink `BEARER_DISABLE` command (or netns teardown); a remote peer can supply the discovery packet that performs the use-after-free access but cannot itself cause `bearer_disable()` to run, so the complete attack requires local access.\nAC:L - The attacker controls both sides of the race — one thread floods TIPC discovery packets at the bearer's UDP port while another disables the bearer — and `bearer_disable()` clears `b->up` and then `kfree()`s the discoverer with no synchronization whatsoever, leaving a wide window that a multi-CPU packet flood hits reliably (a working PoC exists).\nPR:L - `tipc_genl_family` is `.netnsok = true` and the bearer enable/disable ops carry no `GENL_ADMIN_PERM` or other capability check, so an unprivileged user can do everything inside `unshare -Urn` after autoloading tipc via `socket(AF_TIPC, ...)`.\nUI:N - The attacking process performs both the bearer disable and the packet injection itself; no victim action or cooperating user is involved.\nS:U - The corruption stays within the kernel's own security authority — no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - `d->net` is read from the freed slab object and dereferenced as a `struct net *`; after reclaiming the kmalloc-192 allocation with sprayed data the attacker gains a controlled-pointer dereference chain usable for arbitrary kernel memory disclosure.\nI:H - `msg_set_prevnode(buf_msg(d->skb), sugg_addr)` writes a wire-controlled 32-bit value through the dangling `d->skb` pointer, and `tipc_disc_add_dest()` takes a spinlock and increments a counter in freed memory — together a controlled-address/controlled-value write suitable for control-flow hijacking.\nA:H - The use-after-free reliably produces a KASAN slab-use-after-free in softirq context and, on production kernels, a corrupted-pointer dereference or spinlock manipulation on reclaimed memory leading to kernel panic."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64543","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64562","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local KVM nested VMX: open /dev/kvm, run a nested guest, then tear down nested state (VMXOFF/handle_vmxoff or vmx_leave_nested). It is not reachable via network or adjacent-radio packets.\nAC:L - A KVM VMM attacker controls both sides of the race by driving nested teardown (VMXOFF/vcpu destroy) while forcing vCPU migration via thread affinity/scheduling so __loaded_vmcs_clear() VMCLEARs the dangling shadow VMCS pointer.\nPR:L - Exploitation needs permission to use /dev/kvm and nested VMX (commonly kvm-group or equivalent), not real init-namespace root; KVM create/run ioctls have no CAP_SYS_ADMIN gate on this path.\nUI:N - After the attacker has KVM/nested access, they trigger free_nested and migration themselves; no separate victim action is required.\nS:C - free_nested runs in host KVM while handling L1 nested VMX teardown, and the UAF corrupts host kernel memory, crossing the guest/hypervisor isolation boundary (guest-to-host escape class).\nC:H - The dangling shadow VMCS pointer lets VMCLEAR operate on a freed page that may be reused, yielding a host kernel use-after-free that can be leveraged for arbitrary information disclosure.\nI:H - VMCLEAR writes VMCS state into the freed page; with page reuse this is host heap corruption enabling write primitives and potential host code execution, consistent with UAF guidance.\nA:H - Use-after-free of the shadow VMCS page can oops/panic the host kernel when VMCLEAR or later accessors touch reallocated memory, fully denying host availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64562","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64563","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via local netlink sock_diag dumps (e.g. netlink_diag over NETLINK_SOCK_DIAG) and similar local dump walkers such as TIPC_NL_SOCK_GET; not reachable from remote packet processing.\nAC:L - Attacker controls both sides of the race by running a multi-fragment rhashtable dump while concurrently creating/destroying netlink (or TIPC) sockets to force table resize and free the walked object.\nPR:L - An unprivileged local user can open NETLINK_SOCK_DIAG and dump without CAP_NET_ADMIN; CAP_NET_ADMIN is only required for SOCK_DESTROY, and TIPC_NL_SOCK_GET likewise has no admin permission flag.\nUI:N - Exploitation requires only attacker-issued syscalls (netlink dump plus concurrent socket churn); no victim action is needed.\nS:U - Impact is memory corruption within the host kernel authority (local privilege escalation/crash), not a cross-boundary escape such as guest-to-host or IOMMU bypass.\nC:H - Use-after-free read of a freed hashed object (e.g. netlink_sock) can be reclaimed via heap spray, yielding an arbitrary read primitive through subsequent walk/diag use of the corrupted pointer.\nI:H - UAF on a reclaimable slab object enables heap spraying and fake-object injection into the walk path, which can be leveraged for arbitrary write or control-flow hijacking.\nA:H - The demonstrated KASAN slab-use-after-free in rhashtable_walk_next can oops/panic the kernel, and UAFs remain crashable even when not fully exploited."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64563","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64581","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via setsockopt(IP_XFRM_POLICY/IP_IPSEC_POLICY) on a local socket racing concurrent udp_sendmsg; entry is a local syscall path (do_ip_setsockopt -> xfrm_user_policy), not packet processing.\nAC:L - Attacker controls both sides of the race (one thread setsockopt to clear/apply per-socket xfrm policy, another sendmsg on the same connected UDP socket) and can create the obsolete xfrm_dst precondition in their netns, retrying until the double dst_release wins.\nPR:L - Path requires CAP_NET_ADMIN checked with sockopt_ns_capable(sock_net(sk)->user_ns), which an unprivileged user obtains via user+network namespaces; the fix commit explicitly states this reachability.\nUI:N - Exploitation uses only the attacker's own socket, threads, and setsockopt/sendmsg loops; no victim action or cooperation is required.\nS:U - Double-free/UAF of the socket's dst_entry/xfrm_dst is standard local kernel memory corruption within the host kernel authority, not a VM escape or other cross-boundary impact.\nC:H - Double dst_release frees the xfrm_dst slab object while still referenced, yielding a use-after-free that can be reclaimed/sprayed to disclose kernel memory via corrupted dst contents and ops.\nI:H - The UAF targets a dst_entry with function pointers (ops/input/output) used on transmit, enabling heap reuse for arbitrary write and control-flow hijack consistent with comparable sk_dst_cache races.\nA:H - The KASAN slab-use-after-free in dst_release demonstrates kernel memory corruption that can oops/panic, and the attacker can repeat the race freely."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68121","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in pppoe_sendmsg(), reached only via the local sendmsg() syscall on a PF_PPPOX/PPPoE socket; it is not triggered by remote packet reception or in-kernel PPP transmit paths such as __pppoe_xmit().\nAC:L - Exploitation requires a race between copy_from_user() blocking in sendmsg and changing team header_ops (e.g., adding the first non-Ethernet GRE port), which an attacker can drive with concurrent threads and retries rather than uncontrollable timing.\nPR:L - PPPoE sockets can be created without special privileges, and configuring the team/GRE topology needed to trigger dev_hard_header() head expansion is achievable with CAP_NET_ADMIN inside an unprivileged user/network namespace (unshare -Urn).\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through socket I/O and netlink/rtnl configuration of the team device.\nS:U - Impact is kernel heap corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - Writing PPPoE header fields through a stale pointer after pskb_expand_head() frees the old skb head is a slab use-after-free; freed kmalloc objects can be reclaimed for sensitive data, enabling arbitrary kernel memory disclosure.\nI:H - The post-dev_hard_header() memcpy/ph->length stores up to eight attacker-influenced bytes into freed skb head memory, providing a heap corruption primitive that can be developed into arbitrary kernel writes or code execution.\nA:H - Use-after-free writes into freed slab memory commonly cause kernel oops/panic and can be triggered repeatedly via sendmsg, yielding persistent denial of service even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68121","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68136","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached from the standard NAPI GRO receive path processing remotely originated TCP/IP packets (napi_gro_receive→dev_gro_receive→tcp_gro_receive→skb_gro_receive_list), including tethering/NAT/forwarding scenarios where packets re-enter GRO on a second netdev after driver LRO or prior GRO aggregation.\nAC:L - An attacker can reliably trigger the bug by crafting a TCP stream through a forwarding host with rx-gro-list enabled, without races or victim-specific timing; the commit documents a deterministic tethering/forwarding repro where flush-marked frag_list skbs are re-aggregated and later crash skb_segment.\nPR:N - No local privileges or authentication are required; any remote peer that can send TCP traffic through a vulnerable forwarding/tethering/NAT Linux host can reach the GRO fraglist merge path, which performs no capability or credential checks on the receive path.\nUI:N - Exploitation requires only network-delivered packets and normal kernel forwarding/GRO processing; the victim does not need to open files, mount filesystems, click links, or perform any deliberate action beyond routine network operation.\nS:U - Impact is confined to kernel memory corruption and panic within the same host kernel security domain during packet GRO aggregation and subsequent segmentation on transmit; it does not cross VM, container, or IOMMU boundaries to affect a separate security authority.\nC:H - Double aggregation corrupts the skb frag_list chain (loops, dangling references, NULL/corrupted list_skb pointers), constituting kernel heap memory corruption that can be read during skb_segment processing and is classifiable as a high-impact info-disclosure primitive beyond a simple crash.\nI:H - Re-aggregating flush-marked skbs with existing frag_list corrupts skb linked-list structure and reference relationships in kernel memory, enabling potential control of subsequent skb metadata and write/control-flow primitives during GSO segmentation, not merely integrity-preserving packet drops.\nA:H - Corrupted frag_list state causes skb_segment to dereference a NULL or invalid list_skb via skb_headlen(), producing a kernel panic/oops on the transmit path (sch_direct_xmit/qdisc_run), fully denying availability of the affected system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68136","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68138","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local RTM_NEWTFILTER rtnetlink messages (tc flower filter with police action) through rtnetlink_rcv_msg→tc_new_tfilter→fl_change→tcf_police_init→qdisc_get_rtab/qdisc_put_rtab; no remote packet or network protocol path exists.\nAC:L - cls_flower is TCF_PROTO_OPS_DOIT_UNLOCKED, so concurrent RTM_NEWTFILTER requests run without RTNL; the attacker controls both racing threads/CPUs and can repeatedly install flower filters with identical police rate tables to deterministically hit the global qdisc_rtab_list/refcnt race.\nPR:L - Non-GET rtnetlink handlers require netlink_net_capable(CAP_NET_ADMIN); this is namespace-scoped, so an unprivileged local user obtains CAP_NET_ADMIN via user namespaces (unshare -Urn), sets up clsact/ingress, and installs flower+police rules without init-namespace root.\nUI:N - Exploitation is fully self-contained: the attacker issues the concurrent tc/netlink commands from its own processes and needs no victim to mount filesystems, click links, or perform any other interactive action.\nS:U - Impact is heap corruption and UAF/double-free in kernel kmalloc-2k slabs within the same kernel security authority; although qdisc_rtab_list is global across netns, this is standard kernel memory corruption/privilege escalation, not a VM, IOMMU, or sandbox boundary escape.\nC:H - Concurrent non-atomic refcnt and list updates cause slab use-after-free/double-free of struct qdisc_rate_table (KASAN-confirmed in qdisc_put_rtab); freed 2KB objects are attacker-influenceable via kmalloc timing and are classically weaponizable for arbitrary kernel memory disclosure.\nI:H - The race corrupts a process-global singly linked list and can double-free a kmalloc-2k qdisc_rate_table, yielding classic heap metadata/object corruption primitives that can be developed into arbitrary kernel writes and local privilege escalation/code execution.\nA:H - Demonstrated KASAN slab-use-after-free in qdisc_put_rtab on the error/teardown path, and concurrent double-free of the same rate table can panic the kernel; the trigger is repeatable at will with concurrent netlink requests and causes task death or system-wide instability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68138","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68155","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when libceph decodes CEPH_MSG_MON_MAP from a remote Ceph monitor over the kernel client's established TCP/msgr2 session (mon_dispatch -> ceph_monc_handle_map -> ceph_monmap_decode), which is a network protocol attack surface on CephFS/RBD/cloud nodes.\nAC:L - An attacker who can send monitor protocol messages only needs to set num_mon=0 in the monmap; once accepted, any later session reopen (keepalive timeout, hunt, or connection fault) deterministically hits BUG_ON in pick_new_mon without races or special memory layout.\nPR:N - In the highest-impact scenario a malicious or compromised Ceph monitor (or equivalent authenticated cluster peer) sends the malformed monmap to already-connected kernel clients; the attacker needs no local privileges on the victim host.\nUI:N - After a Ceph client session exists, monmap updates are delivered and processed automatically by the kernel monitor client; no further mount, open, or other victim interaction is required to accept the bad map and later crash on reconnect.\nS:U - Exploitation causes a kernel BUG/panic within the same kernel security domain and does not cross VM, container, IOMMU, or other security boundaries.\nC:N - The failure mode is a BUG_ON assertion in pick_new_mon when num_mon is zero; there is no memory corruption, out-of-bounds access, or other information disclosure primitive on the vulnerable path.\nI:N - Accepting num_mon==0 only stores an empty monmap and later triggers a deliberate kernel BUG; attacker input does not corrupt or modify arbitrary kernel memory or enable code execution.\nA:H - BUG_ON(monc->monmap->num_mon < 1) in pick_new_mon during __open_session causes a kernel oops/panic, fully denying availability of the affected host until reboot."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68155","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68158","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Malformed incremental osdmap data is delivered in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch) to libceph clients (CephFS/RBD), and the overflow is triggered while decoding received network bytes in osdmap_apply_incremental().\nAC:L - A compromised or attacker-controlled monitor/OSD can publish an incremental osdmap with epoch N+1 and a crafted new_state length that wraps the multiply, reliably bypassing bounds checks without races or victim-specific memory layout.\nPR:N - Exploitation requires no privileges on the victim host; a malicious cluster peer or on-path attacker that can deliver forged osdmaps to an already-connected kernel Ceph client needs no local account, capabilities, or user-namespace tricks.\nUI:N - Once a host is a Ceph client, osdmap subscriptions and updates are applied automatically by the kernel; no additional mount, open, or interactive step is needed at exploit time beyond the existing client session.\nS:U - Impact is confined to kernel memory and libceph client state on the Ceph client host (info leak, map corruption, crash, or privilege escalation); it does not cross VM, IOMMU, or sandbox boundaries to another security authority.\nC:H - Integer-overflow bypass lets decode_new_up_state_weight() run bare ceph_decode_32/8 loops past the message end, performing out-of-bounds reads of adjacent kernel heap/slack memory that can disclose pointers and other sensitive data.\nI:H - Misaligned decoding also drives attacker-controlled osd/xorstate/weight values into map->osd_weight[], map->osd_state[], and map->osd_addr[] updates (including memset), corrupting kernel osdmap state in ways usable for further exploitation.\nA:H - Unbounded out-of-bounds reads while parsing osdmaps can fault on unmapped pages and trigger kernel oops/panic; map corruption can also cause persistent client failure, repeatable on each malicious incremental map."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68158","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68159","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Malicious pg_temp/pg_upmap data arrives in CEPH_MSG_OSD_MAP from a Ceph monitor or OSD over TCP, is decoded in libceph, and later triggers stack corruption in ceph_pg_to_up_acting_osds during RBD/CephFS/libceph client I/O.\nAC:L - A compromised or attacker-controlled monitor can publish osdmap entries with length >32 for chosen PGs; once the client subscribes, kernel I/O paths such as RBD mount/probe via calc_target deterministically invoke apply_upmap/get_temp_osds and overflow the stack buffer.\nPR:N - Exploitation requires no privileges on the victim host; any machine acting as a Ceph client that receives a forged osdmap from a cluster peer over the network can be attacked without local user capabilities or namespace tricks.\nUI:N - No victim user action is needed during exploitation beyond the host already being a Ceph client; forged osdmaps are applied automatically and the overflow fires on subsequent kernel client operations without interactive steps.\nS:U - Impact is confined to kernel memory on the Ceph client host (privilege escalation or crash); it does not cross VM, IOMMU, or sandbox boundaries to other security authorities.\nC:H - KASAN-confirmed stack out-of-bounds write in ceph_pg_to_up_acting_osds corrupts adjacent stack memory and can be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Unbounded copy loops in apply_upmap() and get_temp_osds() write attacker-controlled u32 OSD IDs past the fixed osds[CEPH_PG_MAX_SIZE] stack array, enabling control-flow hijack and arbitrary kernel writes.\nA:H - The reported reproducer triggers KASAN stack-out-of-bounds followed by kernel BUG in ceph_pg_to_up_acting_osds, demonstrating a reliable kernel oops or panic from malformed osdmap processing on Ceph clients."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68159","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68160","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - CEPH_MSG_CLIENT_CAPS is received over the kernel Ceph messenger TCP connection from an MDS peer; mds_dispatch() passes it directly to ceph_handle_caps(), so a malicious or compromised MDS (or on-path attacker on an unsigned msgr session) reaches the bug with network data alone.\nAC:L - The attacker fully controls msg->hdr.version and snap_trace_len in the caps header; setting version=1 bypasses all version-gated decoders and snap_trace_len=0xFFFFFFFF yields a fake end pointer that reliably defeats ceph_decode_need(), with no race or memory-layout dependency.\nPR:N - Exploitation requires only the ability to send crafted caps messages as the remote MDS peer on an established session; the attacker needs no account, mount privilege, or other credentials on the victim host beyond the client already being connected to that cluster.\nUI:N - Once CephFS is mounted and the MDS session is open, CEPH_CAP_OP_IMPORT caps messages are delivered and processed automatically during normal cap migration and MDS failover; no additional local user action is needed at exploit time beyond prior cluster connectivity.\nS:U - The out-of-bounds read and resulting snap-realm corruption affect only the kernel CephFS client’s internal state within the same kernel security authority; there is no VM escape, sandbox breakout, or cross-authority boundary crossing.\nC:H - ceph_update_snap_trace() decodes struct ceph_mds_snap_realm and snap arrays using an attacker-supplied fake end pointer, reading sizeof(*ri) and further attacker-influenced extents past the legitimate msg->front buffer into adjacent kernel memory without copying to userspace.\nI:H - Out-of-bounds kernel memory is interpreted as snap-realm metadata and copied via dup_array() into newly allocated kernel heap structures (realm->snaps, realm->prior_parent_snaps), corrupting authoritative snap state and providing a memory-corruption primitive that could be leveraged for further kernel compromise.\nA:H - Out-of-bounds reads can fault on unmapped pages causing a kernel oops; the ceph_update_snap_trace() error path issues WARN(1), fences I/O via CEPH_MOUNT_FENCE_IO, and can close all MDS sessions—effects an attacker can trigger repeatedly at will."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68160","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68202","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through ioctls on the local character device /dev/snd/seq (SNDRV_SEQ_IOCTL_CREATE_QUEUE/DELETE_QUEUE/SET_QUEUE_CLIENT); no network or adjacent-network path exists to the ALSA sequencer.\nAC:L - The attacker controls both sides of the race — one thread deletes the queue while another spins on SET_QUEUE_CLIENT holding a queueptr() reference — and can retry the loop indefinitely on a default kernel with CONFIG_SND_SEQUENCER, so the window is reliably hit.\nPR:L - Only an unprivileged local user able to open /dev/snd/seq is needed; snd_seq_queue_use() performs no owner or access check and no capability is required, as the fix commit states explicitly.\nUI:N - The attacker's own threads create, delete and re-use the queue and the global system timer fires on its own; no victim action is involved.\nS:U - The use-after-free corrupts kernel heap objects within the same kernel security authority, giving at most kernel privilege escalation rather than crossing a VM, IOMMU or sandbox boundary.\nC:H - The stale timer instance dereferences the freed snd_seq_queue and snd_seq_timer, reading tick/time fields and freed prioq pointers that can be reclaimed by attacker-sprayed objects, giving a route to disclose arbitrary kernel memory.\nI:H - snd_seq_timer_interrupt() writes cur_time, tick and last_update into the freed snd_seq_timer slab and snd_seq_check_queue() dispatches events through freed queue pointers, yielding a controllable write primitive on reclaimed heap memory suitable for privilege escalation.\nA:H - Even unexploited, the timer callback derefs freed memory and takes a spinlock in a freed object from interrupt context, causing oops, lock corruption or panic — a repeatable denial of service for any local user."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68202","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68397","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handler is registered via dev_add_pack() for ethertype ETH_P_AF_IUCV (0xFBFB) on every netdevice, so any peer LPAR/guest on the same HiperSockets internal LAN or any host on an attached Ethernet segment can drive afiucv_hs_rcv() with crafted frames; the frames are raw L2 and cannot be routed across an IP hop, so the vector is adjacent rather than network.\nAC:L - The attacker controls the packet side of the race outright (flooding 0xFBFB frames) and can drive the freeing side too, since SYN frames make a listener spawn and enqueue child sockets while FIN/SYN|FIN frames push sockets to IUCV_DISCONN and wake the application into close(), so the read_unlock()-to-handler window can be retried indefinitely until won.\nPR:N - afiucv_hs_rcv() runs from the netif RX softirq and processes any matching frame with no authentication, credential check, or capability test anywhere on the path; the attacker needs no account or privilege on the target s390 system.\nUI:N - No victim action is required: the attacker's own frames both create the AF_IUCV child sockets and trigger the state changes that lead to their teardown, and the packet handler runs unconditionally in softirq context.\nS:U - The freed struct sock and the resulting corruption stay inside the kernel of the affected LPAR or z/VM guest; no hypervisor, IOMMU, or container boundary is crossed.\nC:H - This is a use-after-free on a socket allocated from a generic kmalloc cache (iucv_proto is registered without its own slab), so an attacker who reclaims the object has the kernel read attacker-influenced or stale heap contents through sk fields, sk_filter()'s BPF program pointer, and the iucv backlog queues, yielding kernel memory disclosure.\nI:H - After the free the handlers perform indirect calls through the freed object (sk->sk_data_ready(), sk->sk_state_change(), sk_filter()) and writes into it (sk_state, atomic_sub on iucv->msg_sent, skb_queue_tail() list-pointer updates), giving control-flow hijack and write primitives once the slab object is reclaimed with attacker-controlled data.\nA:H - Dereferencing the freed socket from softirq context reliably produces an oops or \"Fatal exception in interrupt\" panic, and the attacker can repeat the frame flood at will, causing complete loss of availability of the IBM Z LPAR or guest."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68397","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68398","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The free side of the race is a local close() of the pppol2tp socket, which no remote peer can invoke; the full attack (create tunnel/session via AF_PPPOX socket, drive RX with loopback UDP datagrams, close concurrently) is performed entirely through local syscalls.\nAC:L - The attacker controls both sides of the race, feeding the UDP-encap RX softirq from one thread while closing the pppox socket on another, and can retry the loop indefinitely until the window is hit.\nPR:L - No capability check exists on this path: pppox_create()/pppol2tp_connect() and ppp_register_net_channel() need no CAP_NET_ADMIN, and PPPIOCGCHAN is handled by pppox_ioctl() on the socket itself, so /dev/ppp access is not required; the fix commit states the bug is reachable by an unprivileged user.\nUI:N - The attacker performs every step — socket creation, session setup, packet injection and close() — with no action by any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the channel is freed and its slab object reallocated, ppp_input() reads pch->bridge and pch->ppp from attacker-groomed memory and can route received frames to an arbitrary attacker-chosen structure, giving a path to disclosing kernel memory.\nI:H - skb_queue_tail(&pch->file.rq, skb) writes a linked-list insertion into the freed object and wake_up_interruptible(&pch->file.rwait) traverses a freed waitqueue, so heap grooming yields controlled writes and function-pointer traversal usable for privilege escalation.\nA:H - Dereferencing and writing to the kfree()d struct channel from softirq context reliably corrupts the slab and panics or oopses the kernel, and the race can be re-triggered at will."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68398","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68417","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access to the RDMA character devices (/dev/infiniband/uverbsN for create_qp and /dev/infiniband/rdma_cm for the QPN lookup); no network packet reaches the racing code path without a local trigger first.\nAC:L - The attacker controls both sides of the race: one thread issues create_qp while another issues rdma_connect/rdma_accept with an attacker-supplied qp_num, and QPNs from xa_alloc(XA_FLAGS_ALLOC1) are predictable. The post-publish failure can be made deterministic by passing a short udata->outlen, so the window is wide and repeatable at will.\nPR:L - Any unprivileged local user with access to the siw uverbs and rdma_cm character devices can create QPs and issue rdma_connect/rdma_accept with an arbitrary qp_num; no capability check gates siw_create_qp, siw_connect or siw_accept.\nUI:N - The attacker drives both the QP creation and the concurrent QPN lookup from its own threads; no action by any other user or administrator is needed.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU or sandbox boundary.\nC:H - The siw_qp object can be kfree'd by the ib core error path while the CM thread still holds a reference, giving a use-after-free on a slab object the attacker can groom and read back through QP/CM state, enabling disclosure of arbitrary kernel memory.\nI:H - After the free, siw_free_qp() performs list_del(&qp->devq), vfree() of four pointer fields and siw_put_tx_cpu(qp->tx_cpu) using values read from reallocated attacker-controlled memory, yielding arbitrary-pointer free, list-unlink writes and out-of-range per-CPU decrements suitable for control-flow hijacking.\nA:H - Even without exploitation the race reliably causes kernel crashes: NULL sendq/recvq/scq/rcq dereferences, list_del on an uninitialized devq head, waits on an uninitialized qp_free completion, and use-after-free oopses."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68417","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68426","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPsec transmit path (validate_xmit_xfrm) which processes any skb routed into an offloaded SA, including GRO-aggregated traffic forwarded from remote hosts on an IPsec gateway; xfrm_dev_offload_ok() has no socket/local-origin requirement, so a remote peer's packet stream drives the vulnerable GSO segmentation and async-crypto steal directly.\nAC:L - The attacker drives both preconditions with traffic alone: sustained large GSO flows keep the crypto engine backlogged so ->xmit() returns -EINPROGRESS routinely, and packet volume advances xo->seq.low toward the wrap that forces segmentation; each stolen trailing segment reproduces the stale skb->prev, and the subsequent tail->next write is deterministic once it occurs.\nPR:N - On an IPsec gateway the traffic that triggers the path is forwarded from remote, unauthenticated senders — no account, credentials, or capability on the target host is needed, since the SA and offload are pre-existing administrative configuration rather than something the attacker must set up.\nUI:N - No victim action is required; the vulnerable code runs automatically in softirq context on every qualifying transmit, driven purely by the attacker's packet stream.\nS:U - The corruption is of kernel sk_buff list state within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Writing through the stale ->prev is a use-after-free on an skb whose memory the attacker can influence via heap grooming with concurrent traffic; per kernel UAF guidance this yields a high-confidentiality primitive, and the corrupted list can splice engine-owned skbs into the transmit path, exposing freed/reused memory contents on the wire.\nI:H - tail->next = skb is an attacker-influenced pointer write into freed heap memory, and the resulting skb list corruption lets live and engine-owned skbs be chained together; this is classic heap corruption that can be shaped via spraying into an arbitrary write or control-flow hijack.\nA:H - Even without full exploitation the use-after-free write and the double-ownership of a stolen segment cause list corruption, double-free/oops and kernel panic in the softirq transmit path, taking down the gateway."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68426","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72020","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when a host running the IPVS backup sync receiver processes forged UDP sync datagrams (default multicast 224.0.0.81:8848) in ip_vs_process_message(), which is a network packet receive path rather than a local-only ioctl/netlink interface.\nAC:L - Once IPVS backup sync is enabled, an attacker can reliably send IPVS v1 messages that set IP_VS_CONN_F_IN_SEQ/OUT_SEQ while omitting IPVS_OPT_SEQ_DATA; no race, heap grooming, or victim-specific state beyond matching syncid (often 0) is required.\nPR:N - The backup sync socket accepts unauthenticated UDP input with no capability checks; only an optional syncid filter (frequently left at 0) may drop messages, so the attacker needs no Linux privileges to inject the malformed sync records.\nUI:N - No end-user or administrator interaction is required at exploit time; the attacker directly delivers crafted sync messages to the listening backup daemon without victims opening files, clicking links, or changing settings.\nS:U - Exploitation stays within the IPVS load balancer kernel/network authority and affects connections it forwards; it does not constitute a VM escape, sandbox breakout, or cross-security-authority boundary such as guest-to-host.\nC:H - Uninitialized ip_vs_seq init_seq and previous_delta fields retain stale slab data that vs_fix_seq()/vs_fix_ack_seq() apply when rewriting forwarded TCP seq/ack numbers, leaking kernel heap bytes onto the network to clients or backend servers.\nI:H - Those same uninitialized sequence-adjustment fields cause incorrect TCP sequence/ack rewriting in NAT/application-helper paths (ip_vs_app_pkt_in/out), corrupting load-balanced TCP flows and enabling attacker-driven manipulation of forwarded traffic integrity.\nA:H - Corrupted TCP sequence handling breaks or resets connections on the virtual service and can be triggered repeatedly via additional forged sync messages, causing sustained denial of service to load-balanced traffic on the affected backup node."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72020","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72069","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On CONFIG_PREEMPT_RT, every spin_unlock() is substituted by rt_spin_unlock(); network subsystems such as netfilter xt_hashlimit process inbound packets through hashlimit_mt_common(), spin_lock/unlock on RCU-protected dsthash_ent objects concurrently freed via call_rcu by GC—the exact embedded-spinlock UAF pattern from the fix.\nAC:L - The bug is a cross-CPU race where rt_spin_unlock() calls rcu_read_unlock() before releasing the rtmutex, ending the RCU grace period while still dereferencing the lock; syzbot triggered this reliably on PREEMPT_RT via concurrent unlinkat and dentry teardown, and attackers control both sides with parallel syscalls or packet/GC load.\nPR:N - Remote attackers need no account, capability, or authentication to send packets that hit deployed hashlimit rules on internet-facing PREEMPT_RT gateways; the proven syzbot unlinkat path needs only directory write permission (PR:L), but PR:N reflects the highest-severity unauthenticated network packet scenario.\nUI:N - No victim interaction is required; the attacker drives the race through their own concurrent filesystem syscalls (syzbot: unlinkat racing __fput/dentry_kill) or sustained inbound traffic overlapping netfilter GC, without needing another user to open files or mount filesystems.\nS:U - The UAF corrupts kernel slab memory containing embedded spinlock/rtmutex fields and enables privilege escalation within the same kernel security authority; it does not inherently cross VM/guest, container sandbox, or IOMMU hardware isolation boundaries.\nC:H - Syzbot reported KASAN slab-use-after-free Read in rt_mutex_slowunlock during spin_unlock on a freed dentry in shrink_dcache_tree; the systemic UAF lets attackers read freed objects (dentry, dsthash_ent, etc.) after premature RCU grace-period completion, enabling kernel pointer and memory disclosure.\nI:H - UAF on embedded rtmutex fields inside freed slab objects (dentry->d_lock per syzbot) permits heap grooming and reallocation of attacker-controlled data, providing standard kernel heap corruption primitives for arbitrary write and control-flow hijack beyond the immediate crash.\nA:H - Syzbot hit KASAN slab-use-after-free causing kernel fault in shrink_dcache_tree via rt_spin_unlock on PREEMPT_RT; the bug can oops/panic any RT kernel whenever spin_unlock races RCU-deferred free of the containing object, enabling repeatable denial of service via concurrent VFS or netfilter operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72069","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72072","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is reached by racing MACSEC_CMD_DEL_RXSC/ADD_RXSC netlink configuration (GENL_ADMIN_PERM) against mlx5e MACsec RX processing; the privileged genlink/rtnl control path is required to trigger the bug, not remote packets alone.\nAC:L - An attacker with CAP_NET_ADMIN can drive both sides by looping RX SC add/delete while flooding MACsec-offloaded RX traffic on the mlx5e netdev, reliably winning the RCU race between xa_load/dst_hold and metadata_dst_free.\nPR:L - MACsec offload mutations require GENL_ADMIN_PERM (CAP_NET_ADMIN); on Mellanox ConnectX/BlueField systems this is reachable by cloud tenants with SR-IOV VFs, containers, or user/network namespaces without init-namespace root.\nUI:N - No victim user action is needed; automated concurrent netlink MACsec operations and incoming MACsec-offloaded frames on an active mlx5e interface suffice once MACsec offload is configured.\nS:U - Impact is kernel heap use-after-free and memory corruption within the host kernel on the mlx5 NIC; it enables local privilege escalation but does not by itself cross VM, IOMMU, or hypervisor security boundaries.\nC:H - The race calls dst_hold() and skb_dst_set() on a freed metadata_dst, a classic slab UAF that can disclose kernel memory through subsequent dst_entry and MACsec skb metadata handling.\nI:H - Freed metadata_dst objects can be reallocated via heap spraying while the RX datapath still references them, enabling refcount corruption and arbitrary kernel memory writes or control-flow hijack beyond a mere crash.\nA:H - Concurrent use of freed md_dst during mlx5e MACsec RX processing can cause immediate kernel oops, BUG, or panic on datacenter/cloud hosts using mlx5 hardware MACsec offload, fully denying system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72072","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72083","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On LIO/iSCSI storage servers and appliances, a remote initiator sends PERSISTENT_RESERVE_OUT with REGISTER AND MOVE over TCP (port 3260); iscsit_process_scsi_cmd()→target_execute_cmd()→target_scsi3_emulate_pr_out()→core_scsi3_emulate_pro_register_and_move() with no local access required.\nAC:L - The attacker fully controls the PR-OUT parameter list length (>4096 to force vmap/vunmap), iSCSI TransportID format 01b with ISID, and can establish prerequisite PR registration and reservation via prior SCSI commands on the same session; no uncontrollable race or layout dependency exists.\nPR:N - Exploitation requires only the ability to act as a network SCSI/iSCSI client with LUN access to an exported target; no Linux UID, capability, or init-namespace root on the storage server is needed—only standard iSCSI initiator connectivity (CHAP/ACL when configured).\nUI:N - Triggering is fully automated once an iSCSI session exists: the attacker issues scripted REGISTER, RESERVE, then REGISTER AND MOVE commands with a crafted >4 KiB parameter list; no victim mount, click, or other interactive action is required.\nS:U - The UAF corrupts kernel heap state inside the target-core PR handler on the storage host; impact stays within that kernel security domain and does not inherently cross VM, container, or IOMMU boundaries (standard host compromise, not escape).\nC:H - After vunmap(), iport_ptr aliases freed kernel virtual address space and is dereferenced in strcmp(), __core_scsi3_locate_pr_reg(), and snprintf() into pr_reg_isid; per kernel CVSS guidance, UAF reads enable arbitrary kernel memory disclosure when uncertain.\nI:H - UAF reads of attacker-influenced unmapped PR-OUT data drive strcmp-based registration matching and snprintf copies into persistent kernel pr_reg structures; memory corruption/UAF is scored High for integrity because it can be leveraged for control-flow or state manipulation.\nA:H - Dereferencing iport_ptr after transport_kunmap_data_sg() vunmap() on multi-page buffers causes immediate invalid kernel virtual address accesses (oops/panic) on every qualifying REGISTER AND MOVE; UAF availability impact is High per kernel guidance even before full exploit development."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72083","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72084","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered by a PERSISTENT RESERVE OUT SCSI command delivered over the LIO iSCSI target fabric (TCP/3260); remote initiators reach `iscsi_parse_pr_out_transport_id()` after login and normal SCSI command processing, and the fix commit notes the same path via vhost-scsi-backed exports.\nAC:L - An attacker fully controls the PR-OUT parameter list and can reliably supply a FORMAT CODE 01b iSCSI TransportID without a \",i,0x\" separator or NUL terminator and size it past one page so `strstr()` over-reads into the vmalloc guard page; no races or victim-specific memory layout are required.\nPR:N - Exploitation requires only completing iSCSI login to an exported LUN as any initiator client, not host administrator privileges; LIO demo mode auto-provisions initiator ACLs and many storage appliances expose iSCSI targets to the network without mapping this to elevated OS credentials.\nUI:N - No end-user or administrator action beyond normal automated iSCSI target operation is needed; a remote initiator can send the malicious PR OUT command directly once a session to the LUN exists.\nS:U - The flaw corrupts or reads kernel memory and crashes the target host kernel within the same kernel security boundary; it does not by itself cross a VM, container, or IOMMU isolation boundary to another authority.\nC:H - Unbounded `strstr()` and an unbounded `%s` on the error path perform out-of-bounds reads past the received PR-OUT buffer, potentially disclosing adjacent kernel memory before the fault, matching CVSS guidance for out-of-bounds reads beyond a few bytes.\nI:H - A malformed TransportID can leave the ISID pointer one byte past the descriptor so subsequent registration code dereferences out of bounds, and the ISID normalization loop can write with `tolower()` beyond the buffer, giving a memory-corruption primitive in kernel context.\nA:H - The over-read into a multi-page vmalloc mapping hits the guard page and triggers a KASAN vmalloc-out-of-bounds fault and kernel oops, remotely denying service to the host and all consumers of the iSCSI target."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72123","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local BCM socket syscalls (sendmsg with RX_SETUP/SETTIMER/ival2 throttling and RX_DELETE); CAN frames can be injected locally via loopback without physical bus access.\nAC:L - The attacker controls both sides of the race by concurrently issuing RX_DELETE teardown and delivering matching CAN frames (e.g., via threads or paired BCM/RAW sockets), making the thrtimer re-arm UAF reliably triggerable.\nPR:L - No kernel capability check gates AF_CAN/CAN_BCM socket creation or bcm_sendmsg opcodes; any unprivileged local user with socket access (including via user namespaces with vcan) can reach the vulnerable path.\nUI:N - No victim interaction is required; the attacker self-triggers the race through their own BCM socket operations and locally injected CAN traffic.\nS:U - Impact is confined to kernel memory corruption and local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM or IOMMU bypass.\nC:H - The thrtimer UAF dereferences freed bcm_op fields (locks, frame buffers, op->sk) in bcm_rx_thr_handler/bcm_send_to_user, enabling attacker-controlled heap reuse and arbitrary kernel memory disclosure.\nI:H - UAF on the bcm_op slab object allows heap spraying to corrupt function pointers, timers, and sock structures, providing a standard path to arbitrary kernel writes and local privilege escalation.\nA:H - The freed-op dereference in the hrtimer softirq path causes kernel oops/panic under normal exploitation attempts, and successful memory corruption can crash or hang the system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72123","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72135","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local pread()/write() syscalls on /dev/tpm0 or /dev/tpmrm0 character devices; there is no network, Bluetooth, or physical-bus code path to the vulnerable tpm_common_read() handler.\nAC:L - An attacker who can open the device reliably triggers the bug by writing any TPM command to create a pending response, then calling pread() with a large offset; no races or special memory layout are required.\nPR:L - Upstream tpm2-tss udev rules grant non-root users in the tss group read/write access to /dev/tpmrm0 (mode 0660), which is the standard TPM2 user-space interface on laptops and servers with TPM hardware.\nUI:N - No victim interaction is required; the attacker opens the TPM device, submits a command, and issues the malicious pread() themselves without relying on another user to mount, click, or configure anything.\nS:U - The vulnerability corrupts kernel heap memory in the TPM driver on the same host; it does not by itself cross a VM, container, or IOMMU security boundary to affect a different trust domain.\nC:H - Unchecked pread offsets cause copy_to_user() to read beyond the 4096-byte data_buffer into adjacent kmalloc slab memory (including tpm_space pointers), leaking kernel heap contents to userspace.\nI:H - A successful out-of-bounds pread also executes memset() past data_buffer, zeroing adjacent heap objects such as tpm_space session/context pointers and enabling further memory corruption or control-flow manipulation.\nA:H - KASAN reports slab-out-of-bounds faults on both the copy_to_user read and memset write; corrupting adjacent heap structures can oops or panic the kernel during subsequent TPM operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72135","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72221","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Reachable over TCP by any remote peer of an in-kernel NFS/RPC server (nfsd) via the pre-auth RPC_AUTH_TLS NULL-procedure STARTTLS path that invokes svc_tcp_handshake() on the accepted SUNRPC transport.\nAC:L - The attacker controls both sides of the race by timing TLS client handshake messages against the fixed 5-second SVC_HANDSHAKE_TO and opening many parallel connections to reliably hit the cancel-lost window.\nPR:N - No credentials or export authorization are required; svcauth_tls_accept() accepts empty AUTH_TLS on RPC NULL from any TCP client, and svcauth_unix_set_client() skips IP export checks when rq_proc==0.\nUI:N - Exploitation requires only scripted network connections and TLS client traffic to nfsd; no victim user interaction such as mounting a filesystem or opening a file is needed.\nS:U - Memory corruption occurs in nfsd kernel worker context on the same host; impact is kernel privilege compromise within the server security authority, not a VM escape or IOMMU boundary bypass.\nC:H - A second svc_tcp_handshake() can call init_completion() while svc_tcp_handshake_done() concurrently calls complete_all(), corrupting the embedded swait_queue in heap-allocated svc_sock and enabling arbitrary kernel memory disclosure.\nI:H - Corrupting completion wait-queue metadata in the svc_sock heap object can be leveraged for arbitrary kernel writes and control-flow hijacking to achieve local privilege escalation on the NFS server.\nA:H - The swait_queue corruption can trigger kernel oops/panic, and the alternate race path tears down connections whose TLS handshake is about to succeed, enabling repeatable remote denial-of-service against nfsd."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72221","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72222","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in nfsd's server-side SUNRPC/TCP TLS handshake (net/sunrpc/svcsock.c), reached when a remote peer connects to port 2049 and sends a pre-authentication AUTH_TLS NULL STARTTLS probe that triggers svc_tcp_handshake() via svcauth_tls_accept().\nAC:L - The attacker controls both sides of the race by initiating AUTH_TLS handshakes and concurrently resetting/closing TCP or waiting for SVC_HANDSHAKE_TO while tlshd delivers completion; repeated parallel connections make the overlap window reliably reachable.\nPR:N - AUTH_TLS is processed on RPC procedure 0 before credentials are verified, so an unauthenticated remote client can reach svc_tcp_handshake() and the asynchronous callback without any account, export access, or kernel capability.\nUI:N - nfsd worker threads automatically accept the TCP connection, process the STARTTLS probe, run the TLS handshake, and handle teardown/completion callbacks without any local user or administrator action.\nS:U - Exploitation corrupts kernel memory on the NFS server host itself and does not cross a VM-guest/host, sandbox, or IOMMU security boundary; impact stays within the kernel's security authority.\nC:H - svc_tcp_handshake_done() use-after-frees svc_sock and performs set_bit/clear_bit RMW on freed xpt_flags plus complete_all() on freed sk_handshake_done, a slab-corruption UAF that can disclose arbitrary kernel memory.\nI:H - The same UAF delivers attacker-timed writes into reclaimed slab slots through atomic bit operations and wait-queue list updates, enabling heap grooming and further kernel memory corruption for arbitrary modification or code execution.\nA:H - Slab corruption and UAF during handshake completion can cause kernel oops/panic, and unauthenticated remote peers can trigger the fault repeatedly by overlapping TLS handshake completion with connection close."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72222","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72251","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit in nf_nat_sip() from sip_help_udp/tcp() during nf_confirm() on POST_ROUTING/LOCAL_IN while processing attacker-supplied SIP/UDP or SIP/TCP packets traversing a netfilter NAT gateway, so exploitation is via remote network traffic rather than local syscalls or physical access.\nAC:L - Once nf_conntrack_sip and nf_nat_sip are active on a NATed SIP flow, a remote peer can set forced_dport with a crafted Via header and drive the reply-path skb_ensure_writable() reallocation on cloned skbs without races or rare layout luck.\nPR:N - Exploitation needs no privileges on the victim kernel; a remote SIP endpoint only has to send malicious SIP through an already-configured SIP conntrack/NAT helper, with no authentication or local access to the firewall or router.\nUI:N - No victim user action is required beyond normal automated packet forwarding; the SIP helper parses and NAT-rewrites attacker-supplied SIP data in softirq during connection-tracking confirmation without opening files, clicking links, or mounting filesystems.\nS:U - Impact stays within kernel netfilter/conntrack memory on the same security authority (for example a NAT firewall, SBC, or VoIP gateway). This is standard kernel memory corruption, not a VM escape, sandbox breakout, or cross-tenant boundary violation.\nC:H - skb_ensure_writable() can free the old linear buffer while *dptr still points into it; sip_help_tcp() then continues parsing with that stale pointer, giving a use-after-free read of freed skb data and enabling disclosure of adjacent kernel heap contents.\nI:H - The stale dptr UAF and, on TCP flows, mistaken nf_nat_mangle_udp_packet() header rewriting corrupt kernel packet-buffer memory; such heap corruption is exploitable with grooming for arbitrary writes, control-flow hijacking, and kernel code execution.\nA:H - Use-after-free and mis-mangled L4 headers during softirq SIP NAT processing can trigger kernel oops/panic or reliably drop or corrupt in-flight VoIP signaling, causing high availability impact on internet-facing NAT/SBC systems handling SIP."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72251","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72262","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl on /dev/snd/controlC* (SNDRV_CTL_IOCTL_TLV_WRITE/READ) through the ALSA control device; there is no network, adjacent-radio, or physical-bus attack surface for this SOF IPC3 kcontrol path.\nAC:L - On affected SOF IPC3 systems with topology bytes_ext controls, an attacker can deterministically trigger the bug by issuing TLV writes with header.length equal to max_size, causing copy_from_user/memcpy to overrun the kzalloc(max_size) buffer by sizeof(struct sof_ipc_ctrl_data).\nPR:L - The fix commit states the overflow is reachable from unprivileged userspace via ALSA TLV kcontrols; any local user who can open the sound control device (typically membership in the audio group on Linux, or an app with audio access on Android/ChromeOS) can reach the vulnerable code without real root.\nUI:N - Exploitation is performed entirely by the attacker issuing ALSA TLV ioctls against an existing bytes_ext kcontrol; no victim click, mount, or other interactive action beyond the attacker's own access to the sound control interface is required.\nS:U - The vulnerability corrupts kernel heap memory from a local userspace context and enables standard kernel privilege escalation or denial of service; it does not cross a VM, container, or IOMMU security boundary into a separate authority.\nC:H - The get path can copy_to_user up to sizeof(struct sof_ipc_ctrl_data) bytes beyond the allocated ipc_control_data buffer, leaking adjacent kernel heap contents; combined with the controllable overflow, this is an out-of-bounds read/memory corruption primitive consistent with arbitrary disclosure potential.\nI:H - The put path performs an out-of-bounds heap write of up to sizeof(struct sof_ipc_ctrl_data) bytes past the kzalloc(max_size) allocation (including via the err_restore memcpy), enabling heap metadata/object corruption that can be developed into arbitrary kernel write or code execution.\nA:H - Heap out-of-bounds writes of roughly 96 bytes into adjacent slab objects can corrupt kernel structures and trigger oops/panic or wedged audio/subsystem state; repeated TLV operations make denial of service reliably achievable even without full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72262","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72288","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached only from KVM guest MMIO traps on GICv3 redistributor GICR_CTLR LPI-disable writes, ITS MOVI affinity changes, and vCPU-exit paths into vgic_prune_ap_list(); no network-facing host protocol is involved.\nAC:L - A guest controls all three racing vCPUs by pinning threads to concurrently issue ITS MOVI, cross-vCPU GICR_CTLR LPI-disable writes, and vCPU exits that invoke vgic_prune_ap_list(); the attacker creates and wins the race rather than depending on uncontrollable host timing.\nPR:N - No host privileges are required beyond running code in an assigned KVM guest (e.g. a cloud VM tenant on arm64); exploitation needs guest-kernel access to GIC/ITS MMIO, not host root or capabilities in the init namespace.\nUI:N - Exploitation is fully attacker-driven from within a multi-vCPU guest VM and does not require any victim user or administrator action on the host.\nS:C - The use-after-free corrupts host-kernel heap memory (struct vgic_irq) from guest-controlled VGIC operations, crossing the guest-to-host virtualization security boundary with VM-escape impact.\nC:H - vgic_flush_pending_lpis() can free the LPI vgic_irq while vgic_prune_ap_list() still dereferences it after reacquiring dropped locks, yielding a kernel heap use-after-free exploitable for arbitrary host memory disclosure via heap grooming.\nI:H - The dangling vgic_irq pointer permits attacker-influenced writes through irq_lock, list_head, vcpu, and target_vcpu fields during ap_list migration, enabling host control-flow or data corruption primitives.\nA:H - The race frees live kernel objects still referenced by the ap_list migration path, causing host kernel oops, panic, or hang during list_del, lock operations, or subsequent LPI delivery on arm64 KVM hosts."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72288","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72289","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only from KVM guest execution paths—GICv3 redistributor GICR_CTLR LPI-disable MMIO traps into vgic_flush_pending_lpis() and vCPU exit/sync paths into vgic_prune_ap_list()—not from any remote network, adjacent-radio, or physical-device interface on the host.\nAC:L - A malicious multi-vCPU guest controls both racing sides by pinning threads, changing LPI affinity via ITS so an interrupt must migrate off one vCPU's ap_list, and concurrently disabling LPIS on that redistributor; the attacker creates the window rather than depending on uncontrollable host timing or memory layout.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant on arm64 KVM who needs no host privileges beyond code already running inside the assigned guest; exploitation uses guest-kernel GIC MMIO/ITS operations, not host root, CAP_SYS_ADMIN in the init namespace, or additional /dev/kvm access beyond having a VM.\nUI:N - Exploitation is fully attacker-driven from within the guest VM through deliberate LPI setup, affinity changes, and timed GICR_CTLR writes; no victim user or administrator action on the host is required beyond normal VM operation.\nS:C - Double list_del()/list_add_tail() on host-kernel ap_list linkages corrupts KVM VGIC state from guest-controlled interrupt operations, crossing the guest-to-host virtualization security boundary with VM-escape-class impact rather than confining damage to the attacker's VM.\nC:H - Corrupting detached ap_list pointers and inserting them into another vCPU's ap_list_head enables out-of-bounds kernel linked-list traversal and disclosure of adjacent kmalloc slab memory (struct vgic_irq and neighboring objects); per kernel guidance, this list corruption is leverageable for arbitrary host memory read primitives.\nI:H - The vulnerable path performs list_del() on an already removed entry and may follow with list_add_tail() onto another vCPU's ap_list, letting a guest steer kernel list pointers and overwrite adjacent vgic_irq/host heap metadata for control-flow or data corruption on the hypervisor.\nA:H - Re-running list_del() on an entry already removed by vgic_flush_pending_lpis() dereferences poisoned list pointers and corrupts live ap_list_heads, causing immediate host kernel BUG/oops/panic or persistent interrupt-delivery failure during subsequent VGIC processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72289","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72317","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in the SUNRPC TCP-with-TLS client connect_worker processing a remote NFS server's TLS handshake; a malicious or misconfigured server can induce fatal handshake failure over the network before the delayed worker runs, matching network-reachable kTLS/RPC-with-TLS client paths.\nAC:L - An attacker operating a reachable NFS endpoint can reliably cause fatal TLS handshake failure (e.g., reject mTLS client certificates or send TLS alerts) and influence reconnect timing/backoff so client teardown frees rpc_clnt before the queued connect_worker executes.\nPR:N - Exploitation requires no privileges on the victim host; a remote peer only needs the client kernel to initiate or re-establish an NFS RPC-with-TLS connection, and TLS handshake processing occurs before NFS authentication completes.\nUI:N - No further victim action is needed once an NFS xprtsec=tls/mtls mount exists because automatic reconnect after server-induced disconnect or handshake failure can trigger the race without additional user interaction.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is standard local kernel compromise rather than crossing VM, container, or IOMMU security scopes.\nC:H - This is a kernel heap use-after-free where xs_tcp_tls_setup_socket reads multiple fields from a freed rpc_clnt (including cl_cred and cl_program), enabling information disclosure and further exploitation beyond a simple crash.\nI:H - Use-after-free of rpc_clnt permits corrupting allocator metadata and adjacent kernel objects; freed-object reuse can yield arbitrary write or control-flow hijack primitives, not merely authenticated data alteration.\nA:H - Accessing the freed rpc_clnt produces a refcount_t underflow and kernel oops/panic; even unsuccessful exploitation typically crashes or hangs the system, and repeated reconnect attempts can deny availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72317","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72339","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the qede NIC RX fastpath reached when remote Ethernet frames are received, hardware posts completion queue entries, and NAPI runs qede_poll() -> qede_rx_int() -> qede_rx_process_cqe()/qede_tpa_start() into qede_rx_build_skb() or qede_tpa_rx_build_skb().\nAC:L - An attacker can reliably trigger build_skb() NULL returns by flooding the interface with frames larger than rx_copybreak (256 bytes) to exhaust GFP_ATOMIC skb slab allocations, then the off-by-one BD consumption desynchronizes the ring without races or victim-specific state.\nPR:N - No local account, capability, or authentication is required; any unauthenticated remote host that can send IP/Ethernet traffic to a server using a Marvell/QLogic FastLinQ qede NIC can hit the vulnerable RX/TPA handlers.\nUI:N - Exploitation requires no victim interaction beyond normal network operation; packet reception, MSI-X interrupt handling, and NAPI polling process attacker-supplied frames automatically in kernel context.\nS:U - The flaw corrupts kernel heap metadata (DMA page refcounts and SLUB freelists) within the host kernel security boundary; it does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - BD ring desynchronization corrupts DMA page reference counts and can corrupt SLUB freelists; this class of kernel heap corruption is exploitable for arbitrary kernel memory reads and information disclosure beyond a simple crash.\nI:H - SLUB freelist corruption from mismatched BD ring consumption enables arbitrary kernel memory writes and control-flow hijacking primitives, supporting local privilege escalation or arbitrary code execution in kernel context.\nA:H - Reference-count and SLUB corruption from the desynchronized BD ring can cause kernel BUG/oops/panic or a wedged RX datapath, resulting in complete loss of host availability on affected systems."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72339","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72389","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation is via local RTNETLINK/ioctl to create a down bridge, enable kernel STP, enslave ports, and delete the bridge; remote STP BPDU handling is blocked when IFF_UP is clear, so the arming path that leaves timers active on a down bridge is local.\nAC:L - The public PoC uses a reliable, attacker-controlled netlink sequence (down bridge + kernel STP + port state progression + dellink) without winning races; per-port forward-delay timers deterministically reach br_topology_change_detection and arm topology_change_timer before deletion.\nPR:L - All reachable paths (RTM_NEWLINK/DELLINK, IFLA_BR_STP_STATE, enslaving ports) require CAP_NET_ADMIN, which unprivileged users can obtain in user/network namespaces (unshare -Urn, Kubernetes NET_ADMIN, LXC/libvirt network namespaces).\nUI:N - Triggering requires only programmatic bridge configuration by the attacker; no victim must click, mount, or open anything beyond the attacker's own netlink operations.\nS:U - Impact is kernel memory corruption and privilege escalation within the same kernel/host security domain; it does not cross a VM, container-to-host, or IOMMU boundary by itself.\nC:H - Use-after-free of the net_device/net_bridge kmalloc object lets an attacker reclaim freed slab memory and obtain arbitrary kernel read/disclosure primitives from corrupted timer and bridge structures.\nI:H - Disclosed analysis and PoC show the dangling timer callback can hijack control flow by reclaiming the freed object with attacker-controlled data, replacing the timer function pointer for arbitrary kernel code execution.\nA:H - Deleting the bridge with active STP timers queued causes the per-CPU timer wheel to invoke callbacks on freed memory, producing kernel BUG/oops/panics and denial of service even if full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72389","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74345","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit while processing attacker-supplied MPA/TCP data on an inbound SIW listener socket during connection establishment, which is a standard network protocol path analogous to other in-kernel TCP service handlers.\nAC:L - An attacker fully controls the TCP connection and malformed MPA request bytes that deterministically fail parsing and drive the endpoint teardown path where the refcount bug frees the cep before it is accessed again.\nPR:N - Exploitation requires only the ability to open a TCP connection to a host running an SIW RDMA listener; the MPA handshake is unauthenticated and occurs before any RDMA credentials or local privileges are established.\nUI:N - No end-user action is required at exploit time; the kernel processes the malicious inbound connection automatically once an administrator has started an RDMA listener service.\nS:U - Impact is confined to kernel memory corruption and potential host privilege escalation within the same kernel security authority, not a VM escape or cross-authority boundary such as guest-to-hypervisor.\nC:H - The vulnerability is a slab use-after-free on a freed siw_cep object; UAF on attacker-influenced connection teardown enables heap grooming and arbitrary kernel memory read primitives beyond a simple crash.\nI:H - Use-after-free of the connection endpoint structure in kernel heap can be leveraged for controlled writes and code execution via object reuse and function pointer/callback corruption, not merely data integrity of a single field.\nA:H - The bug was reproduced as a KASAN slab-use-after-free in siw_cm_work_handler during malformed MPA processing, which can cause kernel oops/panic and denial of service on the target host."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74345","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74377","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires mutating mmap'd receive WQEs through /dev/infiniband/uverbs; inbound RoCE packets (rxe_udp_encap_recv→rxe_rcv→rxe_receiver) only trigger processing and cannot alter WQE fields without local control of the userspace-mapped receive queue.\nAC:L - The attacker controls both sides of the TOCTOU—userspace threads racing num_sge/sge edits while posting recv WRs and driving inbound RoCE SEND/WRITE traffic—so out-of-bounds reads in rxe_resp_check_length() and copy_data() are reliably triggerable with retries.\nPR:L - uverbs_devnode() publishes /dev/infiniband/uverbsN as mode 0666, letting any local account create userspace QPs and mmap receive queues; rxe link setup needs CAP_NET_ADMIN obtainable in a user+network namespace via unshare -Urn, matching PR:L kernel guidance.\nUI:N - Exploitation is entirely self-driven from the attacker's own RDMA verbs client and concurrent userspace threads; no victim user action, mount, or file open is required.\nS:U - Impact is kernel memory corruption and local privilege escalation within the host kernel security authority, not a VM guest-to-host escape, IOMMU/DMA boundary bypass, or other cross-scope compromise.\nC:H - Inflating num_sge or rewriting sge entries during processing causes out-of-bounds reads in rxe_resp_check_length() and copy_data() beyond the allocated WQE slot, potentially into adjacent vmalloc/kernel memory, enabling arbitrary kernel information disclosure.\nI:H - copy_data() walks attacker-forged out-of-bounds sge entries and performs rxe_mr_copy writes of incoming RDMA payload into MR-backed memory; combined with queue overruns this yields controlled memory corruption exploitable for arbitrary write and code execution.\nA:H - Processing a WQE with an attacker-inflated num_sge causes the kernel to walk far past valid sge slots, dereferencing invalid pointers and corrupting memory, reliably producing kernel oops/panic and total loss of availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74377","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74378","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local process with mmap write access to the SRQ receive queue shared with the kernel; although incoming RoCE/UDP packets trigger get_srq_wqe(), a remote peer cannot modify num_sge in the victim's userspace-mapped WQE buffer, so the TOCTOU overflow cannot be achieved from the network alone.\nAC:L - The attacker controls both sides of the race: a userspace thread that repeatedly rewrites num_sge in the mmap'd SRQ entry and the thread/process that posts recv WQEs and receives the triggering RoCE Send/Write packet, making the TOCTOU window reliably winnable without external timing luck.\nPR:L - An unprivileged local user with access to /dev/infiniband/uverbs can create an SRQ (mmap'd queue), associate a QP, and post recv buffers via ibverbs; rxe device setup via \"rdma link add type rxe\" is reachable with CAP_NET_ADMIN inside a user namespace (unshare -Urn).\nUI:N - No victim user interaction is required; the attacker operates their own malicious RDMA userspace process and can self-trigger the vulnerable responder path with RoCE request packets once SRQ/QP resources are configured.\nS:U - The heap overflow corrupts kernel memory within the rxe_qp responder context on the same host kernel, enabling local privilege escalation rather than crossing a VM, container, or IOMMU security boundary to impact a different authority.\nC:H - The attacker-controlled memcpy size causes an out-of-bounds copy from the mmap'd SRQ ring buffer and overflows the fixed qp->resp.srq_wqe kernel buffer, enabling adjacent kernel heap data disclosure and providing primitives that can be developed into arbitrary kernel memory reads.\nI:H - Overflowing qp->resp.srq_wqe corrupts subsequent fields in rxe_resp_info/rxe_qp (e.g., responder resource pointers and state), giving a kernel heap buffer overflow that can be leveraged for arbitrary kernel memory writes and local privilege escalation.\nA:H - Corrupting responder state inside rxe_qp can cause kernel oops/panic or wedged RDMA processing during packet handling; even failed exploitation attempts can crash the kernel through use of corrupted function pointers and queue state."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74378","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74390","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl on /dev/infiniband/uverbs to register CQ/QP/SRQ memory via irdma_reg_user_mr; the bug is not reachable from remote iWARP/RoCE packet handling.\nAC:L - An attacker fully controls reg_type, cq_pages/sq_pages/rq_pages, and umem size; triggering lvl==0 with many DMA blocks is deterministic and needs no races or special memory layout.\nPR:L - Any unprivileged local user who can open the uverbs device (mode 0666) and use the RDMA NIC—typical on cloud/HPC RDMA nodes—can invoke the vulnerable MR registration path without real root.\nUI:N - No victim interaction is required; the attacker triggers the overflow directly through their own RDMA verbs memory registration calls.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel security boundary, not a cross-VM or cross-IOMMU sandbox escape.\nC:H - The out-of-bounds write of attacker-influenced DMA addresses into adjacent irdma_mr/iwpbl heap metadata can be leveraged for arbitrary kernel memory read primitives, not merely a bounded leak.\nI:H - Controlled out-of-bounds u64 writes past pgaddrmem[4] corrupt adjacent kernel heap structures and are suitable for control-flow or arbitrary kernel write exploitation.\nA:H - Heap corruption in a kzalloc'd irdma_mr can cause immediate kernel oops/panic during registration or on subsequent use of corrupted queue memory metadata."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74390","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74394","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - SRPT is an in-kernel SCSI RDMA target reached by remote initiators over InfiniBand/RoCE via RDMA/IB CM; malicious SRP_CMD IUs are delivered through `srpt_recv_done()` without any local syscall or physical access.\nAC:L - Once connected on an immediate-data SRPT target (use_srq=0), a malicious initiator deterministically sets `imm_buf->len=0xFFFFFFFF` to wrap `req_size` and bypass checks; no race or attacker-uncontrollable condition is required.\nPR:N - SRPT enables LIO demo mode (`srpt_check_true`), so any remote initiator that completes SRP login on an enabled target gets a dynamic ACL without target-local credentials, root, or CAP_NET_ADMIN on the victim host.\nUI:N - Exploitation requires only attacker-initiated RDMA connection, SRP login, and crafted SRP_CMD traffic; no administrator or other user must mount storage or perform any action on the target.\nS:U - The integer overflow corrupts kernel heap memory and SCSI-target processing within the host kernel's own security authority; it does not cross VM, IOMMU, or container sandbox boundaries.\nC:H - Passing a ~4GB length to `sg_init_one()` on a small receive buffer creates a massive out-of-bounds scatterlist; subsequent target-core DMA/map operations can read far beyond the buffer, enabling arbitrary kernel memory disclosure.\nI:H - The bogus scatterlist gives the block/SCSI target path an attacker-controlled ~4GB kernel memory write/read primitive over adjacent heap objects, exploitable for control-flow hijacking and privilege escalation.\nA:H - Out-of-bounds access from a ~4GB scatterlist on a kilobyte-scale receive buffer readily triggers kernel oops, KASAN faults, or panic, denying availability even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74394","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74488","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when the mwifiex driver processes attacker-supplied A-MSDU TDLS frames received over WiFi from a nearby peer, AP, or injector on the same wireless segment, which is an adjacent RF attack vector rather than remote Internet or local syscall access.\nAC:L - Once TDLS-capable mwifiex firmware receives an A-MSDU, the attacker fully controls subframe sizes and TDLS content to trigger either the skb use-after-free or the overstated-length out-of-bounds parse reliably without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation requires only the ability to deliver crafted 802.11 data frames to the victim radio; it does not require any local account, capability, or root access on the Linux host and is not gated by user-namespace privilege boundaries.\nUI:N - No victim user action beyond normal wireless operation is required; the driver parses malicious TDLS subframes automatically during receive and A-MSDU decomposition before forwarding traffic to the network stack.\nS:U - Impact is confined to kernel memory corruption and driver state within the host kernel security authority; it does not by itself cross a VM, container, or IOMMU boundary to affect a separate security domain.\nC:H - The skb use-after-free reads freed sk_buff metadata and the inflated length drives an out-of-bounds IE walk that reads kernel memory beyond the subframe, including attacker-positioned bytes from subsequent A-MSDU subframes, enabling substantial information disclosure.\nI:H - The same out-of-bounds parse copies attacker-controlled IE data from beyond the subframe into heap-allocated sta_node/tdls_cap structures via memcpy, providing a memory-corruption primitive that can be developed into arbitrary kernel write or code execution.\nA:H - Reading skb->len after the parent A-MSDU skb may already be freed can immediately fault or corrupt memory, and the out-of-bounds TDLS element parsing can provoke kernel oopses or panics even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74488","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74496","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is opened only via local FOU_CMD_ADD genetlink into fou_create(); remote UDP can race the dangling sk_user_data read in fou_udp_recv/gue_udp_recv but cannot alone reach the erroneous teardown path.\nAC:L - An attacker with CAP_NET_ADMIN controls both sides: issue a second FOU_CMD_ADD with port 0 to force -EALREADY on fou_add_to_port_list while concurrently sending UDP/GRO traffic to the just-bound ephemeral socket during the kfree window.\nPR:L - FOU_CMD_ADD is gated by GENL_ADMIN_PERM (CAP_NET_ADMIN); the fou genl family is netnsok, so a user with CAP_NET_ADMIN inside unshare -Urn can configure FOU and trigger the failing add path without init-namespace root.\nUI:N - Exploitation is fully programmatic via concurrent netlink FOU_CMD_ADD requests and attacker-controlled UDP packets; no victim mount, file open, or other interactive action is required.\nS:U - Impact is kernel heap corruption and privilege escalation within the same security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Concurrent readers call fou_from_sock() and dereference freed struct fou fields (family, protocol, flags); reclaimed slab contents give attacker-controlled reads and kernel pointer disclosure primitives typical of UAF.\nI:H - Freed struct fou is attacker-reclaimable kmalloc memory; fou_gro_receive indexes inet_offloads[fou->protocol] from the dangling pointer, enabling heap grooming for arbitrary writes and control-flow hijack.\nA:H - Use-after-free in UDP receive/GRO softirq reliably causes KASAN violations and, on production kernels, invalid pointer dereferences or panics when accessing the freed fou object during packet processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74496","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74516","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires triggering KVM nested SVM/AVIC paths via local /dev/kvm ioctls (KVM_CREATE_VM, KVM_CREATE_VCPU, KVM_RUN) from L1; there is no network, adjacent, or physical packet/device path to the vulnerable code.\nAC:L - An L1 attacker fully controls nested VM configuration (x2APIC, AVIC, L2 MSR bitmap, IRQ-window/ExtINT conditions) and can reliably reproduce AVIC inhibition while L2 is active without races or uncontrollable host state.\nPR:H - Reaching the bug requires running nested AMD KVM as L1 (nested virtualization enabled and control of a guest hypervisor), which is not available to an unprivileged host user or via user-namespace capabilities alone without delegated /dev/kvm access.\nUI:N - No victim interaction is required; exploitation is driven entirely by the attacker’s nested hypervisor configuration and KVM_RUN operations once nested virtualization is available.\nS:C - The flaw lets an L1 nested guest hypervisor access the host’s physical x2APIC MSRs, crossing the VM/host security boundary rather than staying within the guest’s own security scope.\nC:H - With x2APIC MSR intercepts left disabled, L1 can read most of the host APIC state (IDs, IRR/ISR, timers, ICR), leaking sensitive host interrupt-controller information beyond the guest boundary.\nI:H - L1 can write host x2APIC MSRs to send arbitrary IPIs, change task priority, and invoke host interrupt vectors (e.g. posted-interrupt wakeup), enabling host integrity compromise beyond mere guest-local effects.\nA:H - Host availability is trivially impacted by injecting spurious or high-priority interrupts to host CPUs; the fix commit demonstrates host kernel warnings and spurious interrupt storms causing denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74516","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74518","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local hugetlb reservation paths (mmap/memfd_create/fault syscalls into region_chg/region_add/region_del); no network protocol or remote packet handler invokes allocate_file_region_entries().\nAC:L - Exploitation needs a race while resv->lock is dropped during GFP_KERNEL allocation, but an attacker can spawn concurrent MAP_SHARED mappers/faulters on one hugetlb inode and controls both sides of that race.\nPR:L - Unprivileged local users can trigger this via memfd_create(MFD_HUGETLB) plus MAP_SHARED mmap/fault activity, or by mapping accessible shared hugetlbfs files, without init-namespace root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the needed concurrent syscalls and shared hugetlb mappings themselves to hit the corrupted list splice retry path.\nS:U - Impact is kernel hugetlb resv_map list/memory corruption on the host; it does not by itself cross a VM, IOMMU, or separate security-authority boundary even though KVM/DPDK hosts are a prime deployment.\nC:H - Without CONFIG_DEBUG_LIST, stale list_splice leaves a kernel-stack pointer in resv->region_cache, producing later use-after-free that can be turned into arbitrary kernel memory read/disclosure primitives.\nI:H - Corrupted region_cache pointers let subsequent region_add/region_del/cache operations write through attacker-influenced list links, enabling heap metadata corruption and potential arbitrary kernel write or code execution.\nA:H - Real host panics were reported on dense KVM hugetlb workloads; DEBUG_LIST kernels BUG on list_add corruption, and default builds can crash from UAF while walking the poisoned region_cache."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74518","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74537","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the Bluetooth ISO stack; iso_conn_ready runs from HCI connection-confirmation events (CIS/BIS/PA sync) driven by LE isochronous traffic from Bluetooth peers within radio range, which is an adjacent attack surface (phones, earbuds, automotive, embedded).\nAC:L - This is a use-after-free race between iso_conn_ready and iso_sock_release/iso_sock_kill; an attacker who controls both an ISO socket close and concurrent HCI completion (e.g., dual-thread connect/close or rapid adjacent CIS/BIS establish-teardown) can reliably trigger it without uncontrollable conditions.\nPR:N - Exploitation requires no elevated credentials on the victim: HCI events are processed for any Bluetooth-enabled device in range, and the racing socket close can occur from automatic stack/daemon teardown during connection setup without the victim performing privileged local actions.\nUI:N - No victim interaction is required when the OS Bluetooth stack (e.g., LE Audio on Android phones or bluetoothd on Linux) automatically manages ISO sockets during pairing, reconnection, or broadcast sync while processing peer-initiated CIS/BIS traffic.\nS:U - The UAF corrupts kernel socket memory and can enable local privilege escalation within the kernel; it does not cross a VM, container, or IOMMU security boundary, so scope remains unchanged.\nC:H - Use-after-free on struct sock after iso_sock_kill frees the socket lets an attacker dereference attacker-influenced freed heap memory, enabling arbitrary kernel memory disclosure via heap grooming and reuse of the sock object.\nI:H - The UAF touches sk->sk_state and sk->sk_state_change during iso_sock_ready on a freed sock, providing a standard kernel heap corruption primitive that can be leveraged for arbitrary write and control-flow hijack.\nA:H - Concurrent iso_sock_kill and iso_conn_ready can dereference freed socket memory, causing kernel oops/panic from invalid lock_sock/sk_state access; UAF in the Bluetooth ISO path is inherently a high-availability risk even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74537","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74556","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised iSCSI target delivers crafted SCSI Command Response PDUs over the established TCP iSCSI session; reception flows through iscsi_sw_tcp_recv/iscsi_tcp_recv_skb into iscsi_tcp_hdr_dissect without local access.\nAC:L - The attacker controls the target and can set DataSegmentLength between 8193 and negotiated max_recv_dlength (open-iscsi commonly 262144) on SCSI_CMD_RSP for any outstanding command ITT; no races or victim-specific heap layout are required.\nPR:N - No privileges on the victim host are needed; a remote attacker acting as or MITMing the iSCSI target sends malicious responses after session login, independent of victim user accounts or capabilities.\nUI:N - On systems with persistent iSCSI sessions (cloud VMs, SAN-boot hosts, Kubernetes iSCSI volumes), exploitation triggers automatically during normal SCSI I/O when command responses are received; no victim action is needed at attack time.\nS:U - Heap corruption is confined to the kernel iSCSI initiator on the affected host; successful exploitation yields kernel compromise or DoS within the same security authority, not a VM escape or cross-boundary scope change.\nC:H - iscsi_tcp_segment_recv memcpy writes up to max_recv_dlength bytes into an 8192-byte conn->data buffer, causing a large heap overflow whose controlled corruption can be leveraged for arbitrary kernel memory disclosure.\nI:H - Attacker-controlled response data is copied past the fixed conn->data allocation via iscsi_tcp_data_recv_prep/iscsi_segment_init_linear, enabling heap metadata/object corruption exploitable for arbitrary kernel write and privilege escalation.\nA:H - Overflowing the conn->data heap buffer can immediately corrupt adjacent kernel allocations and cause oops/panic; a malicious target can repeatedly trigger this on active sessions to deny storage availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74556","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74581","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - fib6_rule_suppress() runs on every IPv6 route lookup via fib6_rule_lookup(), including ip6_route_input() for received packets and icmp6/icmpv6 redirect handlers; WireGuard/VPN servers commonly deploy suppress_prefixlength rules (wg-quick), so remote IPv6 traffic to those hosts reaches the bug.\nAC:L - Once suppress_prefixlength IPv6 policy routing rules exist, any matching packet deterministically triggers fib6_rule_suppress() to release the route while leaving a stale res->rt6 pointer; no race or uncontrollable memory layout is required.\nPR:N - Remote exploitation needs only the ability to send IPv6 packets through a host whose operator already configured suppress rules (e.g., wg-quick); CAP_NET_ADMIN is an admin deployment prerequisite, not attacker privilege on the target.\nUI:N - No victim action is required beyond normal delivery of attacker-generated IPv6 traffic (or ICMPv6 redirect) to a host performing policy-route lookup.\nS:U - The stale rt6_info/dst_entry UAF corrupts kernel heap memory within the same host security boundary; it is not a VM escape or cross-authority sandbox break.\nC:H - Returning a released rt6_info leaves a dangling dst_entry in ip6_dst_cache; subsequent reads through ip6_dst_idev(), dst metrics, or error paths are classic slab UAF with attacker-influencable heap reuse via sustained IPv6 traffic.\nI:H - Double-free/imbalanced rcuref put and post-free use of rt6_info fields give heap corruption primitives; UAF on dst/route cache objects is routinely leveraged for kernel write and control-flow hijack.\nA:H - Commit explicitly reports rcuref_put_slowpath() WARN from dst_release() on the freed route; UAF and refcount corruption can oops/panic the kernel, fully denying availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74582","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb->data before skb->head, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74612","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":10,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Remote packets routed through container/host veth pairs reach veth_xdp_rcv_skb() after veth_xmit on the peer; cloud and edge nodes routinely forward Internet traffic across veth links with XDP attached, matching the reproduced UDP receive path.\nAC:L - The fix commit shows 10/10 reliable reproduction with a 60000-byte UDP datagram and XDP bpf_xdp_adjust_tail()/bpf_xdp_pull_data() fragment shrink; the attacker controls packet size, timing, and both veth ends without races or uncontrollable kernel state.\nPR:N - Exploitation only requires an XDP program using bpf_xdp_adjust_tail or bpf_xdp_pull_data to already be attached on a reachable veth peer; the remote packet sender needs no local account, capabilities, or authentication to trigger the bad skb length accounting.\nUI:N - No victim interaction is needed beyond normal always-on packet reception and socket delivery; corrupted payloads and leaked kernel metadata are produced automatically when a userspace process reads the affected datagram.\nS:C - veth links intentionally cross container/host network namespaces on multi-tenant servers, and skb_shared_info metadata plus kernel pointers leaked into a tenant userspace recv buffer exceed that tenant's authorized security boundary.\nC:H - Desynchronized skb->len makes skb_headlen() exceed the real linear tail, so __skb_datagram_iter() copies up to 1024 bytes past the skb into userspace, exposing nr_frags, xdp_frags_size, and a kernel pointer from skb_shinfo(skb)->frags[0].\nI:H - The same length mismatch inflates the linear region, displacing and truncating real datagram bytes in the delivered UDP buffer and corrupting application-visible data beyond intended packet bounds while compounding misuse of leaked kernel metadata.\nA:H - bpf_xdp_pull_data() can leave frags present while the old __skb_put() path hits SKB_LINEAR_ASSERT()/BUG_ON on nonlinear skbs; the commit reports deterministic kernel asserts and crashes in addition to datagram corruption."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74612","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74669","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74669","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74695","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug fires in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS when remotely sourced IPv4/IPv6 packets matching an offloaded flow are received on nftables flowtable-bound interfaces, not via netlink configuration APIs.\nAC:L - Once a flowtable ingress hook and offloaded TCP/UDP flow exist, an attacker can reliably send matching traffic that reaches FLOW_OFFLOAD_XMIT_NEIGH or the XFRM offload path with a ref-counted skb dst; syzbot reproduced this without uncontrollable races.\nPR:N - Exploitation requires only sending network traffic through an already deployed nftables flow-offload path on an ingress device; no local account, authentication, or CAP_NET_ADMIN on the victim is needed to trigger the leak.\nUI:N - No victim interaction is required beyond normal network delivery; packets are processed automatically in softirq on the netdev ingress netfilter hook without opening files or mounting filesystems.\nS:U - Impact is confined to kernel refcount imbalance and availability degradation on the affected host; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:N - The flaw leaks a dst_entry reference by overwriting skb->_skb_refdst without releasing the prior dst; it does not expose kernel memory or provide an arbitrary read primitive.\nI:N - No unauthorized data modification occurs; the skb is forwarded using the intended flowtable destination while the previous dst reference is orphaned, not corrupted into a controllable write primitive.\nA:H - Each matching packet leaks a dst_entry refcount on the flowtable fast path, enabling sustained unauthenticated remote memory exhaustion on high-volume routers; CONFIG_DEBUG_NET builds also emit WARN_ON_ONCE during the overwrite."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74695","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-80722","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - Malformed S1G TWT setup action frames reach mac80211 via normal WiFi RX (driver -> ieee80211_rx_h_action -> ieee80211_process_rx_twt_action -> ieee80211_s1g_rx_twt_setup); an adjacent attacker within radio range sends crafted 802.11 management frames to a vulnerable AP.\nAC:L - The attacker fully controls the TWT element length and payload; ieee80211_process_rx_twt_action() only validates two bytes of req_type before queueing, so a short individual agreement reliably reaches drv_add_twt_setup() without races or victim-specific timing.\nPR:N - No Linux privileges on the victim AP are required; exploitation needs only normal 802.11 association as a WiFi client to an S1G AP with twt_responder enabled and a driver implementing add_twt_setup (e.g. MediaTek mt7915/mt7996).\nUI:N - No deliberate victim action is needed beyond operating an S1G AP that accepts associated stations; the attacker directly injects the malformed TWT setup frame and mac80211 processes it automatically on receive.\nS:U - Impact is kernel/driver heap memory corruption on the AP host within the same security authority; it does not cross VM, IOMMU, or sandbox boundaries (standard kernel compromise scope).\nC:H - drv_add_twt_setup(), its tracepoint, and driver callbacks read the full ieee80211_twt_params (twt, min_twt_dur, mantissa, channel) beyond the validated skb bounds, causing out-of-bounds reads of adjacent skb/heap memory that can disclose kernel data.\nI:H - MediaTek add_twt_setup() handlers write twt_agrt fields (req_type, min_twt_dur, twt) past the undersized params block into skb tail/heap memory, providing out-of-bounds write primitives exploitable for further memory corruption or code execution.\nA:H - Out-of-bounds access in mac80211/driver TWT setup can kernel-oops the AP or hang/crash WiFi firmware when corrupted parameters are programmed into hardware TWT state from attacker-controlled short frames."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80722","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4369-1","advisory_id":"ddb2c304-0ccc-4573-96b3-606b178f0dff","event_types":["advisory"],"published_at":"2026-10-25T22:45:55.826745+00:00","technologies":["core-osv","kernel-64kb","kernel-default","kernel-default-base","kernel-docs","kernel-livepatch-sle15-sp6-update-31","kernel-obs-build","kernel-source","kernel-syms","kernel-zfcpdump"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:46:28+00:00","detail_url":"/events/71343"},"members":[{"id":71343,"cve_ids":["CVE-2024-44981","CVE-2024-57841","CVE-2025-38469","CVE-2025-40022","CVE-2025-68179","CVE-2025-68214","CVE-2025-71104","CVE-2026-23210","CVE-2026-23230","CVE-2026-23451","CVE-2026-23454","CVE-2026-31502","CVE-2026-43147","CVE-2026-43456","CVE-2026-45968","CVE-2026-52910","CVE-2026-52912","CVE-2026-52929","CVE-2026-52977","CVE-2026-52994","CVE-2026-53059","CVE-2026-53110","CVE-2026-53163","CVE-2026-53260","CVE-2026-53264","CVE-2026-53365","CVE-2026-53366","CVE-2026-53381","CVE-2026-63801","CVE-2026-63823","CVE-2026-63827","CVE-2026-63879","CVE-2026-63881","CVE-2026-63886","CVE-2026-63887","CVE-2026-63888","CVE-2026-63920","CVE-2026-63944","CVE-2026-63970","CVE-2026-63972","CVE-2026-63973","CVE-2026-63992","CVE-2026-64000","CVE-2026-64002","CVE-2026-64007","CVE-2026-64010","CVE-2026-64011","CVE-2026-64015","CVE-2026-64018","CVE-2026-64029","CVE-2026-64034","CVE-2026-64048","CVE-2026-64098","CVE-2026-64109","CVE-2026-64114","CVE-2026-64115","CVE-2026-64121","CVE-2026-64217","CVE-2026-64247","CVE-2026-64266","CVE-2026-64268","CVE-2026-64304","CVE-2026-64312","CVE-2026-64355","CVE-2026-64383","CVE-2026-64384","CVE-2026-64385","CVE-2026-64386","CVE-2026-64387","CVE-2026-64423","CVE-2026-64450","CVE-2026-64481","CVE-2026-64524","CVE-2026-64527","CVE-2026-64541","CVE-2026-64543","CVE-2026-64562","CVE-2026-64563","CVE-2026-64572","CVE-2026-64577","CVE-2026-64581","CVE-2026-64593","CVE-2026-68121","CVE-2026-68133","CVE-2026-68136","CVE-2026-68138","CVE-2026-68155","CVE-2026-68158","CVE-2026-68159","CVE-2026-68160","CVE-2026-68202","CVE-2026-68397","CVE-2026-68398","CVE-2026-68417","CVE-2026-68426","CVE-2026-68428","CVE-2026-68480","CVE-2026-72020","CVE-2026-72069","CVE-2026-72072","CVE-2026-72083","CVE-2026-72084","CVE-2026-72123","CVE-2026-72135","CVE-2026-72221","CVE-2026-72222","CVE-2026-72251","CVE-2026-72262","CVE-2026-72288","CVE-2026-72289","CVE-2026-72317","CVE-2026-72339","CVE-2026-72389","CVE-2026-74345","CVE-2026-74377","CVE-2026-74378","CVE-2026-74390","CVE-2026-74394","CVE-2026-74454","CVE-2026-74488","CVE-2026-74496","CVE-2026-74516","CVE-2026-74518","CVE-2026-74537","CVE-2026-74556","CVE-2026-74581","CVE-2026-74582","CVE-2026-74612","CVE-2026-74669","CVE-2026-74695","CVE-2026-80722"],"payload":{"kind":"advisory","title":"Security update for the Linux Kernel","summary":"The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731). - CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225). - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604). - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072). - CVE-2026-43147: Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (bsc#1264642). - CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734). - CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023). - CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659). - CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000). - CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004). - CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242). - CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126). - CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655). - CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985). - CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqu","evidence":"osv:SUSE-SU-2026:4369-1","products":[{"name":{"value":"kernel-default","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-livepatch-SLE15-SP6_Update_31","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1-150600.13.3.4","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-64kb","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1.150600.12.62.4","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-zfcpdump","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1.150600.12.62.4","evidence":"/affected/12/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/13/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/13/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/14/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/14/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/15/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/15/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/16/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/16/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4369-1","aliases":["SUSE-SU-2026:4369-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.135.1","kernel-default-livepatch-devel":"6.4.0-150600.23.135.1","kernel-livepatch-6_4_0-150600_23_135-default":"1-150600.13.3.4"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.3.4"}]}],"package":{"name":"kernel-livepatch-SLE15-SP6_Update_31","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_31&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.135.1","kernel-default-livepatch-devel":"6.4.0-150600.23.135.1","kernel-livepatch-6_4_0-150600_23_135-default":"1-150600.13.3.4"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-64kb","purl":"pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-zfcpdump","purl":"pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}}],"modified":"2026-10-02T18:42:50.599983491Z","provider":"osv","upstream":["CVE-2024-44981","CVE-2024-57841","CVE-2025-38469","CVE-2025-40022","CVE-2025-68179","CVE-2025-68214","CVE-2025-71104","CVE-2026-23210","CVE-2026-23230","CVE-2026-23451","CVE-2026-23454","CVE-2026-31502","CVE-2026-43147","CVE-2026-43456","CVE-2026-45968","CVE-2026-52910","CVE-2026-52912","CVE-2026-52929","CVE-2026-52977","CVE-2026-52994","CVE-2026-53059","CVE-2026-53110","CVE-2026-53163","CVE-2026-53260","CVE-2026-53264","CVE-2026-53365","CVE-2026-53366","CVE-2026-53381","CVE-2026-63801","CVE-2026-63823","CVE-2026-63827","CVE-2026-63879","CVE-2026-63881","CVE-2026-63886","CVE-2026-63887","CVE-2026-63888","CVE-2026-63920","CVE-2026-63944","CVE-2026-63970","CVE-2026-63972","CVE-2026-63973","CVE-2026-63992","CVE-2026-64000","CVE-2026-64002","CVE-2026-64007","CVE-2026-64010","CVE-2026-64011","CVE-2026-64015","CVE-2026-64018","CVE-2026-64029","CVE-2026-64034","CVE-2026-64048","CVE-2026-64098","CVE-2026-64109","CVE-2026-64114","CVE-2026-64115","CVE-2026-64121","CVE-2026-64217","CVE-2026-64247","CVE-2026-64266","CVE-2026-64268","CVE-2026-64304","CVE-2026-64312","CVE-2026-64355","CVE-2026-64383","CVE-2026-64384","CVE-2026-64385","CVE-2026-64386","CVE-2026-64387","CVE-2026-64423","CVE-2026-64450","CVE-2026-64481","CVE-2026-64524","CVE-2026-64527","CVE-2026-64541","CVE-2026-64543","CVE-2026-64562","CVE-2026-64563","CVE-2026-64572","CVE-2026-64577","CVE-2026-64581","CVE-2026-64593","CVE-2026-68121","CVE-2026-68133","CVE-2026-68136","CVE-2026-68138","CVE-2026-68155","CVE-2026-68158","CVE-2026-68159","CVE-2026-68160","CVE-2026-68202","CVE-2026-68397","CVE-2026-68398","CVE-2026-68417","CVE-2026-68426","CVE-2026-68428","CVE-2026-68480","CVE-2026-72020","CVE-2026-72069","CVE-2026-72072","CVE-2026-72083","CVE-2026-72084","CVE-2026-72123","CVE-2026-72135","CVE-2026-72221","CVE-2026-72222","CVE-2026-72251","CVE-2026-72262","CVE-2026-72288","CVE-2026-72289","CVE-2026-72317","CVE-2026-72339","CVE-2026-72389","CVE-2026-74345","CVE-2026-74377","CVE-2026-74378","CVE-2026-74390","CVE-2026-74394","CVE-2026-74454","CVE-2026-74488","CVE-2026-74496","CVE-2026-74516","CVE-2026-74518","CVE-2026-74537","CVE-2026-74556","CVE-2026-74581","CVE-2026-74582","CVE-2026-74612","CVE-2026-74669","CVE-2026-74695","CVE-2026-80722"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264369-1/","https://bugzilla.suse.com/1230238","https://bugzilla.suse.com/1235944","https://bugzilla.suse.com/1247455","https://bugzilla.suse.com/1250748","https://bugzilla.suse.com/1252682","https://bugzilla.suse.com/1254306","https://bugzilla.suse.com/1255225","https://bugzilla.suse.com/1255250","https://bugzilla.suse.com/1256708","https://bugzilla.suse.com/1257154","https://bugzilla.suse.com/1258430","https://bugzilla.suse.com/1258517","https://bugzilla.suse.com/1260522","https://bugzilla.suse.com/1261604","https://bugzilla.suse.com/1261780","https://bugzilla.suse.com/1263072","https://bugzilla.suse.com/1264642","https://bugzilla.suse.com/1264734","https://bugzilla.suse.com/1265449","https://bugzilla.suse.com/1265928","https://bugzilla.suse.com/1266402","https://bugzilla.suse.com/1267023","https://bugzilla.suse.com/1268659","https://bugzilla.suse.com/1269000","https://bugzilla.suse.com/1269004","https://bugzilla.suse.com/1269126","https://bugzilla.suse.com/1269238","https://bugzilla.suse.com/1269242","https://bugzilla.suse.com/1269306","https://bugzilla.suse.com/1269655","https://bugzilla.suse.com/1269731","https://bugzilla.suse.com/1269792","https://bugzilla.suse.com/1269981","https://bugzilla.suse.com/1269985","https://bugzilla.suse.com/1271365","https://bugzilla.suse.com/1271366","https://bugzilla.suse.com/1271830","https://bugzilla.suse.com/1272179","https://bugzilla.suse.com/1272182","https://bugzilla.suse.com/1272230","https://bugzilla.suse.com/1272381","https://bugzilla.suse.com/1272385","https://bugzilla.suse.com/1272390","https://bugzilla.suse.com/1272569","https://bugzilla.suse.com/1272571","https://bugzilla.suse.com/1272662","https://bugzilla.suse.com/1272673","https://bugzilla.suse.com/1272680","https://bugzilla.suse.com/1272682","https://bugzilla.suse.com/1272756","https://bugzilla.suse.com/1272798","https://bugzilla.suse.com/1272868","https://bugzilla.suse.com/1272877","https://bugzilla.suse.com/1273030","https://bugzilla.suse.com/1273053","https://bugzilla.suse.com/1273054","https://bugzilla.suse.com/1273105","https://bugzilla.suse.com/1273276","https://bugzilla.suse.com/1273303","https://bugzilla.suse.com/1273311","https://bugzilla.suse.com/1273422","https://bugzilla.suse.com/1273426","https://bugzilla.suse.com/1273484","https://bugzilla.suse.com/1273488","https://bugzilla.suse.com/1273523","https://bugzilla.suse.com/1273555","https://bugzilla.suse.com/1273578","https://bugzilla.suse.com/1273742","https://bugzilla.suse.com/1273743","https://bugzilla.suse.com/1273745","https://bugzilla.suse.com/1273748","https://bugzilla.suse.com/1273762","https://bugzilla.suse.com/1273766","https://bugzilla.suse.com/1273774","https://bugzilla.suse.com/1273869","https://bugzilla.suse.com/1273882","https://bugzilla.suse.com/1273891","https://bugzilla.suse.com/1273903","https://bugzilla.suse.com/1273930","https://bugzilla.suse.com/1273944","https://bugzilla.suse.com/1273968","https://bugzilla.suse.com/1273995","https://bugzilla.suse.com/1274014","https://bugzilla.suse.com/1274031","https://bugzilla.suse.com/1274041","https://bugzilla.suse.com/1274208","https://bugzilla.suse.com/1274226","https://bugzilla.suse.com/1274274","https://bugzilla.suse.com/1274497","https://bugzilla.suse.com/1274539","https://bugzilla.suse.com/1274541","https://bugzilla.suse.com/1274543","https://bugzilla.suse.com/1274545","https://bugzilla.suse.com/1274547","https://bugzilla.suse.com/1274550","https://bugzilla.suse.com/1274620","https://bugzilla.suse.com/1274696","https://bugzilla.suse.com/1274699","https://bugzilla.suse.com/1274705","https://bugzilla.suse.com/1274752","https://bugzilla.suse.com/1274753","https://bugzilla.suse.com/1274754","https://bugzilla.suse.com/1274888","https://bugzilla.suse.com/1274898","https://bugzilla.suse.com/1274902","https://bugzilla.suse.com/1274908","https://bugzilla.suse.com/1274941","https://bugzilla.suse.com/1275161","https://bugzilla.suse.com/1275304","https://bugzilla.suse.com/1275307","https://bugzilla.suse.com/1275470","https://bugzilla.suse.com/1275472","https://bugzilla.suse.com/1275474","https://bugzilla.suse.com/1275506","https://bugzilla.suse.com/1275528","https://bugzilla.suse.com/1275535","https://bugzilla.suse.com/1275540","https://bugzilla.suse.com/1275555","https://bugzilla.suse.com/1275665","https://bugzilla.suse.com/1275669","https://bugzilla.suse.com/1275687","https://bugzilla.suse.com/1275696","https://bugzilla.suse.com/1275782","https://bugzilla.suse.com/1275784","https://bugzilla.suse.com/1275797","https://bugzilla.suse.com/1275798","https://bugzilla.suse.com/1275827","https://bugzilla.suse.com/1275867","https://bugzilla.suse.com/1275886","https://bugzilla.suse.com/1275905","https://bugzilla.suse.com/1275925","https://bugzilla.suse.com/1276006","https://bugzilla.suse.com/1276350","https://bugzilla.suse.com/1276665","https://bugzilla.suse.com/1276931","https://bugzilla.suse.com/1277073","https://bugzilla.suse.com/1277155","https://bugzilla.suse.com/1277254","https://bugzilla.suse.com/1277285","https://bugzilla.suse.com/1277391","https://bugzilla.suse.com/1277408","https://bugzilla.suse.com/1277505","https://bugzilla.suse.com/1277523","https://bugzilla.suse.com/1277571","https://bugzilla.suse.com/1277678","https://bugzilla.suse.com/1277860","https://bugzilla.suse.com/1278088","https://bugzilla.suse.com/1278233","https://bugzilla.suse.com/1278236","https://bugzilla.suse.com/1279813","https://www.suse.com/security/cve/CVE-2024-44981","https://www.suse.com/security/cve/CVE-2024-57841","https://www.suse.com/security/cve/CVE-2025-38469","https://www.suse.com/security/cve/CVE-2025-40022","https://www.suse.com/security/cve/CVE-2025-68179","https://www.suse.com/security/cve/CVE-2025-68214","https://www.suse.com/security/cve/CVE-2025-71104","https://www.suse.com/security/cve/CVE-2026-23210","https://www.suse.com/security/cve/CVE-2026-23230","https://www.suse.com/security/cve/CVE-2026-23451","https://www.suse.com/security/cve/CVE-2026-23454","https://www.suse.com/security/cve/CVE-2026-31502","https://www.suse.com/security/cve/CVE-2026-43147","https://www.suse.com/security/cve/CVE-2026-43456","https://www.suse.com/security/cve/CVE-2026-45968","https://www.suse.com/security/cve/CVE-2026-52910","https://www.suse.com/security/cve/CVE-2026-52912","https://www.suse.com/security/cve/CVE-2026-52929","https://www.suse.com/security/cve/CVE-2026-52977","https://www.suse.com/security/cve/CVE-2026-52994","https://www.suse.com/security/cve/CVE-2026-53059","https://www.suse.com/security/cve/CVE-2026-53110","https://www.suse.com/security/cve/CVE-2026-53163","https://www.suse.com/security/cve/CVE-2026-53260","https://www.suse.com/security/cve/CVE-2026-53264","https://www.suse.com/security/cve/CVE-2026-53365","https://www.suse.com/security/cve/CVE-2026-53366","https://www.suse.com/security/cve/CVE-2026-53381","https://www.suse.com/security/cve/CVE-2026-63801","https://www.suse.com/security/cve/CVE-2026-63823","https://www.suse.com/security/cve/CVE-2026-63827","https://www.suse.com/security/cve/CVE-2026-63879","https://www.suse.com/security/cve/CVE-2026-63881","https://www.suse.com/security/cve/CVE-2026-63886","https://www.suse.com/security/cve/CVE-2026-63887","https://www.suse.com/security/cve/CVE-2026-63888","https://www.suse.com/security/cve/CVE-2026-63920","https://www.suse.com/security/cve/CVE-2026-63944","https://www.suse.com/security/cve/CVE-2026-63970","https://www.suse.com/security/cve/CVE-2026-63972","https://www.suse.com/security/cve/CVE-2026-63973","https://www.suse.com/security/cve/CVE-2026-63992","https://www.suse.com/security/cve/CVE-2026-64000","https://www.suse.com/security/cve/CVE-2026-64002","https://www.suse.com/security/cve/CVE-2026-64007","https://www.suse.com/security/cve/CVE-2026-64010","https://www.suse.com/security/cve/CVE-2026-64011","https://www.suse.com/security/cve/CVE-2026-64015","https://www.suse.com/security/cve/CVE-2026-64018","https://www.suse.com/security/cve/CVE-2026-64029","https://www.suse.com/security/cve/CVE-2026-64034","https://www.suse.com/security/cve/CVE-2026-64048","https://www.suse.com/security/cve/CVE-2026-64098","https://www.suse.com/security/cve/CVE-2026-64109","https://www.suse.com/security/cve/CVE-2026-64114","https://www.suse.com/security/cve/CVE-2026-64115","https://www.suse.com/security/cve/CVE-2026-64121","https://www.suse.com/security/cve/CVE-2026-64217","https://www.suse.com/security/cve/CVE-2026-64247","https://www.suse.com/security/cve/CVE-2026-64266","https://www.suse.com/security/cve/CVE-2026-64268","https://www.suse.com/security/cve/CVE-2026-64304","https://www.suse.com/security/cve/CVE-2026-64312","https://www.suse.com/security/cve/CVE-2026-64355","https://www.suse.com/security/cve/CVE-2026-64383","https://www.suse.com/security/cve/CVE-2026-64384","https://www.suse.com/security/cve/CVE-2026-64385","https://www.suse.com/security/cve/CVE-2026-64386","https://www.suse.com/security/cve/CVE-2026-64387","https://www.suse.com/security/cve/CVE-2026-64423","https://www.suse.com/security/cve/CVE-2026-64450","https://www.suse.com/security/cve/CVE-2026-64481","https://www.suse.com/security/cve/CVE-2026-64524","https://www.suse.com/security/cve/CVE-2026-64527","https://www.suse.com/security/cve/CVE-2026-64541","https://www.suse.com/security/cve/CVE-2026-64543","https://www.suse.com/security/cve/CVE-2026-64562","https://www.suse.com/security/cve/CVE-2026-64563","https://www.suse.com/security/cve/CVE-2026-64572","https://www.suse.com/security/cve/CVE-2026-64577","https://www.suse.com/security/cve/CVE-2026-64581","https://www.suse.com/security/cve/CVE-2026-64593","https://www.suse.com/security/cve/CVE-2026-68121","https://www.suse.com/security/cve/CVE-2026-68133","https://www.suse.com/security/cve/CVE-2026-68136","https://www.suse.com/security/cve/CVE-2026-68138","https://www.suse.com/security/cve/CVE-2026-68155","https://www.suse.com/security/cve/CVE-2026-68158","https://www.suse.com/security/cve/CVE-2026-68159","https://www.suse.com/security/cve/CVE-2026-68160","https://www.suse.com/security/cve/CVE-2026-68202","https://www.suse.com/security/cve/CVE-2026-68397","https://www.suse.com/security/cve/CVE-2026-68398","https://www.suse.com/security/cve/CVE-2026-68417","https://www.suse.com/security/cve/CVE-2026-68426","https://www.suse.com/security/cve/CVE-2026-68428","https://www.suse.com/security/cve/CVE-2026-68480","https://www.suse.com/security/cve/CVE-2026-72020","https://www.suse.com/security/cve/CVE-2026-72069","https://www.suse.com/security/cve/CVE-2026-72072","https://www.suse.com/security/cve/CVE-2026-72083","https://www.suse.com/security/cve/CVE-2026-72084","https://www.suse.com/security/cve/CVE-2026-72123","https://www.suse.com/security/cve/CVE-2026-72135","https://www.suse.com/security/cve/CVE-2026-72221","https://www.suse.com/security/cve/CVE-2026-72222","https://www.suse.com/security/cve/CVE-2026-72251","https://www.suse.com/security/cve/CVE-2026-72262","https://www.suse.com/security/cve/CVE-2026-72288","https://www.suse.com/security/cve/CVE-2026-72289","https://www.suse.com/security/cve/CVE-2026-72317","https://www.suse.com/security/cve/CVE-2026-72339","https://www.suse.com/security/cve/CVE-2026-72389","https://www.suse.com/security/cve/CVE-2026-74345","https://www.suse.com/security/cve/CVE-2026-74377","https://www.suse.com/security/cve/CVE-2026-74378","https://www.suse.com/security/cve/CVE-2026-74390","https://www.suse.com/security/cve/CVE-2026-74394","https://www.suse.com/security/cve/CVE-2026-74454","https://www.suse.com/security/cve/CVE-2026-74488","https://www.suse.com/security/cve/CVE-2026-74496","https://www.suse.com/security/cve/CVE-2026-74516","https://www.suse.com/security/cve/CVE-2026-74518","https://www.suse.com/security/cve/CVE-2026-74537","https://www.suse.com/security/cve/CVE-2026-74556","https://www.suse.com/security/cve/CVE-2026-74581","https://www.suse.com/security/cve/CVE-2026-74582","https://www.suse.com/security/cve/CVE-2026-74612","https://www.suse.com/security/cve/CVE-2026-74669","https://www.suse.com/security/cve/CVE-2026-74695","https://www.suse.com/security/cve/CVE-2026-80722"]},"related_cves":[{"value":"CVE-2024-44981","evidence":"/upstream"},{"value":"CVE-2024-57841","evidence":"/upstream"},{"value":"CVE-2025-38469","evidence":"/upstream"},{"value":"CVE-2025-40022","evidence":"/upstream"},{"value":"CVE-2025-68179","evidence":"/upstream"},{"value":"CVE-2025-68214","evidence":"/upstream"},{"value":"CVE-2025-71104","evidence":"/upstream"},{"value":"CVE-2026-23210","evidence":"/upstream"},{"value":"CVE-2026-23230","evidence":"/upstream"},{"value":"CVE-2026-23451","evidence":"/upstream"},{"value":"CVE-2026-23454","evidence":"/upstream"},{"value":"CVE-2026-31502","evidence":"/upstream"},{"value":"CVE-2026-43147","evidence":"/upstream"},{"value":"CVE-2026-43456","evidence":"/upstream"},{"value":"CVE-2026-45968","evidence":"/upstream"},{"value":"CVE-2026-52910","evidence":"/upstream"},{"value":"CVE-2026-52912","evidence":"/upstream"},{"value":"CVE-2026-52929","evidence":"/upstream"},{"value":"CVE-2026-52977","evidence":"/upstream"},{"value":"CVE-2026-52994","evidence":"/upstream"},{"value":"CVE-2026-53059","evidence":"/upstream"},{"value":"CVE-2026-53110","evidence":"/upstream"},{"value":"CVE-2026-53163","evidence":"/upstream"},{"value":"CVE-2026-53260","evidence":"/upstream"},{"value":"CVE-2026-53264","evidence":"/upstream"},{"value":"CVE-2026-53365","evidence":"/upstream"},{"value":"CVE-2026-53366","evidence":"/upstream"},{"value":"CVE-2026-53381","evidence":"/upstream"},{"value":"CVE-2026-63801","evidence":"/upstream"},{"value":"CVE-2026-63823","evidence":"/upstream"},{"value":"CVE-2026-63827","evidence":"/upstream"},{"value":"CVE-2026-63879","evidence":"/upstream"},{"value":"CVE-2026-63881","evidence":"/upstream"},{"value":"CVE-2026-63886","evidence":"/upstream"},{"value":"CVE-2026-63887","evidence":"/upstream"},{"value":"CVE-2026-63888","evidence":"/upstream"},{"value":"CVE-2026-63920","evidence":"/upstream"},{"value":"CVE-2026-63944","evidence":"/upstream"},{"value":"CVE-2026-63970","evidence":"/upstream"},{"value":"CVE-2026-63972","evidence":"/upstream"},{"value":"CVE-2026-63973","evidence":"/upstream"},{"value":"CVE-2026-63992","evidence":"/upstream"},{"value":"CVE-2026-64000","evidence":"/upstream"},{"value":"CVE-2026-64002","evidence":"/upstream"},{"value":"CVE-2026-64007","evidence":"/upstream"},{"value":"CVE-2026-64010","evidence":"/upstream"},{"value":"CVE-2026-64011","evidence":"/upstream"},{"value":"CVE-2026-64015","evidence":"/upstream"},{"value":"CVE-2026-64018","evidence":"/upstream"},{"value":"CVE-2026-64029","evidence":"/upstream"},{"value":"CVE-2026-64034","evidence":"/upstream"},{"value":"CVE-2026-64048","evidence":"/upstream"},{"value":"CVE-2026-64098","evidence":"/upstream"},{"value":"CVE-2026-64109","evidence":"/upstream"},{"value":"CVE-2026-64114","evidence":"/upstream"},{"value":"CVE-2026-64115","evidence":"/upstream"},{"value":"CVE-2026-64121","evidence":"/upstream"},{"value":"CVE-2026-64217","evidence":"/upstream"},{"value":"CVE-2026-64247","evidence":"/upstream"},{"value":"CVE-2026-64266","evidence":"/upstream"},{"value":"CVE-2026-64268","evidence":"/upstream"},{"value":"CVE-2026-64304","evidence":"/upstream"},{"value":"CVE-2026-64312","evidence":"/upstream"},{"value":"CVE-2026-64355","evidence":"/upstream"},{"value":"CVE-2026-64383","evidence":"/upstream"},{"value":"CVE-2026-64384","evidence":"/upstream"},{"value":"CVE-2026-64385","evidence":"/upstream"},{"value":"CVE-2026-64386","evidence":"/upstream"},{"value":"CVE-2026-64387","evidence":"/upstream"},{"value":"CVE-2026-64423","evidence":"/upstream"},{"value":"CVE-2026-64450","evidence":"/upstream"},{"value":"CVE-2026-64481","evidence":"/upstream"},{"value":"CVE-2026-64524","evidence":"/upstream"},{"value":"CVE-2026-64527","evidence":"/upstream"},{"value":"CVE-2026-64541","evidence":"/upstream"},{"value":"CVE-2026-64543","evidence":"/upstream"},{"value":"CVE-2026-64562","evidence":"/upstream"},{"value":"CVE-2026-64563","evidence":"/upstream"},{"value":"CVE-2026-64572","evidence":"/upstream"},{"value":"CVE-2026-64577","evidence":"/upstream"},{"value":"CVE-2026-64581","evidence":"/upstream"},{"value":"CVE-2026-64593","evidence":"/upstream"},{"value":"CVE-2026-68121","evidence":"/upstream"},{"value":"CVE-2026-68133","evidence":"/upstream"},{"value":"CVE-2026-68136","evidence":"/upstream"},{"value":"CVE-2026-68138","evidence":"/upstream"},{"value":"CVE-2026-68155","evidence":"/upstream"},{"value":"CVE-2026-68158","evidence":"/upstream"},{"value":"CVE-2026-68159","evidence":"/upstream"},{"value":"CVE-2026-68160","evidence":"/upstream"},{"value":"CVE-2026-68202","evidence":"/upstream"},{"value":"CVE-2026-68397","evidence":"/upstream"},{"value":"CVE-2026-68398","evidence":"/upstream"},{"value":"CVE-2026-68417","evidence":"/upstream"},{"value":"CVE-2026-68426","evidence":"/upstream"},{"value":"CVE-2026-68428","evidence":"/upstream"},{"value":"CVE-2026-68480","evidence":"/upstream"},{"value":"CVE-2026-72020","evidence":"/upstream"},{"value":"CVE-2026-72069","evidence":"/upstream"},{"value":"CVE-2026-72072","evidence":"/upstream"},{"value":"CVE-2026-72083","evidence":"/upstream"},{"value":"CVE-2026-72084","evidence":"/upstream"},{"value":"CVE-2026-72123","evidence":"/upstream"},{"value":"CVE-2026-72135","evidence":"/upstream"},{"value":"CVE-2026-72221","evidence":"/upstream"},{"value":"CVE-2026-72222","evidence":"/upstream"},{"value":"CVE-2026-72251","evidence":"/upstream"},{"value":"CVE-2026-72262","evidence":"/upstream"},{"value":"CVE-2026-72288","evidence":"/upstream"},{"value":"CVE-2026-72289","evidence":"/upstream"},{"value":"CVE-2026-72317","evidence":"/upstream"},{"value":"CVE-2026-72339","evidence":"/upstream"},{"value":"CVE-2026-72389","evidence":"/upstream"},{"value":"CVE-2026-74345","evidence":"/upstream"},{"value":"CVE-2026-74377","evidence":"/upstream"},{"value":"CVE-2026-74378","evidence":"/upstream"},{"value":"CVE-2026-74390","evidence":"/upstream"},{"value":"CVE-2026-74394","evidence":"/upstream"},{"value":"CVE-2026-74454","evidence":"/upstream"},{"value":"CVE-2026-74488","evidence":"/upstream"},{"value":"CVE-2026-74496","evidence":"/upstream"},{"value":"CVE-2026-74516","evidence":"/upstream"},{"value":"CVE-2026-74518","evidence":"/upstream"},{"value":"CVE-2026-74537","evidence":"/upstream"},{"value":"CVE-2026-74556","evidence":"/upstream"},{"value":"CVE-2026-74581","evidence":"/upstream"},{"value":"CVE-2026-74582","evidence":"/upstream"},{"value":"CVE-2026-74612","evidence":"/upstream"},{"value":"CVE-2026-74669","evidence":"/upstream"},{"value":"CVE-2026-74695","evidence":"/upstream"},{"value":"CVE-2026-80722","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ddb2c304-0ccc-4573-96b3-606b178f0dff","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-23230","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerability is in the SMB client code (fs/smb/client/). The race is triggered between processing a server's create response (setting is_open) and the server sending a lease break notification. A malicious SMB server can trigger this remotely over the network.\nAC:L - The attacker (malicious SMB server) controls when lease breaks are sent and can time them immediately after the create response. The attacker can retry many times across many directory opens, and the RMW race window is inherent to every bitfield write, making it reliably triggerable.\nPR:N - The attacker is the SMB server, requiring no privileges on the victim system. The lease break is processed as part of normal SMB protocol handling with no additional authentication check beyond the existing session.\nUI:R - The victim must mount an SMB share from the attacker's server (or a compromised server), which requires explicit user or administrator action.\nS:U - The vulnerability impacts the kernel where the SMB client runs; it does not cross a security boundary such as a VM or sandbox.\nC:H - The race can restore has_lease after the lease reference was dropped, leading to reference count corruption and use-after-free. UAF on heap objects gives the attacker read primitives over arbitrary kernel memory through heap spraying.\nI:H - The use-after-free from reference count corruption allows the attacker to reclaim the freed cached_fid object with controlled data, enabling arbitrary kernel write primitives and potential code execution.\nA:H - The reference count corruption and list corruption caused by the restored stale flags will lead to double-free, use-after-free, or list corruption, all of which reliably cause kernel panics/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-23230","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-31502","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the vulnerable team header_ops path by locally creating/enslaving network devices through rtnetlink and then triggering dev_hard_header()/dev_parse_header() via local packet/socket or network-stack activity on the malformed team device. The required setup is a local kernel networking configuration path rather than an unauthenticated packet-processing path.\nAC:L - The vulnerable topology, such as GRE -> bond -> team, is fully attacker-controlled once the required namespace capabilities are available, and triggering the bad callback is deterministic. There is no race or external timing condition required.\nPR:L - Creating team/bond/GRE devices and enslaving them requires CAP_NET_ADMIN, and packet sockets require CAP_NET_RAW, but both are available to an unprivileged user inside a user and network namespace on systems permitting unprivileged user namespaces. This is therefore low privileges, not real init-namespace root.\nUI:N - No victim interaction is required after the attacker has local access and namespace capabilities. The attacker can configure the devices and trigger the callback directly.\nS:U - The impact is within the same kernel security authority. This is a kernel crash/type-confusion or privilege-impact issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a header_ops type confusion where callbacks interpret team private data as another subsystem's private structure, causing attacker-influenced kernel pointer dereferences and potential kernel memory exposure. Following the higher-severity rule for type confusion, confidentiality impact is high.\nI:H - Type confusion in kernel callback dispatch can lead to misinterpreted object pointers and potentially control-flow or write-primitive exploitation beyond the observed crash. Kernel type confusion is scored as high integrity impact.\nA:H - The reported and expected failure mode is a kernel oops/BUG/crash when the inherited callback uses the wrong net_device private layout. This gives high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31502","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43456","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local rtnetlink/AF_PACKET operations: creating/enslaving a non-Ethernet slave to a bond and then causing `dev_hard_header()` on the bond device. Remote packets are not sufficient without the vulnerable local device configuration.\nAC:L - No race or special external timing is required; the attacker can deterministically create the bond/GRE setup and trigger the confused header callback. Required modules/configuration are common and autoloadable through rtnetlink in normal deployments.\nPR:L - The setup requires `CAP_NET_ADMIN` and the AF_PACKET trigger requires `CAP_NET_RAW`, but both are obtainable by an unprivileged local user inside a user/network namespace. Therefore this is low privilege rather than real init-namespace root only.\nUI:N - Exploitation does not require a victim user to perform an action. The attacker can perform the setup and trigger locally.\nS:U - The impact is within the kernel security authority on the same system. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug is kernel type confusion where bonding private data is interpreted as another device's private structure, and the confused callback can read kernel data using the wrong layout. Following the required higher-severity rule for type confusion, confidentiality impact is High.\nI:H - The confused header callback uses bogus private-data fields to construct and push protocol headers into an skb, making this a kernel memory/type confusion condition rather than a pure NULL dereference. Type confusion is scored as High integrity impact.\nA:H - The reported failure is a kernel BUG/oops in `pskb_expand_head()` reachable through the confused `ipgre_header()` call. This provides a reliable local kernel crash/DoS."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43456","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52910","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable attach/detach operation is reached through local `setsockopt()` on an `SO_REUSEPORT` socket with `SO_ATTACH_REUSEPORT_CBPF` or `SO_DETACH_REUSEPORT_BPF`. Although packet receive executes the stale program, the attacker-controlled trigger for freeing/replacing it is a local socket API path.\nAC:L - The race is attacker-controlled: a local attacker can create the UDP reuseport group, replace/detach the cBPF program, and concurrently send packets to drive `reuseport_select_sock()`. No rare external condition is required.\nPR:L - A basic unprivileged local user can create UDP sockets on an unprivileged port, set `SO_REUSEPORT`, and attach a classic reuseport BPF filter; this path does not require `CAP_NET_ADMIN`. User namespaces are not needed to make the path reachable.\nUI:N - No victim user action is required once the attacker runs the local reproducer. The attacker controls the sockets, the filter replacement, and the packet generation.\nS:U - The bug is a kernel memory lifetime error used for local kernel compromise or crash within the same host security authority. It does not cross a VM, IOMMU, or similar security boundary.\nC:H - This is a use-after-free of a `bpf_prog` object that is dereferenced after reclamation while selecting a reuseport socket. Per kernel CVSS guidance, UAFs are treated as enabling high confidentiality impact through potential kernel memory disclosure.\nI:H - The stale freed `bpf_prog` can be reused while the receive path reads and runs through the program object, making control-flow or data corruption plausible. Per kernel CVSS guidance, UAF memory corruption warrants high integrity impact.\nA:H - The reported reproducer triggers a KASAN vmalloc out-of-bounds/use-after-free splat in the packet receive path. Such kernel memory corruption can reliably crash or destabilize the kernel."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52912","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local control of netfilter/NFQUEUE, bridge device lifecycle, and verdict reinjection through netlink/rtnetlink paths. Remote packets alone cannot force the needed bridge teardown and userspace verdict sequence.\nAC:L - A local attacker can deterministically create a namespace, bridge/veth setup, NFQUEUE rule, queued packet, bridge teardown, and reinjection. There is no race dependent on conditions outside attacker control.\nPR:L - The setup requires CAP_NET_ADMIN, but netfilter and bridge configuration are reachable with CAP_NET_ADMIN inside a user-created network namespace on systems allowing unprivileged user namespaces. This is Low, not High.\nUI:N - No victim action is required once the local attacker runs the exploit sequence. The attacker controls packet injection, queueing, device teardown, and verdict delivery.\nS:U - The impact is kernel memory corruption within the same host security authority. This is a standard local kernel privilege escalation/DoS scenario, not a VM or hardware boundary escape.\nC:H - The bug is a use-after-free of the bridge master net_device retained in skb->dev across NFQUEUE. Kernel UAFs can be leveraged for kernel memory disclosure, so confidentiality impact is High.\nI:H - The stale net_device pointer is dereferenced after free in the receive path and can plausibly be combined with heap reclaim/spraying for memory corruption or control-flow impact. As a kernel UAF, integrity impact is High.\nA:H - At minimum, reinjection can dereference freed net_device memory in netif_receive_skb and crash/oops the kernel. Repeated local triggering makes availability impact High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52912","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52929","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached while processing an SCTP RE-CONFIG response chunk received from a remote SCTP peer on an established association. A malicious peer can send a denied ADD_OUT_STREAMS response over the network once stream reconfiguration is negotiated.\nAC:L - The packet/state sequence is protocol-controlled and reproducible: negotiate SCTP RE-CONFIG, trigger an ADD_OUT_STREAMS request, deny it, then cause later reuse of the stale stream state. Although RE-CONFIG must be enabled by the application, there is no race or condition outside the attacker's reasonable influence in a deployment using this feature.\nPR:N - A remote SCTP peer does not need local kernel privileges or authenticated OS privileges to send the denial response. The path is gated by SCTP association state, verification tag, and matching outstanding request sequence, not by credentials.\nUI:N - No human user interaction is required once the SCTP service/association is operating with stream reconfiguration. The triggering input is network protocol traffic from the peer.\nS:U - The vulnerability affects kernel SCTP state within the same host security authority. It does not cross a VM, IOMMU, or other separate authorization boundary.\nC:N - The investigated failure mode is stale SCTP stream scheduler metadata leading to a NULL pointer dereference in scheduler value retrieval. I did not find evidence of an attacker-controlled memory read or information disclosure primitive.\nI:N - The bug leaves scheduler-private stream state inconsistent but the demonstrated impact is a NULL dereference/crash, not controlled data modification or code execution. No arbitrary write primitive was evident from the rollback path.\nA:H - The stale stream extension state can lead to a kernel NULL pointer dereference/oops in the SCTP scheduler path. A remotely reachable kernel crash is a high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52929","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53110","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached by locally loading or attaching BPF programs through the bpf() syscall and then executing the JITed program or generated trampoline. It is not directly reachable from remote network packets without prior local BPF program installation.\nAC:L - An attacker can craft BPF bytecode/attachments that exercise unsigned kfunc arguments or trampoline return values, and there is no race or external timing condition required. The bug is a deterministic ABI/JIT miscompilation on affected s390 systems.\nPR:L - Loading kfunc/tracing BPF normally requires BPF-related capabilities, but BPF token delegation can evaluate these in a non-init user namespace in delegated/containerized deployments. Following the higher-severity rule, this is scored as low privileges rather than requiring real init-namespace root.\nUI:N - No victim action is needed after the attacker can issue the relevant bpf() syscalls. The attacker loads/attaches and triggers the affected BPF program path directly.\nS:U - The vulnerability affects kernel execution in the same security authority as the vulnerable component. It is a local kernel compromise/DoS style issue, not a VM escape or separate security-scope boundary bypass.\nC:H - The missing zero-extension lets attacker-controlled high bits cross the verifier/native ABI boundary for kfunc calls and trampoline returns. This can plausibly turn verifier-assumed bounded values into unsafe kernel values, matching prior BPF JIT verifier-bypass classes with kernel memory disclosure potential.\nI:H - Incorrect unsigned argument or return extension can corrupt kernel control/data flow through kfuncs or BPF modify-return trampolines. Under the required higher-severity assumption, this is treated as exploitable for kernel memory modification or privilege escalation.\nA:H - At minimum, passing ABI-invalid kfunc arguments or malformed trampoline return values can trigger kernel oops/panic paths, as similar BPF JIT argument-extension bugs have done. The attacker can repeatedly load/trigger the crafted BPF program."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53110","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53260","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable TCP request-socket path is reached by unauthenticated IPv4 or IPv6 SYN packets delivered to a listening socket over the network. This occurs before any application-level authentication.\nAC:L - Although the bug is a PREEMPT_RT timing race, an attacker can repeatedly create request sockets and timer/drop races by driving TCP connection attempts; under the required higher-severity rule this is treated as attacker-controllable rather than an uncontrollable environmental condition.\nPR:N - No credentials, capabilities, or prior authentication are required to send SYN packets to an exposed TCP listener and reach `tcp_conn_request()` and `reqsk_queue_hash_req()`. The path is in the generic TCP receive stack.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform an interactive action. Network traffic alone can exercise the vulnerable path on an affected listening service.\nS:U - The impact is within the kernel/network stack security authority on the same host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The failure is explicitly reported as a refcount underflow/use-after-free in a kernel heap object. Per the required guidance, UAF-class lifetime corruption is scored as high confidentiality impact because it can potentially be shaped into memory disclosure.\nI:H - The corrupted request-socket lifetime can leave stale kernel objects reachable through ehash/timer paths. Per the required guidance, UAF-class kernel memory corruption is scored as high integrity impact because it may be exploitable for write or control-flow manipulation.\nA:H - The observed failure triggers a kernel refcount warning with use-after-free semantics in timer context and can destabilize networking or the kernel. Kernel warnings/oopses, hangs, or UAF-triggered crashes are high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53260","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53264","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local rtnetlink `RTM_NEWTFILTER`/`RTM_DELTFILTER` traffic-control netlink messages, not by remote packet input.\nAC:L - The race is attacker-controlled because the same local actor can issue concurrent filter creation and deletion operations against the same action index. No external victim timing or rare environmental condition is required.\nPR:L - The operations require `CAP_NET_ADMIN` for non-GET rtnetlink messages, but traffic control is reachable with `CAP_NET_ADMIN` inside a user-created network namespace. Under the provided kernel guidance, this is Low privileges rather than High.\nUI:N - No victim interaction is needed; exploitation consists of the attacker sending crafted concurrent rtnetlink requests.\nS:U - The impact is within the kernel security authority and is a standard local kernel memory-corruption/privilege-escalation class issue. It does not cross a VM, IOMMU, or separate authorization scope boundary.\nC:H - The bug is a use-after-free of a `tc_action` object during action lookup/refcounting. A kernel heap UAF can be shaped into disclosure primitives, so confidentiality impact is High.\nI:H - The stale freed action pointer can be reused after heap reallocation and then modified/dereferenced through refcount, bind count, ops, and action lifecycle fields. This is memory corruption that can plausibly support arbitrary write or code execution, so integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or mutate freed/reused kernel memory and can crash or oops the kernel. Availability impact is therefore High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53366","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached while a local process constructs outgoing IPv4 UDP/raw/ping datagrams through sendmsg/splice/sendfile-style socket paths. I did not find a defensible received-packet or unauthenticated remote path that supplies the required cork/MSG_MORE-style fraggap conditions.\nAC:L - The attacker can choose UDP socket options/flags, payload sizes, corking/MSG_MORE behavior, and splice/zerocopy-style paged sends to reach the fraggap paged-allocation path. There is no race or external timing condition required.\nPR:L - A normal unprivileged local user can create IPv4 UDP sockets and use UDP_CORK/MSG_MORE/splice or related paged send paths; raw sockets are CAP_NET_RAW-gated but are not needed for the strongest local trigger. This is therefore basic local user privilege, not real administrator privilege.\nUI:N - No victim interaction is required once the attacker can run the local send/splice sequence. The vulnerable skb construction happens synchronously in the attacker-driven socket send path.\nS:U - The impact is within the same kernel security authority as the vulnerable IPv4 networking code. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug under-allocates/accounting for the linear skb area and can copy attacker-controlled fraggap bytes past skb->end into trailing skb_shared_info metadata. Kernel memory corruption of this kind is reasonably capable of being developed into information disclosure, so the higher severity confidentiality value is appropriate.\nI:H - The copied fraggap bytes corrupt kernel skb metadata past the intended buffer boundary. This is an out-of-bounds write in kernel heap/networking structures and is scored as high integrity impact.\nA:H - The corrupted skb metadata can crash or destabilize the kernel networking stack, and related negative-copy accounting can also produce severe send-path failure behavior. Kernel crash or oops potential is high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53366","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53381","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local VFS operations (open/write/close) on a virtiofs mount with FUSE submounts; exploitation is in the guest FUSE client during file release and submount umount, not via remote network packets.\nAC:L - This is a use-after-free where the attacker controls file close (async FUSE RELEASE) and can drive or coincide with submount umount; Kata Containers reproduces it reliably with virtiofsd --announce-submounts (default).\nPR:L - An unprivileged local process with access to the virtiofs mount can trigger it; virtiofs defaults to allow_other and normal POSIX permissions, and no real root or init-namespace capabilities are required.\nUI:N - Exploitation needs no victim interaction beyond the attacker (or their container workload) performing normal filesystem I/O while submount teardown occurs during pod/container lifecycle.\nS:U - Impact stays within the guest kernel security boundary (crash or guest kernel compromise); it does not by itself cross a VM/host or IOMMU boundary.\nC:H - The flaw is a use-after-free in fuse_release_end() calling iput() on an inode after its superblock is destroyed, which can be turned into arbitrary kernel memory read via heap manipulation.\nI:H - Use-after-free on a struct inode in the kernel heap provides a standard path to controlled memory corruption, heap spraying, and arbitrary write or code execution in kernel context.\nA:H - Confirmed kernel general protection fault/oops in iput() from fuse_release_end during virtio_fs request completion, and UAF bugs inherently threaten kernel stability even without full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53381","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63801","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached from the TIPC packet receive path (UDP bearer on port 6118 or L2 bearer) when encrypted frames arrive from a remote peer; no local syscall is required to enter tipc_aead_decrypt().\nAC:L - The attacker can reliably win the race by flooding packets to queue async decrypt completions while repeatedly destroying the network namespace; the repro demonstrates full control of both sides of the timing window.\nPR:L - Reliable exploitation is demonstrated via unshare-created user/network namespaces where the attacker gains CAP_NET_ADMIN-equivalent control to configure TIPC crypto and cycle namespace teardown, which per kernel CNA guidance maps to Low rather than High.\nUI:N - Exploitation requires only sending network packets and namespace lifecycle manipulation; no victim user action such as opening a file or mounting a filesystem is needed.\nS:U - Impact is confined to kernel memory within the same security authority; this is a standard kernel UAF/privilege-escalation class bug, not a VM escape or cross-authority boundary bypass.\nC:H - The UAF reads freed slab memory including aead->crypto->stats, aead->crypto->net, and aead[] pointers in tipc_crypto_rcv_complete, enabling arbitrary kernel memory disclosure via controlled reuse of the freed tipc_crypto object.\nI:H - Use-after-free of tipc_crypto structures can be leveraged for heap spraying and arbitrary write primitives, and tipc_crypto_rcv_complete continues processing with freed pointers including key attachment and node table operations.\nA:H - KASAN confirmed slab-use-after-free in tipc_aead_decrypt_done on a workqueue thread; UAF on this path causes kernel oops/panic even when not fully exploited for code execution."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63801","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63823","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local `request_key()` and `keyctl()` syscalls (`KEYCTL_ASSUME_AUTHORITY`, `KEYCTL_INSTANTIATE`, `KEYCTL_INSTANTIATE_IOV`, `KEYCTL_REJECT`); there is no network, adjacent-radio, or physical-device entry path.\nAC:L - Exploitation is a race the attacker orchestrates by calling `request_key()` and concurrently driving `KEYCTL_INSTANTIATE_IOV` with a user buffer that page-faults during `copy_from_iter_full()`, while a second helper thread or completion path revokes/frees the auth payload.\nPR:L - Any unprivileged local user can invoke `request_key()` and the affected `keyctl` instantiate/reject operations in the spawned helper context; no real-root or non-userns capability is required.\nUI:N - Exploitation does not depend on a victim performing an action beyond the attacker’s own syscall activity and helper process setup.\nS:U - Impact is kernel memory corruption and local privilege escalation within the same kernel security domain, not a VM-guest-to-host or IOMMU boundary escape.\nC:H - This is a heap use-after-free of `struct request_key_auth`; after free the code dereferences `rka->target_key` and related fields, enabling attacker-controlled reuse and arbitrary kernel memory disclosure.\nI:H - The UAF corrupts trusted kernel pointers (`target_key`, `dest_keyring`) used in `key_instantiate_and_link()`, which can be turned into arbitrary kernel writes and local privilege escalation.\nA:H - Use-after-free of kernel heap objects can cause kernel oops/panic during post-fault dereferences, and is independently severe even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63823","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63879","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local AMDGPU DRM ioctls (e.g., AMDGPU_GEM_USERPTR, AMDGPU_CS) and KFD ioctls on /dev/kfd that call amdgpu_hmm_range_get_pages(); there is no network-facing entry point.\nAC:L - Exploitation requires a >2GB userptr/SVM mapping and a concurrent munmap/remap during the multi-chunk HMM walk, but the attacker controls both the ioctl thread and the address-space manipulation, so the race is attacker-driven rather than dependent on uncontrollable conditions.\nPR:L - Any unprivileged local user with access to the AMDGPU render node or /dev/kfd (typically render/video group membership) can create large userptr buffers and submit GPU work that triggers the vulnerable HMM path; root or init-namespace capabilities are not required.\nUI:N - Exploitation is fully attacker-driven through GPU memory registration and command submission ioctls and does not require any action from another user or administrator.\nS:U - The flaw corrupts or misuses kernel-tracked page metadata and enables standard local kernel memory safety impact and privilege escalation within the same kernel security domain, not a VM escape or IOMMU boundary bypass.\nC:H - Re-reading the MMU notifier sequence per 2GB chunk lets later validation pass while earlier PFNs may reference unmapped or freed pages, giving the GPU (and kernel DMA helpers) a stale-page/use-after-free primitive that can disclose arbitrary physical memory contents.\nI:H - Stale PFNs from invalidated mappings can be DMA-mapped and written by GPU operations, enabling arbitrary memory corruption and potential control-flow hijacking via repurposed physical pages rather than a bounded or crash-only effect.\nA:H - Operating on invalid struct page pointers during pinning/DMA mapping can trigger kernel oopses or panics, and the underlying use-after-free class of bug inherently threatens system availability even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63879","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63881","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local `ioctl()` on `/dev/kfd` via `AMDKFD_IOC_DBG_TRAP` with `KFD_IOC_DBG_TRAP_SUSPEND_QUEUES` or `KFD_IOC_DBG_TRAP_RESUME_QUEUES`; there is no network, adjacent-radio, or physical-access path to the vulnerable code.\nAC:L - On affected 32-bit `size_t` kernel builds, an attacker fully controls `num_queues` in the ioctl and can reliably force the multiply overflow (e.g. `num_queues >= 0x40000001`) to trigger undersized `memdup_user()` followed by unbounded kernel heap corruption.\nPR:L - A local unprivileged user with AMDGPU/KFD device access can open `/dev/kfd`, enable the debug runtime and debug trap on their own process (no ptrace or root required), then invoke suspend/resume with a malicious `num_queues` value.\nUI:N - Exploitation is achieved entirely through attacker-initiated ioctl calls in an established KFD debug session; no victim interaction is required.\nS:U - Impact is kernel heap corruption and potential local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - The integer overflow causes a heap buffer far smaller than `num_queues`, and subsequent `q_array_get_index()`/`copy_to_user()` operations perform out-of-bounds kernel reads that can disclose adjacent heap memory and be leveraged for arbitrary read primitives.\nI:H - `q_array_invalidate()` and per-queue status updates write attacker-influenced values (`KFD_DBG_QUEUE_INVALID_MASK`/`KFD_DBG_QUEUE_ERROR_MASK`) far beyond the allocated buffer, constituting an out-of-bounds heap write exploitable for control-flow hijacking and arbitrary kernel modification.\nA:H - Writing billions of 32-bit values past a 4-byte kmalloc object corrupts adjacent kernel heap metadata and objects, readily causing kernel oops/panic and complete loss of availability even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63881","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63886","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered by a remote iSCSI initiator sending crafted CHAP login PDUs over TCP to the in-kernel LIO iSCSI target during the network login/authentication handshake.\nAC:L - Once an iSCSI target with CHAP is reachable, an attacker can reliably trigger the overflow by sending CHAP_R with a 0b-prefixed base64 string up to 127 characters; no race or special memory layout is required.\nPR:N - The heap overflow occurs during the CHAP authentication handshake before the password hash comparison succeeds, so exploitation is reachable by an unauthenticated remote network attacker who knows a configured CHAP username.\nUI:N - Exploitation requires only the attacker initiating an iSCSI login connection and sending malicious CHAP PDUs; no action from a victim user is needed.\nS:U - Successful exploitation corrupts kernel heap memory within the same kernel security boundary, enabling denial of service or kernel privilege escalation, not a cross-boundary escape such as VM guest-to-host.\nC:H - The out-of-bounds heap write corrupts adjacent kmalloc objects and can be leveraged for arbitrary kernel memory disclosure through heap grooming, consistent with heap overflow impact guidance.\nI:H - A controlled kernel heap out-of-bounds write of up to 79 bytes past a digest-sized buffer can corrupt adjacent structures and be developed into arbitrary code execution or kernel privilege escalation.\nA:H - The overflow causes slab-out-of-bounds writes confirmed by KASAN and can crash or destabilize the kernel during login processing, constituting high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63886","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63887","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The Linux iSCSI target (LIO) is an in-kernel SCSI target that accepts remote TCP connections on the iSCSI portal (typically port 3260); crafted Login PDUs reach the vulnerable encoder via the normal network receive and login-negotiation path.\nAC:L - Once an iSCSI target portal is reachable, an attacker can reliably trigger the overflow by sending a single Login PDU packed with unknown key=value pairs; no races or victim-dependent timing are required.\nPR:N - The heap overflow occurs during login negotiation before iSCSI authentication completes; a discovery-session login requires only InitiatorName and SessionType with no credentials, initiator ACL, or local privileges.\nUI:N - Exploitation requires only network packets sent by the attacker; no action from a legitimate user or administrator is needed beyond the target already exposing its iSCSI portal.\nS:U - The corruption is confined to kernel heap memory in the iSCSI target/login context and does not cross a VM, container, or IOMMU security boundary by itself.\nC:H - A ~24 KiB out-of-bounds write into the kmalloc-8k slab can corrupt adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - The unbounded sprintf heap overrun is a large out-of-bounds write that can corrupt adjacent heap metadata or objects to achieve arbitrary kernel memory modification and potential code execution.\nA:H - Corrupting kmalloc-8k heap objects during login response encoding can cause kernel oops, BUG, or panic, and the attack can be repeated against an exposed iSCSI target."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63887","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63888","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the in-kernel LIO iSCSI target, reachable by sending iSCSI Text PDUs over TCP after connection setup on the network-facing iSCSI portal (typically port 3260), analogous to nfsd/ksmbd network exposure.\nAC:L - An attacker fully controls login parameter negotiation (DataDigest=CRC32C) and subsequent Text PDU content; the CRC overread fires deterministically on every qualifying Text PDU, and the double-free is reliably triggered by sending a bad DataDigest followed by another Text PDU on the same ITT when ERL>0.\nPR:N - No Linux OS privileges are required; the default discovery session permits unauthenticated login (AuthMethod=None, authentication disabled), after which SendTargets Text requests reach the vulnerable handler without any credentials.\nUI:N - Exploitation requires only crafted iSCSI protocol traffic from the attacker; no victim user action such as mounting a filesystem or clicking a link is needed.\nS:U - The vulnerability corrupts kernel heap memory within the iSCSI target subsystem on the host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The CRC path performs a slab out-of-bounds read past the text_in allocation, and the double-free is a use-after-free class bug that reads freed heap metadata; per kernel guidance both OOB reads and UAFs warrant High confidentiality impact.\nI:H - The double-free corrupts the slab freelist (triggering CONFIG_SLAB_FREELIST_HARDENED BUG() on hardened kernels), providing a classic heap corruption primitive that can be leveraged for arbitrary kernel memory writes and code execution.\nA:H - The double-free provably crashes the kernel (KASAN splat or SLAB_FREELIST_HARDENED BUG()), and the heap corruption can cause kernel panics; any UAF is scored as High availability impact per kernel guidance."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63888","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63920","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (nftables netlink to install a payload-set rule, setsockopt for IPV6_RECV* options, and recvmsg). Although the trigger packet is received over IPv6, the mandatory nftables corruption step is classified as Local per kernel guidance.\nAC:L - The attacker fully controls the nftables payload-set rule, the on-wire extension header, socket receive options, and the recvmsg call, making the slab out-of-bounds read reliably reproducible without races or external conditions.\nPR:L - An unprivileged local user can create a user+network namespace, obtain CAP_NET_ADMIN there, configure nftables, open a UDPv6/raw socket with extension-header cmsg options, and trigger the bug without real root in the initial namespace.\nUI:N - No victim interaction is required; the attacker can send the crafted IPv6 datagram and call recvmsg on their own socket to trigger the out-of-bounds read.\nS:U - Impact is confined to kernel memory disclosure and potential kernel instability within the same kernel security domain; it does not cross a VM/host or IOMMU boundary.\nC:H - put_cmsg() can copy up to 2040 bytes past the actual extension header into userspace ancillary data, leaking adjacent slab/kernel memory (confirmed by KASAN slab-out-of-bounds in put_cmsg).\nI:N - The bug is an out-of-bounds read that copies kernel data to userspace; it does not modify kernel memory, corrupt control structures, or provide a write primitive.\nA:H - The out-of-bounds slab read can provoke a KASAN fault/kernel oops during put_cmsg(), and repeated triggering can deny availability of the affected system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63920","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63944","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the Bluetooth HCI ISO/CIS path (`hci_le_create_cis_sync`), reachable only via the Bluetooth radio interface. Per kernel CVSS guidance, Bluetooth vulnerabilities are scored as Adjacent, including on phones and LE Audio devices in public spaces.\nAC:L - The UAF is a race between `hci_le_create_cis_sync` dropping locks and a concurrent `hci_conn_del`. An attacker who controls one side of the CIS setup (local ISO socket threads or a remote peer timing ACL/CIS teardown) can repeatedly trigger the race; success does not depend on uncontrollable conditions like kernel memory layout.\nPR:N - No local Unix privileges are required for the highest-impact scenario: a remote Bluetooth peer in range can provoke CIS teardown/disconnect events while the victim host is performing normal LE Audio CIS establishment (e.g., phone connecting to earbuds). Local exploitation via ISO sockets also requires no special capabilities at the kernel level.\nUI:N - Both sides of the race run inside the kernel's own HCI event handling: hci_le_create_cis_pending() queues the vulnerable work from hci_le_cis_established_evt(), hci_cs_le_create_cis(), hci_unbound_cis_failed() and iso_connect_cfm(), all driven by controller events and remote peer traffic, while the freeing side is a peer-initiated disconnect reaching hci_conn_del(). On an LE Audio host the CIS establishment happens by itself when the earbuds connect and the attacker supplies the disconnect, so nothing is asked of the person holding the device; the existing pairing is a precondition of the deployment, not an in-attack user step.\nS:U - Impact is confined to kernel memory corruption within the Bluetooth subsystem on the host; this is standard kernel compromise, not a cross-boundary escape (KVM guest-to-host, IOMMU bypass, or sandbox breakout).\nC:H - This is a slab use-after-free read of `conn->conn_timeout` on a freed `hci_conn` (kmalloc-8k object). UAF reads against attacker-influencable freed objects can disclose kernel heap contents and are scored as High per kernel CVSS guidance.\nI:H - Although the immediate bug is a post-unlock dereference of a freed `hci_conn`, UAF on large `hci_conn` kmalloc objects enables heap grooming and control of freed memory contents, which can be chained into arbitrary kernel writes or code execution; UAF class bugs are scored I:H.\nA:H - Use-after-free access to a freed connection object can cause kernel oops/panic (as demonstrated by the same bug class in the related `le_read_features_complete` fix found by syzkaller). Even without full exploitation, triggering the UAF reliably causes High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63944","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63970","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local AF_VSOCK transmission (syscall/io_uring send on a connected virtio vsock socket), not by processing remote network packets. Per kernel CVSS guidance, vsock is Local.\nAC:L - An attacker fully controls the trigger: SO_ZEROCOPY, io_uring IORING_OP_SEND_ZC with IORING_RECVSEND_FIXED_BUF and a vectored iov exceeding MAX_SKB_FRAGS (17), causing io_sg_from_iter() to return -EMSGSIZE on a deterministic error rollback path.\nPR:L - Exploitation requires only an unprivileged local process that can open a vsock connection and use io_uring zerocopy send; no CAP_NET_ADMIN or real root is needed beyond ordinary local user access in a virtio-vsock environment (KVM/Firecracker/cloud microVMs).\nUI:N - No victim interaction is required; the attacker triggers the bug directly through their own socket send/io_uring operation.\nS:U - Impact is kernel memory corruption and privilege escalation within the same security domain where the send occurs (guest kernel or host kernel). It is not a cross-boundary VM escape on the receive path; the flaw is in the sender's local skb teardown.\nC:H - Incorrect __skb_frag_unref() on SKBFL_MANAGED_FRAG_REFS pages without a bound uarg corrupts refcount/lifetime of io_uring registered buffer pages, yielding use-after-free and arbitrary kernel memory read primitives.\nI:H - The refcount corruption is a memory-safety bug in kernel heap/page management that can be leveraged for arbitrary write and control-flow hijacking, not merely a bounded data change.\nA:H - The erroneous frag unref on managed zerocopy pages can cause immediate kernel oops/panic from refcount underflow or use-after-free during skb teardown, independent of full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63970","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63992","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code runs on the VXLAN/GENEVE transmit path when processing remotely received UDP-encapsulated tunnel traffic (or L2 frames forwarded through a bridge port), which is reachable by sending crafted packets over the network to the victim VTEP.\nAC:L - The attacker fully controls the inner IPv4 header fields (DF bit, length, addresses) and can reliably craft oversized packets that exceed the tunnel-adjusted PMTU on bridge-port tunnel devices without depending on race timing or uncontrollable system state.\nPR:N - Exploitation requires only the ability to send network packets to a host with VXLAN/GENEVE bridged; no local account, authentication, or capabilities on the victim are needed.\nUI:N - No victim user action is required; the kernel processes attacker-supplied packets automatically through the tunnel receive, bridge forward, and re-encapsulation path.\nS:U - The out-of-bounds read and resulting kernel oops occur within the kernel network stack on the same host; there is no crossing of a VM, container, or IOMMU security boundary beyond standard kernel memory safety failure.\nC:H - Reading through `icmp_hdr(skb)` when `transport_header` is unset causes an out-of-bounds read at `skb->head + 65535`, potentially disclosing adjacent kernel memory beyond the skb buffer before any bounds checking occurs.\nI:N - The flaw is an out-of-bounds read of the ICMP type field; it does not directly modify or write kernel memory, though it may cause a kernel fault.\nA:H - The invalid pointer dereference at offset 65535 can trigger a kernel oops or panic when accessing unmapped memory, causing denial of service on the affected host."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63992","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64000","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached when the kernel processes received Ethernet frames via the netdev RX handler in net/hsr, and a remote attacker on the HSR/PRP ring can deliver a crafted supervision frame without any local access to the victim host.\nAC:L - The attacker fully controls the malformed frame content and length; a precisely truncated supervision frame reliably passes existing TLV validation and triggers the out-of-bounds read with no races or attacker-uncontrollable conditions.\nPR:N - Exploitation requires only the ability to inject L2 HSR/PRP supervision frames onto the ring segment; no local account, capabilities, or authentication on the target kernel is needed.\nUI:N - No victim user action is required beyond normal operation of an HSR/PRP-configured node; the attacker triggers the bug solely by sending a malicious frame.\nS:U - Impact is confined to kernel memory safety within the same security authority; there is no VM escape, IOMMU bypass, or cross-security-boundary scope change.\nC:H - The bug is an out-of-bounds read of supervision TLV header fields past the skb tail, which can disclose adjacent kernel heap/skb memory and is not strictly bounded to a few attacker-uncontrolled bytes.\nI:H - Out-of-bounds access in kernel packet parsing can supply attacker-influenced TLV type/length values that drive further skb_pull arithmetic and extended parsing, creating a plausible path to memory corruption and control-flow hijacking.\nA:H - Reading beyond the skb buffer boundary during softirq packet processing can cause a kernel oops/panic, and the attacker can repeatedly trigger the condition with crafted frames."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64000","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64002","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls—network namespace teardown via unshare/setns/put_net, sysctl access to /proc/sys/net/ipv4/ip_local_reserved_ports, and/or local socket bind/connect—not remote packet delivery.\nAC:L - The attacker can control both sides of the race by concurrently tearing down a network namespace while hammering the sysctl or triggering socket port selection in that namespace.\nPR:L - An unprivileged local user can reach this via user namespaces (CAP_SYS_ADMIN within the user_ns for CLONE_NEWNET) and world-writable sysctl access (mode 0644) during namespace destruction.\nUI:N - No victim interaction is required beyond the attacker's own concurrent namespace teardown and sysctl or socket activity.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it is standard local kernel memory corruption, not a VM/hypervisor boundary escape.\nC:H - Freed 8 KiB bitmap memory remains reachable via sysctl reads (find_next_bit) and inet_is_local_reserved_port() (test_bit), enabling heap information disclosure through a use-after-free.\nI:H - Sysctl writes via proc_do_large_bitmap perform bitmap_copy/bitmap_or into the freed allocation, providing a heap write primitive exploitable for control-flow hijacking.\nA:H - Concurrent access to the freed bitmap can cause kernel oops/panic from invalid memory access, and UAF exploitation inherently threatens kernel availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64002","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64007","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered when remote TCP packets traverse SYNPROXY netfilter hooks (NF_INET_LOCAL_IN / NF_INET_POST_ROUTING) on a host with SYNPROXY configured, which is the standard internet-facing firewall/router deployment for this subsystem.\nAC:L - An attacker who controls a TCP session through SYNPROXY can reliably send timestamp-bearing packets to hit the vulnerable path; the stale-pointer UAF write occurs whenever skb_ensure_writable() must expand a cloned skb, which the attacker can influence by sustaining traffic on the proxied connection.\nPR:N - Exploitation requires only that the victim already runs SYNPROXY (normal for protected services); the remote attacker needs no credentials or local privileges on the target system to send the triggering TCP packets.\nUI:N - No victim user action is required beyond normal network operation; exploitation is fully automated via crafted or sustained TCP traffic through the SYNPROXY session.\nS:U - Impact is confined to kernel memory on the affected host running SYNPROXY; this is standard kernel privilege escalation/memory corruption, not a cross-VM or cross-security-boundary escape.\nC:H - The stale tcphdr pointer causes inet_proto_csum_replace4() to write into freed slab memory, a use-after-free class bug that can be leveraged for arbitrary kernel memory read via heap grooming techniques.\nI:H - The out-of-bounds write into freed slab memory via a stale tcphdr pointer is a use-after-free write primitive that can be developed into arbitrary kernel memory writes and local privilege escalation.\nA:H - Writing into freed slab memory can corrupt adjacent kernel objects and cause kernel oops, panic, or crash, and UAF conditions are inherently capable of destabilizing the system even during exploitation attempts."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64007","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64015","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through find_key_to_update() on the persistent keyring register, which is invoked from keyctl_get_persistent() via the keyctl(2) syscall. There is no network, adjacent-radio, or physical-device path to this code.\nAC:L - Exploitation is a race between assoc_array_find() and assoc_array_gc() on the .persistent_register keyring; the attacker controls both sides by repeatedly calling KEYCTL_GET_PERSISTENT (including from multiple threads) while driving key expiry/GC via keyctl timeouts or natural garbage collection. Per kernel guidance, attacker-controlled races are AC:L.\nPR:L - Any unprivileged local user who can invoke keyctl() can call KEYCTL_GET_PERSISTENT for their own UID (-1) with a writable destination keyring (e.g., session keyring). No real-root or CAP_SETUID capability is required for the vulnerable lookup path; this remains PR:L even inside user namespaces.\nUI:N - Exploitation requires only the attacker's own keyctl syscalls and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary on its own.\nC:H - assoc_array_find() is documented to require an RCU read lock, but the persistent-keyring path called it without one while assoc_array_gc() frees tree nodes via call_rcu(), yielding a use-after-free on assoc_array nodes/leaves. UAF on kernel heap objects can be turned into arbitrary kernel memory reads.\nI:H - The freed assoc_array nodes can be reallocated and corrupted through concurrent GC versus lookup, providing a standard kernel heap UAF primitive that can be developed into arbitrary write or code-execution primitives.\nA:H - Dereferencing RCU-freed assoc_array tree nodes during lookup can cause kernel oops/panic from invalid pointer access, and UAF exploitation commonly destabilizes or crashes the kernel even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64015","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64018","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached via MSI-driven hardware completion processing in the MANA HWC control path (not netdev packet receive), triggered when the Azure hypervisor/host tampers with guest-visible DMA-coherent WQE memory on the same physical compute node.\nAC:L - A malicious host or NIC firmware that can modify shared unencrypted DMA buffers controls both the forged sge->address and the timing of HWC RX completions, allowing reliable out-of-bounds indexing without winning a race or depending on guest state.\nPR:N - Exploitation requires no privileges on the victim guest VM; the attacker operates from the Azure hypervisor/host side by modifying DMA-coherent memory that the guest kernel trusts during HWC response handling.\nUI:N - No victim user action is required; exploitation occurs automatically when the driver processes a hardware completion event on the HWC receive queue.\nS:C - In Confidential VMs the guest relies on host isolation guarantees, but shared unencrypted DMA memory lets a hostile hypervisor cross that CVM security boundary to corrupt guest kernel memory and confidentiality.\nC:H - An out-of-bounds rx_req_idx yields a corrupted hwc_work_request whose buf_va is dereferenced and copied via memcpy in mana_hwc_handle_resp(), enabling arbitrary kernel memory disclosure.\nI:H - The out-of-bounds hwc_work_request supplies attacker-controlled pointers and SGE fields used to repost RX WQEs via mana_hwc_post_rx_wqe(), enabling kernel heap corruption and exploitable memory writes.\nA:H - Indexing reqs[] out of bounds with attacker-controlled values can dereference invalid kernel pointers and corrupt adjacent heap objects, causing kernel oops/panic and denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64018","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64029","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access via the ALSA sequencer device node (/dev/snd/seq) using write(2) and port-subscription ioctls; there is no network, Bluetooth, or physical-device attack surface on the vulnerable code path.\nAC:L - The race is between concurrent UMP event delivery and the last output-port unsubscribe/close path, and a local attacker can control both sides with parallel threads (flood write() while repeatedly subscribing/unsubscribing to the UMP port).\nPR:L - Any local unprivileged user who can open /dev/snd/seq (typically membership in the audio group on desktop/workstation systems where UMP MIDI hardware is present) can create sequencer clients, subscribe to UMP kernel ports, and trigger the bug without real root or init-namespace capabilities.\nUI:N - Exploitation is fully attacker-driven through sequencer writes and subscription management; no victim interaction such as opening files, mounting filesystems, or plugging in devices is required beyond the UMP endpoint already being present on the system.\nS:U - Impact is confined to kernel memory corruption and potential local privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary bypass.\nC:H - KASAN confirmed a slab use-after-free on freed substream runtime metadata in snd_rawmidi_kernel_write1(); UAF on kernel heap objects enables controlled reallocation and arbitrary kernel memory disclosure primitives.\nI:H - The UAF occurs inside snd_rawmidi_kernel_write1(), which performs memcpy() into runtime->buffer using attacker-supplied UMP event payload, providing a plausible path to arbitrary kernel memory corruption and code execution beyond a simple crash.\nA:H - The confirmed KASAN slab-use-after-free in kernel write path causes kernel oops/panic; even without full exploitation, the bug reliably threatens system availability through kernel crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64029","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64034","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a malicious hypervisor or host that can modify MANA HWC DMA-coherent response buffers between guest kernel loads; it is not reachable by sending network packets to the guest's data path.\nAC:L - The attacker controlling the hypervisor fully controls DMA buffer contents and can reliably flip hwc_msg_id between the validation read and the use in mana_hwc_handle_resp() on uncacheable coherent memory.\nPR:N - The attacking hypervisor needs no guest OS credentials or capabilities; exploitation targets the guest kernel through the virtual device DMA path while the MANA driver is active.\nUI:N - No victim user action is required beyond normal Azure VM operation with the MANA driver loaded and HWC receive buffers posted.\nS:C - The vulnerability crosses the VM/DMA security boundary by allowing a hostile hypervisor to corrupt guest kernel memory that the confidential-guest threat model assumes is protected from host tampering.\nC:H - Out-of-bounds indexing via bypassed hwc_msg_id validation enables reading adjacent kernel heap objects through misdirected caller_ctx access and test_bit() on the inflight bitmap.\nI:H - Host-controlled response data is copied with memcpy() to an out-of-bounds output_buf pointer, enabling arbitrary kernel memory corruption and potential control-flow hijacking.\nA:H - Out-of-bounds caller_ctx access and corrupted completion signaling can cause kernel oops, panic, or hang during HWC response handling."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64034","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64048","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The fault is triggered while processing a malicious CLC ACCEPT message received from a remote TCP peer during the SMC-D handshake; the attacker controls the server response over the network.\nAC:L - Once a victim with SMC-Dv2 hardware initiates an SMC connection, a malicious peer can reliably send `d1.chid == 0` in the CLC ACCEPT to match the empty reserved slot 0 without races or special timing.\nPR:N - No local privileges are required on the victim host; an unauthenticated remote attacker operating a malicious SMC server can crash connecting clients, and unprivileged users can create SMC sockets without capability checks.\nUI:N - Exploitation requires only that a victim application initiate a normal outbound SMC connection to the attacker's server, which occurs automatically in enterprise middleware without per-connection user action.\nS:U - The vulnerability causes a kernel crash on the victim host but does not cross a security boundary such as VM escape or sandbox breakout.\nC:N - The bug is a null pointer dereference when taking `ism_dev[0]->lgr_lock`; it causes an immediate kernel fault with no information disclosure.\nI:N - The attempted write at address 0x68 is a spinlock operation on a NULL `smcd_dev` pointer, not a controlled or arbitrary memory modification primitive.\nA:H - A successful trigger causes a kernel null pointer dereference (KASAN-reported oops/panic), crashing the affected system or at minimum the connecting process's kernel context."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64048","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64098","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through local DRM ioctl syscalls (DRM_IOCTL_MODE_CURSOR and DRM_MASTER modesetting ioctls) on /dev/dri/card0, not via any network-facing kernel service.\nAC:L - An attacker can reliably trigger the bug by signaling a thread blocked in dma_resv_lock_interruptible (-EINTR), forcing memory pressure for -ENOMEM, or running concurrent plane updates to race the unlocked fence-list mutation.\nPR:L - Exploitation requires DRM master on the virtio-gpu device, which a local user with standard DRI access (video/render group membership on typical virtio-gpu VMs) can obtain when no compositor holds master; this is not init-namespace root.\nUI:N - Triggering the bug requires only attacker-initiated DRM ioctl calls (cursor/plane updates); no action by another user or victim is needed.\nS:U - The corruption occurs within the same kernel security domain (guest or host) that issued the ioctl; virtio-gpu runs in the guest kernel and this does not cross a VM/hypervisor boundary to the host.\nC:H - Mutating the dma_resv fence list without holding the lock races with concurrent readers and can corrupt kernel heap metadata, which is reasonably leverageable for arbitrary memory disclosure.\nI:H - The same unlocked fence-list corruption can corrupt kernel pointers and synchronization state, providing a plausible path to arbitrary kernel writes or control-flow hijacking.\nA:H - The bug produces kernel WARN/oops under lockdep and fence-list corruption can cause kernel crashes, hangs, or panics during subsequent dma_resv operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64098","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64109","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local syscalls on AF_UNIX SOCK_STREAM sockets (recvmsg, splice_read, setsockopt SO_PEEK_OFF), not via any network protocol handler.\nAC:L - The attacker controls both racing threads on the same socket fd and can retry the peek/normal-recv interleaving; this is a self-induced race, not one dependent on uncontrollable kernel state.\nPR:L - Any unprivileged local user can create AF_UNIX socketpairs, set SO_PEEK_OFF, and run concurrent recv operations without capabilities, including from within user namespaces.\nUI:N - Exploitation requires no victim interaction; the attacker sets up and races their own socket endpoints programmatically.\nS:C - Successful kernel heap UAF exploitation from an unprivileged container, Android app sandbox, or user-namespace tenant crosses the sandbox boundary to compromise the host kernel.\nC:H - This is a slab use-after-free read of sk_buff->len on freed memory, which per UAF guidance enables arbitrary kernel memory disclosure and heap layout leaks.\nI:H - UAF on sk_buff objects in the kernel heap can be leveraged through heap grooming and spraying to obtain arbitrary write and kernel code execution primitives.\nA:H - The UAF read can trigger KASAN slab-use-after-free faults, kernel oops, or panic during the dereference, and repeated triggering causes denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64109","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64114","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (socket/sendmsg on a raw IP_HDRINCL socket); malformed packets are injected locally into the output path, not via remote network ingress which validates ihl >= 5.\nAC:L - The attacker fully controls the crafted header ihl value and can install the required xfrm AH policy and route via CAP_NET_ADMIN in their own network namespace, making exploitation reliable without conditions outside attacker control.\nPR:L - Triggering requires CAP_NET_RAW for raw sockets and CAP_NET_ADMIN to install xfrm AH policy, both obtainable by an unprivileged user via user+network namespaces or a container granted NET_ADMIN without init-namespace root.\nUI:N - No victim interaction is required; the attacker sends the malformed packet directly through their own raw socket and configured IPsec policy.\nS:U - Impact is kernel memory corruption and panic within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The integer underflow in ah_output() memcpy length produces an out-of-bounds read of near SIZE_MAX bytes, providing an arbitrary kernel memory read primitive beyond any bounded disclosure.\nI:H - The same memcpy with underflowed length causes a massive out-of-bounds write that can corrupt adjacent kernel heap memory and be leveraged for control-flow hijacking.\nA:H - The OOB memcpy reliably causes a kernel-mode fault and host panic, as reproduced with KASAN and in a rootless Docker container, denying all system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64114","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64115","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local AF_VSOCK syscalls (connect/close) to drive VMCI control packets; per kernel CVSS guidance, vsock is scored Local even when the peer is a VM guest reaching a host listener.\nAC:L - The attacker controls both sides of the handshake race by initiating a connection and aborting it with RST during TCP_SYN_SENT; KASAN testing showed 52/100 repro without conditions outside attacker control.\nPR:L - Any unprivileged local user inside a VM (or on the same host) can open AF_VSOCK sockets and connect to a listening peer without CAP_NET_ADMIN or other elevated privileges.\nUI:N - Exploitation requires only a victim service with a bound/listening vsock socket, which is normal background operation; no interactive victim action is needed.\nS:C - In the most severe reasonable VMware deployment, an unprivileged guest VM triggers kernel memory corruption on the hypervisor host via VMCI vsock, crossing the guest-to-host virtualisation security boundary analogous to KVM/Xen VM escape.\nC:H - The bug is a slab use-after-free on struct sock; UAF on kernel heap objects enables arbitrary memory read primitives through controlled reuse of the freed socket structure.\nI:H - The UAF involves a write to a freed object's refcount field and corrupts kernel heap metadata, providing a foundation for arbitrary write and kernel code execution via heap grooming.\nA:H - The vulnerability reliably triggers kernel UAF detected by KASAN (refcount write to freed memory on a kworker), which causes kernel oops/panic and denial of host availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64115","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64247","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggering requires a Hyper-V TLB-flush hypercall from an L2 vCPU under KVM, ultimately reached through the local KVM_RUN ioctl; no network path reaches it.\nAC:L - A malicious nested-virtualization tenant controls both the unchecked enlightened-VMCS/VMCB VP ID and the sparse-bank hypercall data, with no uncontrollable race required.\nPR:L - The attacker needs control of a KVM guest with nested virtualization, or ordinary /dev/kvm access to create one, but requires neither host root nor an init-namespace capability.\nUI:N - Once the crafted nested guest executes, no action by another user is required.\nS:C - The out-of-bounds access occurs in the host kernel from attacker-controlled guest state, crossing the KVM guest-to-host isolation boundary.\nC:H - The attacker-selected VP ID makes test_bit() query selectable bits far beyond the stack-resident 64-bit mask, and the resulting TLB-flush decision can provide an oracle for host kernel memory.\nI:N - The primitive performs reads only; a set result merely selects a legitimate L2 vCPU for an extra TLB flush, with no out-of-bounds write or unsafe mapping change.\nA:H - The selectable access can reach a VMAP_STACK guard or another unmapped page and oops the host; KASAN already detects the access as an eight-byte invalid read, which can become a host-wide denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64247","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64266","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - A local attacker reaches the flaw by serving a self-created FUSE mount and invoking splice() on its associated /dev/fuse descriptor.\nAC:L - The attacker controls writeback generation, splice processing, and concurrent connection abort, allowing repeated attempts at the race without an uncontrollable prerequisite.\nPR:L - FUSE supports user-namespace mounts, and an unprivileged mount owner can operate /dev/fuse and abort their own connection without init-namespace root.\nUI:N - The attacker can create and exercise their own FUSE connection without any victim action.\nS:U - Exploitation compromises the kernel within the same operating-system security authority and does not inherently cross a virtualization boundary.\nC:H - The freed argument and folio arrays are subsequently dereferenced, permitting attacker-influenced stale folio pointers and potential arbitrary kernel-memory disclosure through pipe buffers.\nI:H - Heap reclamation can replace the freed folio pointers and loop metadata, enabling attacker-directed memory or refcount operations that may support arbitrary writes and kernel code execution.\nA:H - The repeatable use-after-free and invalid folio operations can cause an oops, panic, or other complete system failure."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64266","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64268","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - siw carries iWARP over ordinary routable TCP, and the vulnerable receive callback processes crafted Read Response FPDUs from the remote endpoint of an established RDMA connection.\nAC:L - The peer learns the sink tag, address, and length from the RREAD and can deterministically send oversized continuation segments; no race or uncontrollable condition is required.\nPR:N - The MPA/siw data path performs no credential or capability check on the connected peer, and an unauthenticated RDMA service can accept the connection and issue attacker-induced RREADs.\nUI:N - The overflow is triggered through an automated RDMA protocol exchange and requires no human action.\nS:U - The corruption compromises resources within the affected host's kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The global DMA/KVA sink case exposes the sink address and permits attacker-controlled kernel memory corruption, which can enable control-flow hijacking and arbitrary kernel-memory disclosure.\nI:H - Attacker-chosen response bytes are written beyond the validated sink into adjacent kernel memory, providing an exploitable out-of-bounds write capable of modifying objects or achieving kernel code execution.\nA:H - The overwrite can corrupt critical kernel objects or reach invalid memory, causing an oops or panic; bounded FRWR sinks still permit connection-terminating denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64268","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64304","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An unprivileged local process can add a crafted PKCS#8 RSA private key to its own keyring and invoke KEYCTL_PKEY_QUERY, which selects qat-rsa and reaches the vulnerable key setup path.\nAC:L - With an active QAT asymmetric service and PKCS#8 parser, an oversized CRT integer deterministically causes unsigned offset underflow and an out-of-bounds memcpy. No race or attacker-uncontrollable condition is required.\nPR:L - An ordinary user can create, search, and use keys in a personal process, thread, or session keyring. No capability, administrator privilege, or user namespace is required.\nUI:N - The attacker directly performs the add_key and keyctl system calls without any victim action.\nS:U - The vulnerable QAT driver and the corrupted kernel resources share the same security authority. Ordinary kernel privilege escalation does not cross a CVSS scope boundary.\nC:H - The controlled kernel-memory overwrite can corrupt page tables, credentials, or control-flow objects and plausibly yield code execution with access to protected kernel memory.\nI:H - Attacker-controlled CRT bytes are written outside the coherent DMA allocation, potentially through multiple CRT components. This can provide powerful kernel-memory corruption and control-flow hijacking primitives.\nA:H - The invalid destination can cause an immediate kernel fault or corrupt unrelated kernel memory and subsequently panic or hang the system. The attack is repeatable."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64312","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - pcrypt is designed for network-facing IPsec use, and an inbound ESP packet can traverse xfrm_input(), esp_input(), crypto_aead_decrypt(), and pcrypt_aead_decrypt().\nAC:L - In load-responsive CPU-hotplug deployments, an attacker can flood qualifying ESP requests across repeated PADATA_RESET windows without precise timing or an uncontrollable memory-layout condition.\nPR:N - The ESP SPI is transmitted in clear, and the faulty path is reached before the child AEAD validates the integrity tag, so an unauthenticated on-path attacker needs no target-system privileges.\nUI:N - Packet delivery and asynchronous completion require no victim action.\nS:U - The failure affects the same kernel security authority processing the request and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The rejected request retains a zero padata->pd pointer, producing a NULL dereference without an out-of-bounds read or information disclosure.\nI:N - The callback writes only the completion status into its valid request context before dereferencing NULL; it provides no attacker-directed corruption or write primitive.\nA:H - padata_do_serial() dereferences the uninitialized padata->pd pointer, causing a kernel oops or panic that can terminate the system and can be retriggered."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64312","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64355","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A remote peer can send an oversized packet that a fragment-capable NIC represents as a multi-buffer XDP frame, reaching the vulnerable devmap broadcast clone path on a configured forwarding host.\nAC:L - No race or uncontrollable timing condition is required; fragmented packets reliably enter the faulty clone path and can be sent repeatedly.\nPR:N - Although initial-namespace CAP_BPF and CAP_NET_ADMIN are needed to configure the XDP deployment, the attacker sending packets through the already-configured unauthenticated data path needs no privileges.\nUI:N - Packet reception and XDP processing occur automatically without victim action.\nS:U - The corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other distinct boundary.\nC:H - Uninitialized fragment descriptors are consumed as page references and can be used by scatter-gather transmitters for unintended DMA mappings, potentially exposing arbitrary kernel memory.\nI:H - An uninitialized fragment count can overrun fixed-size driver arrays, while bogus page references can cause invalid refcount decrements, premature frees, and exploitable kernel memory corruption.\nA:H - Invalid fragment metadata can fault during DMA mapping, transmission, or frame return and cause a kernel oops or panic; an attacker can trigger this repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64355","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64383","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB server can trigger the flaw through crafted replayable responses and connection failures over the network.\nAC:L - The server controls both the replayable error and subsequent reconnect failure, allowing repeated triggering without an uncontrollable race.\nPR:N - The attacking SMB endpoint requires no privileges on the client system once an SMB session and file handle exist.\nUI:N - An automatically mounted share and routine service-generated fsync, truncate, timestamp, or seek operations can reach SMB2_flush() without human participation.\nS:U - The memory corruption compromises resources governed by the same host kernel security authority.\nC:H - The response-buffer double-free can create overlapping CIFS slab allocations and use-after-free primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and attacker-influenced overlapping network buffers can provide arbitrary-write or control-flow-hijacking primitives.\nA:H - The double-free can immediately trigger an allocator BUG, kernel oops, or panic and can be invoked repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64383","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64384","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious SMB server can return a replayable response and then force reconnect failure over the network, causing the client to free stale response state twice.\nAC:L - The peer controls both prerequisites by returning a status such as STATUS_RETRY and then disconnecting or refusing reconnection; repeated attempts make the scheduling window attacker-controllable.\nPR:N - The malicious SMB peer requires no account, capability, or other privilege on the vulnerable client; the established client session does not grant the attacker privileges on that host.\nUI:N - An ordinary automated CIFS workload can maintain an outstanding change-notify request, after which the remote peer completes the trigger without human involvement.\nS:U - Exploitation compromises the kernel and resources governed by the same host security authority, without crossing a separate virtualization or sandbox boundary.\nC:H - The double-free corrupts the CIFS response-buffer slab or mempool, permitting overlapping live objects and freelist manipulation that can support disclosure of arbitrary kernel memory.\nI:H - The heap corruption can provide attacker-influenced writes through aliased request and response buffers or freelist poisoning, potentially enabling kernel control-flow hijacking.\nA:H - Hardened allocators can immediately panic on the consecutive double-free, while unhardened allocators can crash later through freelist corruption."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64384","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64385","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - An attacker-controlled SMB server can deliver crafted SMB2 IOCTL responses over TCP, including through the kernel's periodic interface-query FSCTL on an existing SMB3 mount.\nAC:L - On a hard or retrans-enabled mount, the server controls replayable statuses, response contents, disconnects, reconnects, and repeated attempts, allowing it to drive both sides of the triggering sequence.\nPR:N - The malicious SMB server needs no account or privilege on the target; victim mounting authority and client authentication do not grant or require attacker-side target privileges.\nUI:N - Once the share is mounted, kernel delayed work can automatically issue the affected FSCTL when the server advertises multichannel support, requiring no user action during exploitation.\nS:U - The memory corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, container, or IOMMU boundary.\nC:H - The response-buffer double-free can corrupt SLUB or mempool state and create dangling or overlapping live buffers, enabling use-after-free exploitation and kernel-memory disclosure.\nI:H - Attacker-controlled network data can overwrite aliased or freed buffers and poison allocator state, supporting arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can trigger an allocator BUG or corrupt kernel heap state, causing an oops, panic, or complete system crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64385","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64386","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB2/3 server can remotely return a response-bearing replayable error and manipulate the subsequent connection state, reaching the vulnerable client over TCP.\nAC:L - The server controls the error response, disconnect, and reconnection sequence and can repeat it until the stale free occurs. Replay-enabled hard or retrans-configured SMB mounts are a reasonable deployment.\nPR:N - The malicious SMB peer needs no privileges or credentials on the client; SMB session setup authenticates the client to the server, not the attacker to the victim kernel.\nUI:N - Once the share is mounted, ordinary or automated file and metadata operations issue query-info requests, and exploitation requires no human action during the crafted response and reconnect sequence.\nS:U - The corruption and resulting impacts occur within the same Linux kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:H - The double-free corrupts SMB response-buffer slab and mempool state, enabling aliased or use-after-free buffers that can be leveraged to expose kernel memory.\nI:H - Allocator freelist corruption and reuse of one buffer by concurrent SMB operations can provide attacker-controlled modification of live kernel memory and support control-flow hijacking.\nA:H - The repeated free can immediately cause allocator corruption, a BUG, kernel oops, or panic, and the malicious server can trigger the sequence repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64386","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64387","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious remote SMB server can trigger the flaw through crafted responses to SMB2 QUERY_DIRECTORY requests over the established network connection.\nAC:L - On a hard/retrans-enabled mount, the server controls the replayable error and can repeatedly induce disconnect/reconnect conditions before request reinitialization, without relying on an uncontrollable race.\nPR:N - The attacker needs no account or privilege on the client; the client authenticates to the attacker-controlled SMB server, and ordinary accessible-share enumeration reaches the code.\nUI:N - In a reasonable auto-mounted deployment, routine directory enumeration can be performed automatically by a daemon or application without human participation.\nS:U - The corruption occurs within the client kernel and compromises resources governed by that same kernel security authority.\nC:H - Double-freeing the attacker-influenced CIFS response object can poison the slab freelist or create overlapping allocations, providing UAF-style primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and aliased CIFS buffers can enable attacker-influenced writes and potentially control-flow hijacking or kernel code execution.\nA:H - The double-free can immediately trigger allocator diagnostics, an oops, or a kernel panic, and corrupted freelists can cause subsequent fatal faults."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64387","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64423","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An end-to-end attacker-controlled trigger requires local socket and netlink operations to create multicast memberships and concurrently destroy IPv4 device state; received multicast packets alone cannot initiate the necessary teardown. These operations are reachable inside an attacker-created user and network namespace.\nAC:L - The attacker can populate mc_hash, generate continuous multicast traffic, and repeatedly tear down IPv4 state, controlling both sides of the race. No victim-dependent timing or secret state is required.\nPR:L - Device teardown or invalid-MTU configuration requires CAP_NET_ADMIN in the target network namespace, while multicast joins and UDP sends are unprivileged. An ordinary user can obtain this namespace-scoped capability through unprivileged user and network namespaces.\nUI:N - Exploitation requires no action by another user once the attacker can execute locally and create the required namespace and traffic.\nS:U - The vulnerable code and resulting host-kernel compromise remain within the same security authority; this is conventional kernel privilege escalation rather than a guest-to-host escape.\nC:H - The stale kmalloc-256 ip_mc_list entry exposes reuse-controlled fields and pointers to kernel reads, making kernel-memory disclosure and broader read primitives plausible.\nI:H - Reallocation permits attacker-influenced object contents to drive spinlock writes and pointer traversal on freed memory, making heap corruption and control-flow hijacking defensible.\nA:H - The confirmed slab use-after-free can dereference corrupted hash pointers or operate on an invalid spinlock, causing a kernel oops, panic, general-protection fault, or hang."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64423","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64450","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - TIPC packets can arrive through an IP/UDP bearer from a routable remote source, and the receive callback does not restrict packets to configured remote addresses. An attacker can also establish or spoof the required TIPC neighbour state without credentials.\nAC:L - The attacker controls capability advertisement, link establishment, broadcast synchronization, and the malformed STATE message; one packet then reliably performs the out-of-bounds copy without a race or uncontrollable condition.\nPR:N - The packet-receive path performs no capability or user-credential check, and TIPC discovery and link negotiation are unauthenticated when optional cryptographic keys are not configured. The vulnerable broadcast processing also precedes normal STATE-session validation.\nUI:N - No victim action is required after the TIPC bearer is active; receipt of the crafted STATE message directly invokes the vulnerable code.\nS:U - The vulnerability compromises availability and potentially confidentiality within the receiving kernel's existing security authority, without crossing a VM, IOMMU, or comparable scope boundary.\nC:H - The attacker-controlled count makes the kernel copy up to 1,024 bytes from a much smaller skb, incorporating substantial adjacent slab contents rather than a strictly bounded few-byte read.\nI:N - The defect performs an out-of-bounds read into a correctly sized new allocation; investigation found no out-of-bounds write, arbitrary-write primitive, or control-flow corruption.\nA:H - The demonstrated 1,024-byte slab-out-of-bounds access produces a KASAN BUG and can panic or fault hardened kernels, and an unauthenticated attacker can trigger it repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64450","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64481","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the vulnerable callbacks through ALSA control ioctls on /dev/snd/controlC*. No network or physical protocol directly exposes this path.\nAC:L - After teardown, stale controls can repeatedly dereference the freed object or queue its embedded work item, so exploitation does not require winning a narrow race. A queued work_struct also remains directly usable after its containing allocation is freed.\nPR:L - An unprivileged user with ordinary audio-device access can invoke the control callbacks. The ioctl path contains no capability, namespace, or administrative privilege check.\nUI:N - Exploitation requires no victim to open content or perform an interactive action.\nS:U - The vulnerable driver and the affected kernel resources are governed by the same kernel security authority.\nC:H - The heap use-after-free permits attacker-influenced reuse and disclosure of freed kernel object contents, potentially supporting arbitrary kernel memory reads.\nI:H - The freed object embeds mutable workqueue list state and a function pointer that is subsequently invoked, making kernel memory corruption and control-flow hijacking defensible.\nA:H - Stale control accesses or corrupted queued work can cause a kernel oops, panic, or workqueue corruption, resulting in complete system unavailability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64481","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64524","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The malicious resolution response must originate from the local Hyper-V synthetic-video backend over VMBus; it is not reachable through a network protocol or guest userspace ioctl.\nAC:L - The backend can deterministically trigger the flaw by returning a resolution_count from 65 through 255 during the normal WIN10+ probe or resume exchange, without a race or unpredictable condition.\nPR:N - The guest accepts the VMBus response without authentication, capability checks, or guest credentials; a malicious or compromised backend requires no privileges within the vulnerable guest.\nUI:N - The response is processed automatically during device probing or resume, without any victim action.\nS:U - The vulnerable parser and the affected DRM and kernel resources are within the same guest-kernel security authority; this does not produce a guest-to-host escape.\nC:H - A count of 255 causes 191 additional four-byte entries to be read beyond the declared array, substantially exceeding a small bounded disclosure and allowing out-of-bounds kernel data to influence observable display state.\nI:N - The invalid accesses are reads, and their results are written only to the intended resolution fields; no out-of-bounds write, use-after-free, or control-flow corruption was found.\nA:H - Bounds-instrumented hardened kernels can oops when index 64 is reached, while a failed or malformed resolution probe can leave zero maximum dimensions and make every userspace framebuffer creation fail."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64524","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64541","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable handler is driven entirely by a CDC control message sent by the remote SMC-R peer over the RDMA link, with an attacker-chosen `token` field and no local syscall involvement. SMC-R runs over RoCEv2 (IP/UDP-routable, port 4791) with the CLC handshake over plain TCP, and SMC-Rv2 explicitly supports non-local/routed peers, so the attacker need not share an L2 segment.\nAC:L - The attacker controls both sides of the race: it chooses when to emit CDC messages and which connection to target (the alert token is disclosed to it in the CLC accept/confirm), and it can drive the teardown side itself via CDC close/abort flags into `smc_close_passive_work()` or a stale seqno with `failover_validation` into `abort_work` -> `smc_conn_kill()`. The race can be retried indefinitely across many connections in the same link group, and was reproduced in practice with soft-RoCE.\nPR:N - Establishing an SMC-R connection to a listening SMC socket requires no credentials — SMC has no authentication layer of its own, exactly like plain TCP. Everything after connection establishment (sending CDC messages with a chosen token, signalling close/abort) is available to an unauthenticated peer.\nUI:N - The CDC message is processed in a softirq tasklet from the RDMA completion queue with no involvement from any local user or application action. No victim interaction of any kind is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard in-kernel use-after-free.\nC:H - The freed `smc_sock` is reused type-safely as another live socket, so attacker-supplied cursors applied by `smc_cdc_msg_recv_action()` break the `0 <= bytes_to_rcv <= rmb_desc->len` invariant and make `smc_rx_recvmsg()` hand stale RMB contents to userspace, while the urgent-data path reads `*(base + conn->urg_curs.count - 1)` at an attacker-chosen offset. Once the slab page is reclaimed after the RCU grace period, reuse is unconstrained, giving a general kernel-memory read primitive.\nI:H - `sock_hold()` on an already-zero refcount followed by `sock_put()` re-enters `sk_free()`, yielding a double free, and the handler additionally writes `sk_err`/`sk_shutdown`, makes indirect calls through `sk_data_ready()`/`sk_write_space()`, and `queue_work()`s a freed `work_struct`. These are classic heap-spray and control-flow-hijack primitives leading to arbitrary kernel write.\nA:H - The reported symptom is `refcount_warn_saturate` from `smc_cdc_msg_recv()`, which is an immediate kernel panic on `panic_on_warn` systems, and dereferencing freed memory in softirq context otherwise oopses. The attacker can trigger it repeatedly without authentication."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64541","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64543","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The free side is only reachable through the local TIPCv2 generic-netlink `BEARER_DISABLE` command (or netns teardown); a remote peer can supply the discovery packet that performs the use-after-free access but cannot itself cause `bearer_disable()` to run, so the complete attack requires local access.\nAC:L - The attacker controls both sides of the race — one thread floods TIPC discovery packets at the bearer's UDP port while another disables the bearer — and `bearer_disable()` clears `b->up` and then `kfree()`s the discoverer with no synchronization whatsoever, leaving a wide window that a multi-CPU packet flood hits reliably (a working PoC exists).\nPR:L - `tipc_genl_family` is `.netnsok = true` and the bearer enable/disable ops carry no `GENL_ADMIN_PERM` or other capability check, so an unprivileged user can do everything inside `unshare -Urn` after autoloading tipc via `socket(AF_TIPC, ...)`.\nUI:N - The attacking process performs both the bearer disable and the packet injection itself; no victim action or cooperating user is involved.\nS:U - The corruption stays within the kernel's own security authority — no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - `d->net` is read from the freed slab object and dereferenced as a `struct net *`; after reclaiming the kmalloc-192 allocation with sprayed data the attacker gains a controlled-pointer dereference chain usable for arbitrary kernel memory disclosure.\nI:H - `msg_set_prevnode(buf_msg(d->skb), sugg_addr)` writes a wire-controlled 32-bit value through the dangling `d->skb` pointer, and `tipc_disc_add_dest()` takes a spinlock and increments a counter in freed memory — together a controlled-address/controlled-value write suitable for control-flow hijacking.\nA:H - The use-after-free reliably produces a KASAN slab-use-after-free in softirq context and, on production kernels, a corrupted-pointer dereference or spinlock manipulation on reclaimed memory leading to kernel panic."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64543","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64562","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local KVM nested VMX: open /dev/kvm, run a nested guest, then tear down nested state (VMXOFF/handle_vmxoff or vmx_leave_nested). It is not reachable via network or adjacent-radio packets.\nAC:L - A KVM VMM attacker controls both sides of the race by driving nested teardown (VMXOFF/vcpu destroy) while forcing vCPU migration via thread affinity/scheduling so __loaded_vmcs_clear() VMCLEARs the dangling shadow VMCS pointer.\nPR:L - Exploitation needs permission to use /dev/kvm and nested VMX (commonly kvm-group or equivalent), not real init-namespace root; KVM create/run ioctls have no CAP_SYS_ADMIN gate on this path.\nUI:N - After the attacker has KVM/nested access, they trigger free_nested and migration themselves; no separate victim action is required.\nS:C - free_nested runs in host KVM while handling L1 nested VMX teardown, and the UAF corrupts host kernel memory, crossing the guest/hypervisor isolation boundary (guest-to-host escape class).\nC:H - The dangling shadow VMCS pointer lets VMCLEAR operate on a freed page that may be reused, yielding a host kernel use-after-free that can be leveraged for arbitrary information disclosure.\nI:H - VMCLEAR writes VMCS state into the freed page; with page reuse this is host heap corruption enabling write primitives and potential host code execution, consistent with UAF guidance.\nA:H - Use-after-free of the shadow VMCS page can oops/panic the host kernel when VMCLEAR or later accessors touch reallocated memory, fully denying host availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64562","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64563","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via local netlink sock_diag dumps (e.g. netlink_diag over NETLINK_SOCK_DIAG) and similar local dump walkers such as TIPC_NL_SOCK_GET; not reachable from remote packet processing.\nAC:L - Attacker controls both sides of the race by running a multi-fragment rhashtable dump while concurrently creating/destroying netlink (or TIPC) sockets to force table resize and free the walked object.\nPR:L - An unprivileged local user can open NETLINK_SOCK_DIAG and dump without CAP_NET_ADMIN; CAP_NET_ADMIN is only required for SOCK_DESTROY, and TIPC_NL_SOCK_GET likewise has no admin permission flag.\nUI:N - Exploitation requires only attacker-issued syscalls (netlink dump plus concurrent socket churn); no victim action is needed.\nS:U - Impact is memory corruption within the host kernel authority (local privilege escalation/crash), not a cross-boundary escape such as guest-to-host or IOMMU bypass.\nC:H - Use-after-free read of a freed hashed object (e.g. netlink_sock) can be reclaimed via heap spray, yielding an arbitrary read primitive through subsequent walk/diag use of the corrupted pointer.\nI:H - UAF on a reclaimable slab object enables heap spraying and fake-object injection into the walk path, which can be leveraged for arbitrary write or control-flow hijacking.\nA:H - The demonstrated KASAN slab-use-after-free in rhashtable_walk_next can oops/panic the kernel, and UAFs remain crashable even when not fully exploited."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64563","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64581","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via setsockopt(IP_XFRM_POLICY/IP_IPSEC_POLICY) on a local socket racing concurrent udp_sendmsg; entry is a local syscall path (do_ip_setsockopt -> xfrm_user_policy), not packet processing.\nAC:L - Attacker controls both sides of the race (one thread setsockopt to clear/apply per-socket xfrm policy, another sendmsg on the same connected UDP socket) and can create the obsolete xfrm_dst precondition in their netns, retrying until the double dst_release wins.\nPR:L - Path requires CAP_NET_ADMIN checked with sockopt_ns_capable(sock_net(sk)->user_ns), which an unprivileged user obtains via user+network namespaces; the fix commit explicitly states this reachability.\nUI:N - Exploitation uses only the attacker's own socket, threads, and setsockopt/sendmsg loops; no victim action or cooperation is required.\nS:U - Double-free/UAF of the socket's dst_entry/xfrm_dst is standard local kernel memory corruption within the host kernel authority, not a VM escape or other cross-boundary impact.\nC:H - Double dst_release frees the xfrm_dst slab object while still referenced, yielding a use-after-free that can be reclaimed/sprayed to disclose kernel memory via corrupted dst contents and ops.\nI:H - The UAF targets a dst_entry with function pointers (ops/input/output) used on transmit, enabling heap reuse for arbitrary write and control-flow hijack consistent with comparable sk_dst_cache races.\nA:H - The KASAN slab-use-after-free in dst_release demonstrates kernel memory corruption that can oops/panic, and the attacker can repeat the race freely."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68121","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in pppoe_sendmsg(), reached only via the local sendmsg() syscall on a PF_PPPOX/PPPoE socket; it is not triggered by remote packet reception or in-kernel PPP transmit paths such as __pppoe_xmit().\nAC:L - Exploitation requires a race between copy_from_user() blocking in sendmsg and changing team header_ops (e.g., adding the first non-Ethernet GRE port), which an attacker can drive with concurrent threads and retries rather than uncontrollable timing.\nPR:L - PPPoE sockets can be created without special privileges, and configuring the team/GRE topology needed to trigger dev_hard_header() head expansion is achievable with CAP_NET_ADMIN inside an unprivileged user/network namespace (unshare -Urn).\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through socket I/O and netlink/rtnl configuration of the team device.\nS:U - Impact is kernel heap corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - Writing PPPoE header fields through a stale pointer after pskb_expand_head() frees the old skb head is a slab use-after-free; freed kmalloc objects can be reclaimed for sensitive data, enabling arbitrary kernel memory disclosure.\nI:H - The post-dev_hard_header() memcpy/ph->length stores up to eight attacker-influenced bytes into freed skb head memory, providing a heap corruption primitive that can be developed into arbitrary kernel writes or code execution.\nA:H - Use-after-free writes into freed slab memory commonly cause kernel oops/panic and can be triggered repeatedly via sendmsg, yielding persistent denial of service even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68121","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68136","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached from the standard NAPI GRO receive path processing remotely originated TCP/IP packets (napi_gro_receive→dev_gro_receive→tcp_gro_receive→skb_gro_receive_list), including tethering/NAT/forwarding scenarios where packets re-enter GRO on a second netdev after driver LRO or prior GRO aggregation.\nAC:L - An attacker can reliably trigger the bug by crafting a TCP stream through a forwarding host with rx-gro-list enabled, without races or victim-specific timing; the commit documents a deterministic tethering/forwarding repro where flush-marked frag_list skbs are re-aggregated and later crash skb_segment.\nPR:N - No local privileges or authentication are required; any remote peer that can send TCP traffic through a vulnerable forwarding/tethering/NAT Linux host can reach the GRO fraglist merge path, which performs no capability or credential checks on the receive path.\nUI:N - Exploitation requires only network-delivered packets and normal kernel forwarding/GRO processing; the victim does not need to open files, mount filesystems, click links, or perform any deliberate action beyond routine network operation.\nS:U - Impact is confined to kernel memory corruption and panic within the same host kernel security domain during packet GRO aggregation and subsequent segmentation on transmit; it does not cross VM, container, or IOMMU boundaries to affect a separate security authority.\nC:H - Double aggregation corrupts the skb frag_list chain (loops, dangling references, NULL/corrupted list_skb pointers), constituting kernel heap memory corruption that can be read during skb_segment processing and is classifiable as a high-impact info-disclosure primitive beyond a simple crash.\nI:H - Re-aggregating flush-marked skbs with existing frag_list corrupts skb linked-list structure and reference relationships in kernel memory, enabling potential control of subsequent skb metadata and write/control-flow primitives during GSO segmentation, not merely integrity-preserving packet drops.\nA:H - Corrupted frag_list state causes skb_segment to dereference a NULL or invalid list_skb via skb_headlen(), producing a kernel panic/oops on the transmit path (sch_direct_xmit/qdisc_run), fully denying availability of the affected system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68136","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68138","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local RTM_NEWTFILTER rtnetlink messages (tc flower filter with police action) through rtnetlink_rcv_msg→tc_new_tfilter→fl_change→tcf_police_init→qdisc_get_rtab/qdisc_put_rtab; no remote packet or network protocol path exists.\nAC:L - cls_flower is TCF_PROTO_OPS_DOIT_UNLOCKED, so concurrent RTM_NEWTFILTER requests run without RTNL; the attacker controls both racing threads/CPUs and can repeatedly install flower filters with identical police rate tables to deterministically hit the global qdisc_rtab_list/refcnt race.\nPR:L - Non-GET rtnetlink handlers require netlink_net_capable(CAP_NET_ADMIN); this is namespace-scoped, so an unprivileged local user obtains CAP_NET_ADMIN via user namespaces (unshare -Urn), sets up clsact/ingress, and installs flower+police rules without init-namespace root.\nUI:N - Exploitation is fully self-contained: the attacker issues the concurrent tc/netlink commands from its own processes and needs no victim to mount filesystems, click links, or perform any other interactive action.\nS:U - Impact is heap corruption and UAF/double-free in kernel kmalloc-2k slabs within the same kernel security authority; although qdisc_rtab_list is global across netns, this is standard kernel memory corruption/privilege escalation, not a VM, IOMMU, or sandbox boundary escape.\nC:H - Concurrent non-atomic refcnt and list updates cause slab use-after-free/double-free of struct qdisc_rate_table (KASAN-confirmed in qdisc_put_rtab); freed 2KB objects are attacker-influenceable via kmalloc timing and are classically weaponizable for arbitrary kernel memory disclosure.\nI:H - The race corrupts a process-global singly linked list and can double-free a kmalloc-2k qdisc_rate_table, yielding classic heap metadata/object corruption primitives that can be developed into arbitrary kernel writes and local privilege escalation/code execution.\nA:H - Demonstrated KASAN slab-use-after-free in qdisc_put_rtab on the error/teardown path, and concurrent double-free of the same rate table can panic the kernel; the trigger is repeatable at will with concurrent netlink requests and causes task death or system-wide instability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68138","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68155","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when libceph decodes CEPH_MSG_MON_MAP from a remote Ceph monitor over the kernel client's established TCP/msgr2 session (mon_dispatch -> ceph_monc_handle_map -> ceph_monmap_decode), which is a network protocol attack surface on CephFS/RBD/cloud nodes.\nAC:L - An attacker who can send monitor protocol messages only needs to set num_mon=0 in the monmap; once accepted, any later session reopen (keepalive timeout, hunt, or connection fault) deterministically hits BUG_ON in pick_new_mon without races or special memory layout.\nPR:N - In the highest-impact scenario a malicious or compromised Ceph monitor (or equivalent authenticated cluster peer) sends the malformed monmap to already-connected kernel clients; the attacker needs no local privileges on the victim host.\nUI:N - After a Ceph client session exists, monmap updates are delivered and processed automatically by the kernel monitor client; no further mount, open, or other victim interaction is required to accept the bad map and later crash on reconnect.\nS:U - Exploitation causes a kernel BUG/panic within the same kernel security domain and does not cross VM, container, IOMMU, or other security boundaries.\nC:N - The failure mode is a BUG_ON assertion in pick_new_mon when num_mon is zero; there is no memory corruption, out-of-bounds access, or other information disclosure primitive on the vulnerable path.\nI:N - Accepting num_mon==0 only stores an empty monmap and later triggers a deliberate kernel BUG; attacker input does not corrupt or modify arbitrary kernel memory or enable code execution.\nA:H - BUG_ON(monc->monmap->num_mon < 1) in pick_new_mon during __open_session causes a kernel oops/panic, fully denying availability of the affected host until reboot."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68155","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68158","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Malformed incremental osdmap data is delivered in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch) to libceph clients (CephFS/RBD), and the overflow is triggered while decoding received network bytes in osdmap_apply_incremental().\nAC:L - A compromised or attacker-controlled monitor/OSD can publish an incremental osdmap with epoch N+1 and a crafted new_state length that wraps the multiply, reliably bypassing bounds checks without races or victim-specific memory layout.\nPR:N - Exploitation requires no privileges on the victim host; a malicious cluster peer or on-path attacker that can deliver forged osdmaps to an already-connected kernel Ceph client needs no local account, capabilities, or user-namespace tricks.\nUI:N - Once a host is a Ceph client, osdmap subscriptions and updates are applied automatically by the kernel; no additional mount, open, or interactive step is needed at exploit time beyond the existing client session.\nS:U - Impact is confined to kernel memory and libceph client state on the Ceph client host (info leak, map corruption, crash, or privilege escalation); it does not cross VM, IOMMU, or sandbox boundaries to another security authority.\nC:H - Integer-overflow bypass lets decode_new_up_state_weight() run bare ceph_decode_32/8 loops past the message end, performing out-of-bounds reads of adjacent kernel heap/slack memory that can disclose pointers and other sensitive data.\nI:H - Misaligned decoding also drives attacker-controlled osd/xorstate/weight values into map->osd_weight[], map->osd_state[], and map->osd_addr[] updates (including memset), corrupting kernel osdmap state in ways usable for further exploitation.\nA:H - Unbounded out-of-bounds reads while parsing osdmaps can fault on unmapped pages and trigger kernel oops/panic; map corruption can also cause persistent client failure, repeatable on each malicious incremental map."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68158","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68159","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Malicious pg_temp/pg_upmap data arrives in CEPH_MSG_OSD_MAP from a Ceph monitor or OSD over TCP, is decoded in libceph, and later triggers stack corruption in ceph_pg_to_up_acting_osds during RBD/CephFS/libceph client I/O.\nAC:L - A compromised or attacker-controlled monitor can publish osdmap entries with length >32 for chosen PGs; once the client subscribes, kernel I/O paths such as RBD mount/probe via calc_target deterministically invoke apply_upmap/get_temp_osds and overflow the stack buffer.\nPR:N - Exploitation requires no privileges on the victim host; any machine acting as a Ceph client that receives a forged osdmap from a cluster peer over the network can be attacked without local user capabilities or namespace tricks.\nUI:N - No victim user action is needed during exploitation beyond the host already being a Ceph client; forged osdmaps are applied automatically and the overflow fires on subsequent kernel client operations without interactive steps.\nS:U - Impact is confined to kernel memory on the Ceph client host (privilege escalation or crash); it does not cross VM, IOMMU, or sandbox boundaries to other security authorities.\nC:H - KASAN-confirmed stack out-of-bounds write in ceph_pg_to_up_acting_osds corrupts adjacent stack memory and can be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Unbounded copy loops in apply_upmap() and get_temp_osds() write attacker-controlled u32 OSD IDs past the fixed osds[CEPH_PG_MAX_SIZE] stack array, enabling control-flow hijack and arbitrary kernel writes.\nA:H - The reported reproducer triggers KASAN stack-out-of-bounds followed by kernel BUG in ceph_pg_to_up_acting_osds, demonstrating a reliable kernel oops or panic from malformed osdmap processing on Ceph clients."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68159","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68160","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - CEPH_MSG_CLIENT_CAPS is received over the kernel Ceph messenger TCP connection from an MDS peer; mds_dispatch() passes it directly to ceph_handle_caps(), so a malicious or compromised MDS (or on-path attacker on an unsigned msgr session) reaches the bug with network data alone.\nAC:L - The attacker fully controls msg->hdr.version and snap_trace_len in the caps header; setting version=1 bypasses all version-gated decoders and snap_trace_len=0xFFFFFFFF yields a fake end pointer that reliably defeats ceph_decode_need(), with no race or memory-layout dependency.\nPR:N - Exploitation requires only the ability to send crafted caps messages as the remote MDS peer on an established session; the attacker needs no account, mount privilege, or other credentials on the victim host beyond the client already being connected to that cluster.\nUI:N - Once CephFS is mounted and the MDS session is open, CEPH_CAP_OP_IMPORT caps messages are delivered and processed automatically during normal cap migration and MDS failover; no additional local user action is needed at exploit time beyond prior cluster connectivity.\nS:U - The out-of-bounds read and resulting snap-realm corruption affect only the kernel CephFS client’s internal state within the same kernel security authority; there is no VM escape, sandbox breakout, or cross-authority boundary crossing.\nC:H - ceph_update_snap_trace() decodes struct ceph_mds_snap_realm and snap arrays using an attacker-supplied fake end pointer, reading sizeof(*ri) and further attacker-influenced extents past the legitimate msg->front buffer into adjacent kernel memory without copying to userspace.\nI:H - Out-of-bounds kernel memory is interpreted as snap-realm metadata and copied via dup_array() into newly allocated kernel heap structures (realm->snaps, realm->prior_parent_snaps), corrupting authoritative snap state and providing a memory-corruption primitive that could be leveraged for further kernel compromise.\nA:H - Out-of-bounds reads can fault on unmapped pages causing a kernel oops; the ceph_update_snap_trace() error path issues WARN(1), fences I/O via CEPH_MOUNT_FENCE_IO, and can close all MDS sessions—effects an attacker can trigger repeatedly at will."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68160","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68202","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through ioctls on the local character device /dev/snd/seq (SNDRV_SEQ_IOCTL_CREATE_QUEUE/DELETE_QUEUE/SET_QUEUE_CLIENT); no network or adjacent-network path exists to the ALSA sequencer.\nAC:L - The attacker controls both sides of the race — one thread deletes the queue while another spins on SET_QUEUE_CLIENT holding a queueptr() reference — and can retry the loop indefinitely on a default kernel with CONFIG_SND_SEQUENCER, so the window is reliably hit.\nPR:L - Only an unprivileged local user able to open /dev/snd/seq is needed; snd_seq_queue_use() performs no owner or access check and no capability is required, as the fix commit states explicitly.\nUI:N - The attacker's own threads create, delete and re-use the queue and the global system timer fires on its own; no victim action is involved.\nS:U - The use-after-free corrupts kernel heap objects within the same kernel security authority, giving at most kernel privilege escalation rather than crossing a VM, IOMMU or sandbox boundary.\nC:H - The stale timer instance dereferences the freed snd_seq_queue and snd_seq_timer, reading tick/time fields and freed prioq pointers that can be reclaimed by attacker-sprayed objects, giving a route to disclose arbitrary kernel memory.\nI:H - snd_seq_timer_interrupt() writes cur_time, tick and last_update into the freed snd_seq_timer slab and snd_seq_check_queue() dispatches events through freed queue pointers, yielding a controllable write primitive on reclaimed heap memory suitable for privilege escalation.\nA:H - Even unexploited, the timer callback derefs freed memory and takes a spinlock in a freed object from interrupt context, causing oops, lock corruption or panic — a repeatable denial of service for any local user."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68202","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68397","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handler is registered via dev_add_pack() for ethertype ETH_P_AF_IUCV (0xFBFB) on every netdevice, so any peer LPAR/guest on the same HiperSockets internal LAN or any host on an attached Ethernet segment can drive afiucv_hs_rcv() with crafted frames; the frames are raw L2 and cannot be routed across an IP hop, so the vector is adjacent rather than network.\nAC:L - The attacker controls the packet side of the race outright (flooding 0xFBFB frames) and can drive the freeing side too, since SYN frames make a listener spawn and enqueue child sockets while FIN/SYN|FIN frames push sockets to IUCV_DISCONN and wake the application into close(), so the read_unlock()-to-handler window can be retried indefinitely until won.\nPR:N - afiucv_hs_rcv() runs from the netif RX softirq and processes any matching frame with no authentication, credential check, or capability test anywhere on the path; the attacker needs no account or privilege on the target s390 system.\nUI:N - No victim action is required: the attacker's own frames both create the AF_IUCV child sockets and trigger the state changes that lead to their teardown, and the packet handler runs unconditionally in softirq context.\nS:U - The freed struct sock and the resulting corruption stay inside the kernel of the affected LPAR or z/VM guest; no hypervisor, IOMMU, or container boundary is crossed.\nC:H - This is a use-after-free on a socket allocated from a generic kmalloc cache (iucv_proto is registered without its own slab), so an attacker who reclaims the object has the kernel read attacker-influenced or stale heap contents through sk fields, sk_filter()'s BPF program pointer, and the iucv backlog queues, yielding kernel memory disclosure.\nI:H - After the free the handlers perform indirect calls through the freed object (sk->sk_data_ready(), sk->sk_state_change(), sk_filter()) and writes into it (sk_state, atomic_sub on iucv->msg_sent, skb_queue_tail() list-pointer updates), giving control-flow hijack and write primitives once the slab object is reclaimed with attacker-controlled data.\nA:H - Dereferencing the freed socket from softirq context reliably produces an oops or \"Fatal exception in interrupt\" panic, and the attacker can repeat the frame flood at will, causing complete loss of availability of the IBM Z LPAR or guest."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68397","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68398","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The free side of the race is a local close() of the pppol2tp socket, which no remote peer can invoke; the full attack (create tunnel/session via AF_PPPOX socket, drive RX with loopback UDP datagrams, close concurrently) is performed entirely through local syscalls.\nAC:L - The attacker controls both sides of the race, feeding the UDP-encap RX softirq from one thread while closing the pppox socket on another, and can retry the loop indefinitely until the window is hit.\nPR:L - No capability check exists on this path: pppox_create()/pppol2tp_connect() and ppp_register_net_channel() need no CAP_NET_ADMIN, and PPPIOCGCHAN is handled by pppox_ioctl() on the socket itself, so /dev/ppp access is not required; the fix commit states the bug is reachable by an unprivileged user.\nUI:N - The attacker performs every step — socket creation, session setup, packet injection and close() — with no action by any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the channel is freed and its slab object reallocated, ppp_input() reads pch->bridge and pch->ppp from attacker-groomed memory and can route received frames to an arbitrary attacker-chosen structure, giving a path to disclosing kernel memory.\nI:H - skb_queue_tail(&pch->file.rq, skb) writes a linked-list insertion into the freed object and wake_up_interruptible(&pch->file.rwait) traverses a freed waitqueue, so heap grooming yields controlled writes and function-pointer traversal usable for privilege escalation.\nA:H - Dereferencing and writing to the kfree()d struct channel from softirq context reliably corrupts the slab and panics or oopses the kernel, and the race can be re-triggered at will."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68398","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68417","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access to the RDMA character devices (/dev/infiniband/uverbsN for create_qp and /dev/infiniband/rdma_cm for the QPN lookup); no network packet reaches the racing code path without a local trigger first.\nAC:L - The attacker controls both sides of the race: one thread issues create_qp while another issues rdma_connect/rdma_accept with an attacker-supplied qp_num, and QPNs from xa_alloc(XA_FLAGS_ALLOC1) are predictable. The post-publish failure can be made deterministic by passing a short udata->outlen, so the window is wide and repeatable at will.\nPR:L - Any unprivileged local user with access to the siw uverbs and rdma_cm character devices can create QPs and issue rdma_connect/rdma_accept with an arbitrary qp_num; no capability check gates siw_create_qp, siw_connect or siw_accept.\nUI:N - The attacker drives both the QP creation and the concurrent QPN lookup from its own threads; no action by any other user or administrator is needed.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU or sandbox boundary.\nC:H - The siw_qp object can be kfree'd by the ib core error path while the CM thread still holds a reference, giving a use-after-free on a slab object the attacker can groom and read back through QP/CM state, enabling disclosure of arbitrary kernel memory.\nI:H - After the free, siw_free_qp() performs list_del(&qp->devq), vfree() of four pointer fields and siw_put_tx_cpu(qp->tx_cpu) using values read from reallocated attacker-controlled memory, yielding arbitrary-pointer free, list-unlink writes and out-of-range per-CPU decrements suitable for control-flow hijacking.\nA:H - Even without exploitation the race reliably causes kernel crashes: NULL sendq/recvq/scq/rcq dereferences, list_del on an uninitialized devq head, waits on an uninitialized qp_free completion, and use-after-free oopses."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68417","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68426","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPsec transmit path (validate_xmit_xfrm) which processes any skb routed into an offloaded SA, including GRO-aggregated traffic forwarded from remote hosts on an IPsec gateway; xfrm_dev_offload_ok() has no socket/local-origin requirement, so a remote peer's packet stream drives the vulnerable GSO segmentation and async-crypto steal directly.\nAC:L - The attacker drives both preconditions with traffic alone: sustained large GSO flows keep the crypto engine backlogged so ->xmit() returns -EINPROGRESS routinely, and packet volume advances xo->seq.low toward the wrap that forces segmentation; each stolen trailing segment reproduces the stale skb->prev, and the subsequent tail->next write is deterministic once it occurs.\nPR:N - On an IPsec gateway the traffic that triggers the path is forwarded from remote, unauthenticated senders — no account, credentials, or capability on the target host is needed, since the SA and offload are pre-existing administrative configuration rather than something the attacker must set up.\nUI:N - No victim action is required; the vulnerable code runs automatically in softirq context on every qualifying transmit, driven purely by the attacker's packet stream.\nS:U - The corruption is of kernel sk_buff list state within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Writing through the stale ->prev is a use-after-free on an skb whose memory the attacker can influence via heap grooming with concurrent traffic; per kernel UAF guidance this yields a high-confidentiality primitive, and the corrupted list can splice engine-owned skbs into the transmit path, exposing freed/reused memory contents on the wire.\nI:H - tail->next = skb is an attacker-influenced pointer write into freed heap memory, and the resulting skb list corruption lets live and engine-owned skbs be chained together; this is classic heap corruption that can be shaped via spraying into an arbitrary write or control-flow hijack.\nA:H - Even without full exploitation the use-after-free write and the double-ownership of a stolen segment cause list corruption, double-free/oops and kernel panic in the softirq transmit path, taking down the gateway."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68426","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72020","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when a host running the IPVS backup sync receiver processes forged UDP sync datagrams (default multicast 224.0.0.81:8848) in ip_vs_process_message(), which is a network packet receive path rather than a local-only ioctl/netlink interface.\nAC:L - Once IPVS backup sync is enabled, an attacker can reliably send IPVS v1 messages that set IP_VS_CONN_F_IN_SEQ/OUT_SEQ while omitting IPVS_OPT_SEQ_DATA; no race, heap grooming, or victim-specific state beyond matching syncid (often 0) is required.\nPR:N - The backup sync socket accepts unauthenticated UDP input with no capability checks; only an optional syncid filter (frequently left at 0) may drop messages, so the attacker needs no Linux privileges to inject the malformed sync records.\nUI:N - No end-user or administrator interaction is required at exploit time; the attacker directly delivers crafted sync messages to the listening backup daemon without victims opening files, clicking links, or changing settings.\nS:U - Exploitation stays within the IPVS load balancer kernel/network authority and affects connections it forwards; it does not constitute a VM escape, sandbox breakout, or cross-security-authority boundary such as guest-to-host.\nC:H - Uninitialized ip_vs_seq init_seq and previous_delta fields retain stale slab data that vs_fix_seq()/vs_fix_ack_seq() apply when rewriting forwarded TCP seq/ack numbers, leaking kernel heap bytes onto the network to clients or backend servers.\nI:H - Those same uninitialized sequence-adjustment fields cause incorrect TCP sequence/ack rewriting in NAT/application-helper paths (ip_vs_app_pkt_in/out), corrupting load-balanced TCP flows and enabling attacker-driven manipulation of forwarded traffic integrity.\nA:H - Corrupted TCP sequence handling breaks or resets connections on the virtual service and can be triggered repeatedly via additional forged sync messages, causing sustained denial of service to load-balanced traffic on the affected backup node."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72020","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72069","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On CONFIG_PREEMPT_RT, every spin_unlock() is substituted by rt_spin_unlock(); network subsystems such as netfilter xt_hashlimit process inbound packets through hashlimit_mt_common(), spin_lock/unlock on RCU-protected dsthash_ent objects concurrently freed via call_rcu by GC—the exact embedded-spinlock UAF pattern from the fix.\nAC:L - The bug is a cross-CPU race where rt_spin_unlock() calls rcu_read_unlock() before releasing the rtmutex, ending the RCU grace period while still dereferencing the lock; syzbot triggered this reliably on PREEMPT_RT via concurrent unlinkat and dentry teardown, and attackers control both sides with parallel syscalls or packet/GC load.\nPR:N - Remote attackers need no account, capability, or authentication to send packets that hit deployed hashlimit rules on internet-facing PREEMPT_RT gateways; the proven syzbot unlinkat path needs only directory write permission (PR:L), but PR:N reflects the highest-severity unauthenticated network packet scenario.\nUI:N - No victim interaction is required; the attacker drives the race through their own concurrent filesystem syscalls (syzbot: unlinkat racing __fput/dentry_kill) or sustained inbound traffic overlapping netfilter GC, without needing another user to open files or mount filesystems.\nS:U - The UAF corrupts kernel slab memory containing embedded spinlock/rtmutex fields and enables privilege escalation within the same kernel security authority; it does not inherently cross VM/guest, container sandbox, or IOMMU hardware isolation boundaries.\nC:H - Syzbot reported KASAN slab-use-after-free Read in rt_mutex_slowunlock during spin_unlock on a freed dentry in shrink_dcache_tree; the systemic UAF lets attackers read freed objects (dentry, dsthash_ent, etc.) after premature RCU grace-period completion, enabling kernel pointer and memory disclosure.\nI:H - UAF on embedded rtmutex fields inside freed slab objects (dentry->d_lock per syzbot) permits heap grooming and reallocation of attacker-controlled data, providing standard kernel heap corruption primitives for arbitrary write and control-flow hijack beyond the immediate crash.\nA:H - Syzbot hit KASAN slab-use-after-free causing kernel fault in shrink_dcache_tree via rt_spin_unlock on PREEMPT_RT; the bug can oops/panic any RT kernel whenever spin_unlock races RCU-deferred free of the containing object, enabling repeatable denial of service via concurrent VFS or netfilter operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72069","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72072","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is reached by racing MACSEC_CMD_DEL_RXSC/ADD_RXSC netlink configuration (GENL_ADMIN_PERM) against mlx5e MACsec RX processing; the privileged genlink/rtnl control path is required to trigger the bug, not remote packets alone.\nAC:L - An attacker with CAP_NET_ADMIN can drive both sides by looping RX SC add/delete while flooding MACsec-offloaded RX traffic on the mlx5e netdev, reliably winning the RCU race between xa_load/dst_hold and metadata_dst_free.\nPR:L - MACsec offload mutations require GENL_ADMIN_PERM (CAP_NET_ADMIN); on Mellanox ConnectX/BlueField systems this is reachable by cloud tenants with SR-IOV VFs, containers, or user/network namespaces without init-namespace root.\nUI:N - No victim user action is needed; automated concurrent netlink MACsec operations and incoming MACsec-offloaded frames on an active mlx5e interface suffice once MACsec offload is configured.\nS:U - Impact is kernel heap use-after-free and memory corruption within the host kernel on the mlx5 NIC; it enables local privilege escalation but does not by itself cross VM, IOMMU, or hypervisor security boundaries.\nC:H - The race calls dst_hold() and skb_dst_set() on a freed metadata_dst, a classic slab UAF that can disclose kernel memory through subsequent dst_entry and MACsec skb metadata handling.\nI:H - Freed metadata_dst objects can be reallocated via heap spraying while the RX datapath still references them, enabling refcount corruption and arbitrary kernel memory writes or control-flow hijack beyond a mere crash.\nA:H - Concurrent use of freed md_dst during mlx5e MACsec RX processing can cause immediate kernel oops, BUG, or panic on datacenter/cloud hosts using mlx5 hardware MACsec offload, fully denying system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72072","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72083","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On LIO/iSCSI storage servers and appliances, a remote initiator sends PERSISTENT_RESERVE_OUT with REGISTER AND MOVE over TCP (port 3260); iscsit_process_scsi_cmd()→target_execute_cmd()→target_scsi3_emulate_pr_out()→core_scsi3_emulate_pro_register_and_move() with no local access required.\nAC:L - The attacker fully controls the PR-OUT parameter list length (>4096 to force vmap/vunmap), iSCSI TransportID format 01b with ISID, and can establish prerequisite PR registration and reservation via prior SCSI commands on the same session; no uncontrollable race or layout dependency exists.\nPR:N - Exploitation requires only the ability to act as a network SCSI/iSCSI client with LUN access to an exported target; no Linux UID, capability, or init-namespace root on the storage server is needed—only standard iSCSI initiator connectivity (CHAP/ACL when configured).\nUI:N - Triggering is fully automated once an iSCSI session exists: the attacker issues scripted REGISTER, RESERVE, then REGISTER AND MOVE commands with a crafted >4 KiB parameter list; no victim mount, click, or other interactive action is required.\nS:U - The UAF corrupts kernel heap state inside the target-core PR handler on the storage host; impact stays within that kernel security domain and does not inherently cross VM, container, or IOMMU boundaries (standard host compromise, not escape).\nC:H - After vunmap(), iport_ptr aliases freed kernel virtual address space and is dereferenced in strcmp(), __core_scsi3_locate_pr_reg(), and snprintf() into pr_reg_isid; per kernel CVSS guidance, UAF reads enable arbitrary kernel memory disclosure when uncertain.\nI:H - UAF reads of attacker-influenced unmapped PR-OUT data drive strcmp-based registration matching and snprintf copies into persistent kernel pr_reg structures; memory corruption/UAF is scored High for integrity because it can be leveraged for control-flow or state manipulation.\nA:H - Dereferencing iport_ptr after transport_kunmap_data_sg() vunmap() on multi-page buffers causes immediate invalid kernel virtual address accesses (oops/panic) on every qualifying REGISTER AND MOVE; UAF availability impact is High per kernel guidance even before full exploit development."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72083","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72084","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered by a PERSISTENT RESERVE OUT SCSI command delivered over the LIO iSCSI target fabric (TCP/3260); remote initiators reach `iscsi_parse_pr_out_transport_id()` after login and normal SCSI command processing, and the fix commit notes the same path via vhost-scsi-backed exports.\nAC:L - An attacker fully controls the PR-OUT parameter list and can reliably supply a FORMAT CODE 01b iSCSI TransportID without a \",i,0x\" separator or NUL terminator and size it past one page so `strstr()` over-reads into the vmalloc guard page; no races or victim-specific memory layout are required.\nPR:N - Exploitation requires only completing iSCSI login to an exported LUN as any initiator client, not host administrator privileges; LIO demo mode auto-provisions initiator ACLs and many storage appliances expose iSCSI targets to the network without mapping this to elevated OS credentials.\nUI:N - No end-user or administrator action beyond normal automated iSCSI target operation is needed; a remote initiator can send the malicious PR OUT command directly once a session to the LUN exists.\nS:U - The flaw corrupts or reads kernel memory and crashes the target host kernel within the same kernel security boundary; it does not by itself cross a VM, container, or IOMMU isolation boundary to another authority.\nC:H - Unbounded `strstr()` and an unbounded `%s` on the error path perform out-of-bounds reads past the received PR-OUT buffer, potentially disclosing adjacent kernel memory before the fault, matching CVSS guidance for out-of-bounds reads beyond a few bytes.\nI:H - A malformed TransportID can leave the ISID pointer one byte past the descriptor so subsequent registration code dereferences out of bounds, and the ISID normalization loop can write with `tolower()` beyond the buffer, giving a memory-corruption primitive in kernel context.\nA:H - The over-read into a multi-page vmalloc mapping hits the guard page and triggers a KASAN vmalloc-out-of-bounds fault and kernel oops, remotely denying service to the host and all consumers of the iSCSI target."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72123","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local BCM socket syscalls (sendmsg with RX_SETUP/SETTIMER/ival2 throttling and RX_DELETE); CAN frames can be injected locally via loopback without physical bus access.\nAC:L - The attacker controls both sides of the race by concurrently issuing RX_DELETE teardown and delivering matching CAN frames (e.g., via threads or paired BCM/RAW sockets), making the thrtimer re-arm UAF reliably triggerable.\nPR:L - No kernel capability check gates AF_CAN/CAN_BCM socket creation or bcm_sendmsg opcodes; any unprivileged local user with socket access (including via user namespaces with vcan) can reach the vulnerable path.\nUI:N - No victim interaction is required; the attacker self-triggers the race through their own BCM socket operations and locally injected CAN traffic.\nS:U - Impact is confined to kernel memory corruption and local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM or IOMMU bypass.\nC:H - The thrtimer UAF dereferences freed bcm_op fields (locks, frame buffers, op->sk) in bcm_rx_thr_handler/bcm_send_to_user, enabling attacker-controlled heap reuse and arbitrary kernel memory disclosure.\nI:H - UAF on the bcm_op slab object allows heap spraying to corrupt function pointers, timers, and sock structures, providing a standard path to arbitrary kernel writes and local privilege escalation.\nA:H - The freed-op dereference in the hrtimer softirq path causes kernel oops/panic under normal exploitation attempts, and successful memory corruption can crash or hang the system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72123","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72135","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local pread()/write() syscalls on /dev/tpm0 or /dev/tpmrm0 character devices; there is no network, Bluetooth, or physical-bus code path to the vulnerable tpm_common_read() handler.\nAC:L - An attacker who can open the device reliably triggers the bug by writing any TPM command to create a pending response, then calling pread() with a large offset; no races or special memory layout are required.\nPR:L - Upstream tpm2-tss udev rules grant non-root users in the tss group read/write access to /dev/tpmrm0 (mode 0660), which is the standard TPM2 user-space interface on laptops and servers with TPM hardware.\nUI:N - No victim interaction is required; the attacker opens the TPM device, submits a command, and issues the malicious pread() themselves without relying on another user to mount, click, or configure anything.\nS:U - The vulnerability corrupts kernel heap memory in the TPM driver on the same host; it does not by itself cross a VM, container, or IOMMU security boundary to affect a different trust domain.\nC:H - Unchecked pread offsets cause copy_to_user() to read beyond the 4096-byte data_buffer into adjacent kmalloc slab memory (including tpm_space pointers), leaking kernel heap contents to userspace.\nI:H - A successful out-of-bounds pread also executes memset() past data_buffer, zeroing adjacent heap objects such as tpm_space session/context pointers and enabling further memory corruption or control-flow manipulation.\nA:H - KASAN reports slab-out-of-bounds faults on both the copy_to_user read and memset write; corrupting adjacent heap structures can oops or panic the kernel during subsequent TPM operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72135","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72221","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Reachable over TCP by any remote peer of an in-kernel NFS/RPC server (nfsd) via the pre-auth RPC_AUTH_TLS NULL-procedure STARTTLS path that invokes svc_tcp_handshake() on the accepted SUNRPC transport.\nAC:L - The attacker controls both sides of the race by timing TLS client handshake messages against the fixed 5-second SVC_HANDSHAKE_TO and opening many parallel connections to reliably hit the cancel-lost window.\nPR:N - No credentials or export authorization are required; svcauth_tls_accept() accepts empty AUTH_TLS on RPC NULL from any TCP client, and svcauth_unix_set_client() skips IP export checks when rq_proc==0.\nUI:N - Exploitation requires only scripted network connections and TLS client traffic to nfsd; no victim user interaction such as mounting a filesystem or opening a file is needed.\nS:U - Memory corruption occurs in nfsd kernel worker context on the same host; impact is kernel privilege compromise within the server security authority, not a VM escape or IOMMU boundary bypass.\nC:H - A second svc_tcp_handshake() can call init_completion() while svc_tcp_handshake_done() concurrently calls complete_all(), corrupting the embedded swait_queue in heap-allocated svc_sock and enabling arbitrary kernel memory disclosure.\nI:H - Corrupting completion wait-queue metadata in the svc_sock heap object can be leveraged for arbitrary kernel writes and control-flow hijacking to achieve local privilege escalation on the NFS server.\nA:H - The swait_queue corruption can trigger kernel oops/panic, and the alternate race path tears down connections whose TLS handshake is about to succeed, enabling repeatable remote denial-of-service against nfsd."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72221","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72222","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in nfsd's server-side SUNRPC/TCP TLS handshake (net/sunrpc/svcsock.c), reached when a remote peer connects to port 2049 and sends a pre-authentication AUTH_TLS NULL STARTTLS probe that triggers svc_tcp_handshake() via svcauth_tls_accept().\nAC:L - The attacker controls both sides of the race by initiating AUTH_TLS handshakes and concurrently resetting/closing TCP or waiting for SVC_HANDSHAKE_TO while tlshd delivers completion; repeated parallel connections make the overlap window reliably reachable.\nPR:N - AUTH_TLS is processed on RPC procedure 0 before credentials are verified, so an unauthenticated remote client can reach svc_tcp_handshake() and the asynchronous callback without any account, export access, or kernel capability.\nUI:N - nfsd worker threads automatically accept the TCP connection, process the STARTTLS probe, run the TLS handshake, and handle teardown/completion callbacks without any local user or administrator action.\nS:U - Exploitation corrupts kernel memory on the NFS server host itself and does not cross a VM-guest/host, sandbox, or IOMMU security boundary; impact stays within the kernel's security authority.\nC:H - svc_tcp_handshake_done() use-after-frees svc_sock and performs set_bit/clear_bit RMW on freed xpt_flags plus complete_all() on freed sk_handshake_done, a slab-corruption UAF that can disclose arbitrary kernel memory.\nI:H - The same UAF delivers attacker-timed writes into reclaimed slab slots through atomic bit operations and wait-queue list updates, enabling heap grooming and further kernel memory corruption for arbitrary modification or code execution.\nA:H - Slab corruption and UAF during handshake completion can cause kernel oops/panic, and unauthenticated remote peers can trigger the fault repeatedly by overlapping TLS handshake completion with connection close."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72222","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72251","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit in nf_nat_sip() from sip_help_udp/tcp() during nf_confirm() on POST_ROUTING/LOCAL_IN while processing attacker-supplied SIP/UDP or SIP/TCP packets traversing a netfilter NAT gateway, so exploitation is via remote network traffic rather than local syscalls or physical access.\nAC:L - Once nf_conntrack_sip and nf_nat_sip are active on a NATed SIP flow, a remote peer can set forced_dport with a crafted Via header and drive the reply-path skb_ensure_writable() reallocation on cloned skbs without races or rare layout luck.\nPR:N - Exploitation needs no privileges on the victim kernel; a remote SIP endpoint only has to send malicious SIP through an already-configured SIP conntrack/NAT helper, with no authentication or local access to the firewall or router.\nUI:N - No victim user action is required beyond normal automated packet forwarding; the SIP helper parses and NAT-rewrites attacker-supplied SIP data in softirq during connection-tracking confirmation without opening files, clicking links, or mounting filesystems.\nS:U - Impact stays within kernel netfilter/conntrack memory on the same security authority (for example a NAT firewall, SBC, or VoIP gateway). This is standard kernel memory corruption, not a VM escape, sandbox breakout, or cross-tenant boundary violation.\nC:H - skb_ensure_writable() can free the old linear buffer while *dptr still points into it; sip_help_tcp() then continues parsing with that stale pointer, giving a use-after-free read of freed skb data and enabling disclosure of adjacent kernel heap contents.\nI:H - The stale dptr UAF and, on TCP flows, mistaken nf_nat_mangle_udp_packet() header rewriting corrupt kernel packet-buffer memory; such heap corruption is exploitable with grooming for arbitrary writes, control-flow hijacking, and kernel code execution.\nA:H - Use-after-free and mis-mangled L4 headers during softirq SIP NAT processing can trigger kernel oops/panic or reliably drop or corrupt in-flight VoIP signaling, causing high availability impact on internet-facing NAT/SBC systems handling SIP."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72251","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72262","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl on /dev/snd/controlC* (SNDRV_CTL_IOCTL_TLV_WRITE/READ) through the ALSA control device; there is no network, adjacent-radio, or physical-bus attack surface for this SOF IPC3 kcontrol path.\nAC:L - On affected SOF IPC3 systems with topology bytes_ext controls, an attacker can deterministically trigger the bug by issuing TLV writes with header.length equal to max_size, causing copy_from_user/memcpy to overrun the kzalloc(max_size) buffer by sizeof(struct sof_ipc_ctrl_data).\nPR:L - The fix commit states the overflow is reachable from unprivileged userspace via ALSA TLV kcontrols; any local user who can open the sound control device (typically membership in the audio group on Linux, or an app with audio access on Android/ChromeOS) can reach the vulnerable code without real root.\nUI:N - Exploitation is performed entirely by the attacker issuing ALSA TLV ioctls against an existing bytes_ext kcontrol; no victim click, mount, or other interactive action beyond the attacker's own access to the sound control interface is required.\nS:U - The vulnerability corrupts kernel heap memory from a local userspace context and enables standard kernel privilege escalation or denial of service; it does not cross a VM, container, or IOMMU security boundary into a separate authority.\nC:H - The get path can copy_to_user up to sizeof(struct sof_ipc_ctrl_data) bytes beyond the allocated ipc_control_data buffer, leaking adjacent kernel heap contents; combined with the controllable overflow, this is an out-of-bounds read/memory corruption primitive consistent with arbitrary disclosure potential.\nI:H - The put path performs an out-of-bounds heap write of up to sizeof(struct sof_ipc_ctrl_data) bytes past the kzalloc(max_size) allocation (including via the err_restore memcpy), enabling heap metadata/object corruption that can be developed into arbitrary kernel write or code execution.\nA:H - Heap out-of-bounds writes of roughly 96 bytes into adjacent slab objects can corrupt kernel structures and trigger oops/panic or wedged audio/subsystem state; repeated TLV operations make denial of service reliably achievable even without full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72262","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72288","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached only from KVM guest MMIO traps on GICv3 redistributor GICR_CTLR LPI-disable writes, ITS MOVI affinity changes, and vCPU-exit paths into vgic_prune_ap_list(); no network-facing host protocol is involved.\nAC:L - A guest controls all three racing vCPUs by pinning threads to concurrently issue ITS MOVI, cross-vCPU GICR_CTLR LPI-disable writes, and vCPU exits that invoke vgic_prune_ap_list(); the attacker creates and wins the race rather than depending on uncontrollable host timing.\nPR:N - No host privileges are required beyond running code in an assigned KVM guest (e.g. a cloud VM tenant on arm64); exploitation needs guest-kernel access to GIC/ITS MMIO, not host root or capabilities in the init namespace.\nUI:N - Exploitation is fully attacker-driven from within a multi-vCPU guest VM and does not require any victim user or administrator action on the host.\nS:C - The use-after-free corrupts host-kernel heap memory (struct vgic_irq) from guest-controlled VGIC operations, crossing the guest-to-host virtualization security boundary with VM-escape impact.\nC:H - vgic_flush_pending_lpis() can free the LPI vgic_irq while vgic_prune_ap_list() still dereferences it after reacquiring dropped locks, yielding a kernel heap use-after-free exploitable for arbitrary host memory disclosure via heap grooming.\nI:H - The dangling vgic_irq pointer permits attacker-influenced writes through irq_lock, list_head, vcpu, and target_vcpu fields during ap_list migration, enabling host control-flow or data corruption primitives.\nA:H - The race frees live kernel objects still referenced by the ap_list migration path, causing host kernel oops, panic, or hang during list_del, lock operations, or subsequent LPI delivery on arm64 KVM hosts."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72288","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72289","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only from KVM guest execution paths—GICv3 redistributor GICR_CTLR LPI-disable MMIO traps into vgic_flush_pending_lpis() and vCPU exit/sync paths into vgic_prune_ap_list()—not from any remote network, adjacent-radio, or physical-device interface on the host.\nAC:L - A malicious multi-vCPU guest controls both racing sides by pinning threads, changing LPI affinity via ITS so an interrupt must migrate off one vCPU's ap_list, and concurrently disabling LPIS on that redistributor; the attacker creates the window rather than depending on uncontrollable host timing or memory layout.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant on arm64 KVM who needs no host privileges beyond code already running inside the assigned guest; exploitation uses guest-kernel GIC MMIO/ITS operations, not host root, CAP_SYS_ADMIN in the init namespace, or additional /dev/kvm access beyond having a VM.\nUI:N - Exploitation is fully attacker-driven from within the guest VM through deliberate LPI setup, affinity changes, and timed GICR_CTLR writes; no victim user or administrator action on the host is required beyond normal VM operation.\nS:C - Double list_del()/list_add_tail() on host-kernel ap_list linkages corrupts KVM VGIC state from guest-controlled interrupt operations, crossing the guest-to-host virtualization security boundary with VM-escape-class impact rather than confining damage to the attacker's VM.\nC:H - Corrupting detached ap_list pointers and inserting them into another vCPU's ap_list_head enables out-of-bounds kernel linked-list traversal and disclosure of adjacent kmalloc slab memory (struct vgic_irq and neighboring objects); per kernel guidance, this list corruption is leverageable for arbitrary host memory read primitives.\nI:H - The vulnerable path performs list_del() on an already removed entry and may follow with list_add_tail() onto another vCPU's ap_list, letting a guest steer kernel list pointers and overwrite adjacent vgic_irq/host heap metadata for control-flow or data corruption on the hypervisor.\nA:H - Re-running list_del() on an entry already removed by vgic_flush_pending_lpis() dereferences poisoned list pointers and corrupts live ap_list_heads, causing immediate host kernel BUG/oops/panic or persistent interrupt-delivery failure during subsequent VGIC processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72289","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72317","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in the SUNRPC TCP-with-TLS client connect_worker processing a remote NFS server's TLS handshake; a malicious or misconfigured server can induce fatal handshake failure over the network before the delayed worker runs, matching network-reachable kTLS/RPC-with-TLS client paths.\nAC:L - An attacker operating a reachable NFS endpoint can reliably cause fatal TLS handshake failure (e.g., reject mTLS client certificates or send TLS alerts) and influence reconnect timing/backoff so client teardown frees rpc_clnt before the queued connect_worker executes.\nPR:N - Exploitation requires no privileges on the victim host; a remote peer only needs the client kernel to initiate or re-establish an NFS RPC-with-TLS connection, and TLS handshake processing occurs before NFS authentication completes.\nUI:N - No further victim action is needed once an NFS xprtsec=tls/mtls mount exists because automatic reconnect after server-induced disconnect or handshake failure can trigger the race without additional user interaction.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is standard local kernel compromise rather than crossing VM, container, or IOMMU security scopes.\nC:H - This is a kernel heap use-after-free where xs_tcp_tls_setup_socket reads multiple fields from a freed rpc_clnt (including cl_cred and cl_program), enabling information disclosure and further exploitation beyond a simple crash.\nI:H - Use-after-free of rpc_clnt permits corrupting allocator metadata and adjacent kernel objects; freed-object reuse can yield arbitrary write or control-flow hijack primitives, not merely authenticated data alteration.\nA:H - Accessing the freed rpc_clnt produces a refcount_t underflow and kernel oops/panic; even unsuccessful exploitation typically crashes or hangs the system, and repeated reconnect attempts can deny availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72317","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72339","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the qede NIC RX fastpath reached when remote Ethernet frames are received, hardware posts completion queue entries, and NAPI runs qede_poll() -> qede_rx_int() -> qede_rx_process_cqe()/qede_tpa_start() into qede_rx_build_skb() or qede_tpa_rx_build_skb().\nAC:L - An attacker can reliably trigger build_skb() NULL returns by flooding the interface with frames larger than rx_copybreak (256 bytes) to exhaust GFP_ATOMIC skb slab allocations, then the off-by-one BD consumption desynchronizes the ring without races or victim-specific state.\nPR:N - No local account, capability, or authentication is required; any unauthenticated remote host that can send IP/Ethernet traffic to a server using a Marvell/QLogic FastLinQ qede NIC can hit the vulnerable RX/TPA handlers.\nUI:N - Exploitation requires no victim interaction beyond normal network operation; packet reception, MSI-X interrupt handling, and NAPI polling process attacker-supplied frames automatically in kernel context.\nS:U - The flaw corrupts kernel heap metadata (DMA page refcounts and SLUB freelists) within the host kernel security boundary; it does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - BD ring desynchronization corrupts DMA page reference counts and can corrupt SLUB freelists; this class of kernel heap corruption is exploitable for arbitrary kernel memory reads and information disclosure beyond a simple crash.\nI:H - SLUB freelist corruption from mismatched BD ring consumption enables arbitrary kernel memory writes and control-flow hijacking primitives, supporting local privilege escalation or arbitrary code execution in kernel context.\nA:H - Reference-count and SLUB corruption from the desynchronized BD ring can cause kernel BUG/oops/panic or a wedged RX datapath, resulting in complete loss of host availability on affected systems."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72339","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72389","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation is via local RTNETLINK/ioctl to create a down bridge, enable kernel STP, enslave ports, and delete the bridge; remote STP BPDU handling is blocked when IFF_UP is clear, so the arming path that leaves timers active on a down bridge is local.\nAC:L - The public PoC uses a reliable, attacker-controlled netlink sequence (down bridge + kernel STP + port state progression + dellink) without winning races; per-port forward-delay timers deterministically reach br_topology_change_detection and arm topology_change_timer before deletion.\nPR:L - All reachable paths (RTM_NEWLINK/DELLINK, IFLA_BR_STP_STATE, enslaving ports) require CAP_NET_ADMIN, which unprivileged users can obtain in user/network namespaces (unshare -Urn, Kubernetes NET_ADMIN, LXC/libvirt network namespaces).\nUI:N - Triggering requires only programmatic bridge configuration by the attacker; no victim must click, mount, or open anything beyond the attacker's own netlink operations.\nS:U - Impact is kernel memory corruption and privilege escalation within the same kernel/host security domain; it does not cross a VM, container-to-host, or IOMMU boundary by itself.\nC:H - Use-after-free of the net_device/net_bridge kmalloc object lets an attacker reclaim freed slab memory and obtain arbitrary kernel read/disclosure primitives from corrupted timer and bridge structures.\nI:H - Disclosed analysis and PoC show the dangling timer callback can hijack control flow by reclaiming the freed object with attacker-controlled data, replacing the timer function pointer for arbitrary kernel code execution.\nA:H - Deleting the bridge with active STP timers queued causes the per-CPU timer wheel to invoke callbacks on freed memory, producing kernel BUG/oops/panics and denial of service even if full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72389","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74345","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit while processing attacker-supplied MPA/TCP data on an inbound SIW listener socket during connection establishment, which is a standard network protocol path analogous to other in-kernel TCP service handlers.\nAC:L - An attacker fully controls the TCP connection and malformed MPA request bytes that deterministically fail parsing and drive the endpoint teardown path where the refcount bug frees the cep before it is accessed again.\nPR:N - Exploitation requires only the ability to open a TCP connection to a host running an SIW RDMA listener; the MPA handshake is unauthenticated and occurs before any RDMA credentials or local privileges are established.\nUI:N - No end-user action is required at exploit time; the kernel processes the malicious inbound connection automatically once an administrator has started an RDMA listener service.\nS:U - Impact is confined to kernel memory corruption and potential host privilege escalation within the same kernel security authority, not a VM escape or cross-authority boundary such as guest-to-hypervisor.\nC:H - The vulnerability is a slab use-after-free on a freed siw_cep object; UAF on attacker-influenced connection teardown enables heap grooming and arbitrary kernel memory read primitives beyond a simple crash.\nI:H - Use-after-free of the connection endpoint structure in kernel heap can be leveraged for controlled writes and code execution via object reuse and function pointer/callback corruption, not merely data integrity of a single field.\nA:H - The bug was reproduced as a KASAN slab-use-after-free in siw_cm_work_handler during malformed MPA processing, which can cause kernel oops/panic and denial of service on the target host."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74345","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74377","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires mutating mmap'd receive WQEs through /dev/infiniband/uverbs; inbound RoCE packets (rxe_udp_encap_recv→rxe_rcv→rxe_receiver) only trigger processing and cannot alter WQE fields without local control of the userspace-mapped receive queue.\nAC:L - The attacker controls both sides of the TOCTOU—userspace threads racing num_sge/sge edits while posting recv WRs and driving inbound RoCE SEND/WRITE traffic—so out-of-bounds reads in rxe_resp_check_length() and copy_data() are reliably triggerable with retries.\nPR:L - uverbs_devnode() publishes /dev/infiniband/uverbsN as mode 0666, letting any local account create userspace QPs and mmap receive queues; rxe link setup needs CAP_NET_ADMIN obtainable in a user+network namespace via unshare -Urn, matching PR:L kernel guidance.\nUI:N - Exploitation is entirely self-driven from the attacker's own RDMA verbs client and concurrent userspace threads; no victim user action, mount, or file open is required.\nS:U - Impact is kernel memory corruption and local privilege escalation within the host kernel security authority, not a VM guest-to-host escape, IOMMU/DMA boundary bypass, or other cross-scope compromise.\nC:H - Inflating num_sge or rewriting sge entries during processing causes out-of-bounds reads in rxe_resp_check_length() and copy_data() beyond the allocated WQE slot, potentially into adjacent vmalloc/kernel memory, enabling arbitrary kernel information disclosure.\nI:H - copy_data() walks attacker-forged out-of-bounds sge entries and performs rxe_mr_copy writes of incoming RDMA payload into MR-backed memory; combined with queue overruns this yields controlled memory corruption exploitable for arbitrary write and code execution.\nA:H - Processing a WQE with an attacker-inflated num_sge causes the kernel to walk far past valid sge slots, dereferencing invalid pointers and corrupting memory, reliably producing kernel oops/panic and total loss of availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74377","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74378","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local process with mmap write access to the SRQ receive queue shared with the kernel; although incoming RoCE/UDP packets trigger get_srq_wqe(), a remote peer cannot modify num_sge in the victim's userspace-mapped WQE buffer, so the TOCTOU overflow cannot be achieved from the network alone.\nAC:L - The attacker controls both sides of the race: a userspace thread that repeatedly rewrites num_sge in the mmap'd SRQ entry and the thread/process that posts recv WQEs and receives the triggering RoCE Send/Write packet, making the TOCTOU window reliably winnable without external timing luck.\nPR:L - An unprivileged local user with access to /dev/infiniband/uverbs can create an SRQ (mmap'd queue), associate a QP, and post recv buffers via ibverbs; rxe device setup via \"rdma link add type rxe\" is reachable with CAP_NET_ADMIN inside a user namespace (unshare -Urn).\nUI:N - No victim user interaction is required; the attacker operates their own malicious RDMA userspace process and can self-trigger the vulnerable responder path with RoCE request packets once SRQ/QP resources are configured.\nS:U - The heap overflow corrupts kernel memory within the rxe_qp responder context on the same host kernel, enabling local privilege escalation rather than crossing a VM, container, or IOMMU security boundary to impact a different authority.\nC:H - The attacker-controlled memcpy size causes an out-of-bounds copy from the mmap'd SRQ ring buffer and overflows the fixed qp->resp.srq_wqe kernel buffer, enabling adjacent kernel heap data disclosure and providing primitives that can be developed into arbitrary kernel memory reads.\nI:H - Overflowing qp->resp.srq_wqe corrupts subsequent fields in rxe_resp_info/rxe_qp (e.g., responder resource pointers and state), giving a kernel heap buffer overflow that can be leveraged for arbitrary kernel memory writes and local privilege escalation.\nA:H - Corrupting responder state inside rxe_qp can cause kernel oops/panic or wedged RDMA processing during packet handling; even failed exploitation attempts can crash the kernel through use of corrupted function pointers and queue state."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74378","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74390","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl on /dev/infiniband/uverbs to register CQ/QP/SRQ memory via irdma_reg_user_mr; the bug is not reachable from remote iWARP/RoCE packet handling.\nAC:L - An attacker fully controls reg_type, cq_pages/sq_pages/rq_pages, and umem size; triggering lvl==0 with many DMA blocks is deterministic and needs no races or special memory layout.\nPR:L - Any unprivileged local user who can open the uverbs device (mode 0666) and use the RDMA NIC—typical on cloud/HPC RDMA nodes—can invoke the vulnerable MR registration path without real root.\nUI:N - No victim interaction is required; the attacker triggers the overflow directly through their own RDMA verbs memory registration calls.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel security boundary, not a cross-VM or cross-IOMMU sandbox escape.\nC:H - The out-of-bounds write of attacker-influenced DMA addresses into adjacent irdma_mr/iwpbl heap metadata can be leveraged for arbitrary kernel memory read primitives, not merely a bounded leak.\nI:H - Controlled out-of-bounds u64 writes past pgaddrmem[4] corrupt adjacent kernel heap structures and are suitable for control-flow or arbitrary kernel write exploitation.\nA:H - Heap corruption in a kzalloc'd irdma_mr can cause immediate kernel oops/panic during registration or on subsequent use of corrupted queue memory metadata."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74390","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74394","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - SRPT is an in-kernel SCSI RDMA target reached by remote initiators over InfiniBand/RoCE via RDMA/IB CM; malicious SRP_CMD IUs are delivered through `srpt_recv_done()` without any local syscall or physical access.\nAC:L - Once connected on an immediate-data SRPT target (use_srq=0), a malicious initiator deterministically sets `imm_buf->len=0xFFFFFFFF` to wrap `req_size` and bypass checks; no race or attacker-uncontrollable condition is required.\nPR:N - SRPT enables LIO demo mode (`srpt_check_true`), so any remote initiator that completes SRP login on an enabled target gets a dynamic ACL without target-local credentials, root, or CAP_NET_ADMIN on the victim host.\nUI:N - Exploitation requires only attacker-initiated RDMA connection, SRP login, and crafted SRP_CMD traffic; no administrator or other user must mount storage or perform any action on the target.\nS:U - The integer overflow corrupts kernel heap memory and SCSI-target processing within the host kernel's own security authority; it does not cross VM, IOMMU, or container sandbox boundaries.\nC:H - Passing a ~4GB length to `sg_init_one()` on a small receive buffer creates a massive out-of-bounds scatterlist; subsequent target-core DMA/map operations can read far beyond the buffer, enabling arbitrary kernel memory disclosure.\nI:H - The bogus scatterlist gives the block/SCSI target path an attacker-controlled ~4GB kernel memory write/read primitive over adjacent heap objects, exploitable for control-flow hijacking and privilege escalation.\nA:H - Out-of-bounds access from a ~4GB scatterlist on a kilobyte-scale receive buffer readily triggers kernel oops, KASAN faults, or panic, denying availability even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74394","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74488","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when the mwifiex driver processes attacker-supplied A-MSDU TDLS frames received over WiFi from a nearby peer, AP, or injector on the same wireless segment, which is an adjacent RF attack vector rather than remote Internet or local syscall access.\nAC:L - Once TDLS-capable mwifiex firmware receives an A-MSDU, the attacker fully controls subframe sizes and TDLS content to trigger either the skb use-after-free or the overstated-length out-of-bounds parse reliably without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation requires only the ability to deliver crafted 802.11 data frames to the victim radio; it does not require any local account, capability, or root access on the Linux host and is not gated by user-namespace privilege boundaries.\nUI:N - No victim user action beyond normal wireless operation is required; the driver parses malicious TDLS subframes automatically during receive and A-MSDU decomposition before forwarding traffic to the network stack.\nS:U - Impact is confined to kernel memory corruption and driver state within the host kernel security authority; it does not by itself cross a VM, container, or IOMMU boundary to affect a separate security domain.\nC:H - The skb use-after-free reads freed sk_buff metadata and the inflated length drives an out-of-bounds IE walk that reads kernel memory beyond the subframe, including attacker-positioned bytes from subsequent A-MSDU subframes, enabling substantial information disclosure.\nI:H - The same out-of-bounds parse copies attacker-controlled IE data from beyond the subframe into heap-allocated sta_node/tdls_cap structures via memcpy, providing a memory-corruption primitive that can be developed into arbitrary kernel write or code execution.\nA:H - Reading skb->len after the parent A-MSDU skb may already be freed can immediately fault or corrupt memory, and the out-of-bounds TDLS element parsing can provoke kernel oopses or panics even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74488","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74496","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is opened only via local FOU_CMD_ADD genetlink into fou_create(); remote UDP can race the dangling sk_user_data read in fou_udp_recv/gue_udp_recv but cannot alone reach the erroneous teardown path.\nAC:L - An attacker with CAP_NET_ADMIN controls both sides: issue a second FOU_CMD_ADD with port 0 to force -EALREADY on fou_add_to_port_list while concurrently sending UDP/GRO traffic to the just-bound ephemeral socket during the kfree window.\nPR:L - FOU_CMD_ADD is gated by GENL_ADMIN_PERM (CAP_NET_ADMIN); the fou genl family is netnsok, so a user with CAP_NET_ADMIN inside unshare -Urn can configure FOU and trigger the failing add path without init-namespace root.\nUI:N - Exploitation is fully programmatic via concurrent netlink FOU_CMD_ADD requests and attacker-controlled UDP packets; no victim mount, file open, or other interactive action is required.\nS:U - Impact is kernel heap corruption and privilege escalation within the same security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Concurrent readers call fou_from_sock() and dereference freed struct fou fields (family, protocol, flags); reclaimed slab contents give attacker-controlled reads and kernel pointer disclosure primitives typical of UAF.\nI:H - Freed struct fou is attacker-reclaimable kmalloc memory; fou_gro_receive indexes inet_offloads[fou->protocol] from the dangling pointer, enabling heap grooming for arbitrary writes and control-flow hijack.\nA:H - Use-after-free in UDP receive/GRO softirq reliably causes KASAN violations and, on production kernels, invalid pointer dereferences or panics when accessing the freed fou object during packet processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74496","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74516","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires triggering KVM nested SVM/AVIC paths via local /dev/kvm ioctls (KVM_CREATE_VM, KVM_CREATE_VCPU, KVM_RUN) from L1; there is no network, adjacent, or physical packet/device path to the vulnerable code.\nAC:L - An L1 attacker fully controls nested VM configuration (x2APIC, AVIC, L2 MSR bitmap, IRQ-window/ExtINT conditions) and can reliably reproduce AVIC inhibition while L2 is active without races or uncontrollable host state.\nPR:H - Reaching the bug requires running nested AMD KVM as L1 (nested virtualization enabled and control of a guest hypervisor), which is not available to an unprivileged host user or via user-namespace capabilities alone without delegated /dev/kvm access.\nUI:N - No victim interaction is required; exploitation is driven entirely by the attacker’s nested hypervisor configuration and KVM_RUN operations once nested virtualization is available.\nS:C - The flaw lets an L1 nested guest hypervisor access the host’s physical x2APIC MSRs, crossing the VM/host security boundary rather than staying within the guest’s own security scope.\nC:H - With x2APIC MSR intercepts left disabled, L1 can read most of the host APIC state (IDs, IRR/ISR, timers, ICR), leaking sensitive host interrupt-controller information beyond the guest boundary.\nI:H - L1 can write host x2APIC MSRs to send arbitrary IPIs, change task priority, and invoke host interrupt vectors (e.g. posted-interrupt wakeup), enabling host integrity compromise beyond mere guest-local effects.\nA:H - Host availability is trivially impacted by injecting spurious or high-priority interrupts to host CPUs; the fix commit demonstrates host kernel warnings and spurious interrupt storms causing denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74516","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74518","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local hugetlb reservation paths (mmap/memfd_create/fault syscalls into region_chg/region_add/region_del); no network protocol or remote packet handler invokes allocate_file_region_entries().\nAC:L - Exploitation needs a race while resv->lock is dropped during GFP_KERNEL allocation, but an attacker can spawn concurrent MAP_SHARED mappers/faulters on one hugetlb inode and controls both sides of that race.\nPR:L - Unprivileged local users can trigger this via memfd_create(MFD_HUGETLB) plus MAP_SHARED mmap/fault activity, or by mapping accessible shared hugetlbfs files, without init-namespace root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the needed concurrent syscalls and shared hugetlb mappings themselves to hit the corrupted list splice retry path.\nS:U - Impact is kernel hugetlb resv_map list/memory corruption on the host; it does not by itself cross a VM, IOMMU, or separate security-authority boundary even though KVM/DPDK hosts are a prime deployment.\nC:H - Without CONFIG_DEBUG_LIST, stale list_splice leaves a kernel-stack pointer in resv->region_cache, producing later use-after-free that can be turned into arbitrary kernel memory read/disclosure primitives.\nI:H - Corrupted region_cache pointers let subsequent region_add/region_del/cache operations write through attacker-influenced list links, enabling heap metadata corruption and potential arbitrary kernel write or code execution.\nA:H - Real host panics were reported on dense KVM hugetlb workloads; DEBUG_LIST kernels BUG on list_add corruption, and default builds can crash from UAF while walking the poisoned region_cache."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74518","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74537","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the Bluetooth ISO stack; iso_conn_ready runs from HCI connection-confirmation events (CIS/BIS/PA sync) driven by LE isochronous traffic from Bluetooth peers within radio range, which is an adjacent attack surface (phones, earbuds, automotive, embedded).\nAC:L - This is a use-after-free race between iso_conn_ready and iso_sock_release/iso_sock_kill; an attacker who controls both an ISO socket close and concurrent HCI completion (e.g., dual-thread connect/close or rapid adjacent CIS/BIS establish-teardown) can reliably trigger it without uncontrollable conditions.\nPR:N - Exploitation requires no elevated credentials on the victim: HCI events are processed for any Bluetooth-enabled device in range, and the racing socket close can occur from automatic stack/daemon teardown during connection setup without the victim performing privileged local actions.\nUI:N - No victim interaction is required when the OS Bluetooth stack (e.g., LE Audio on Android phones or bluetoothd on Linux) automatically manages ISO sockets during pairing, reconnection, or broadcast sync while processing peer-initiated CIS/BIS traffic.\nS:U - The UAF corrupts kernel socket memory and can enable local privilege escalation within the kernel; it does not cross a VM, container, or IOMMU security boundary, so scope remains unchanged.\nC:H - Use-after-free on struct sock after iso_sock_kill frees the socket lets an attacker dereference attacker-influenced freed heap memory, enabling arbitrary kernel memory disclosure via heap grooming and reuse of the sock object.\nI:H - The UAF touches sk->sk_state and sk->sk_state_change during iso_sock_ready on a freed sock, providing a standard kernel heap corruption primitive that can be leveraged for arbitrary write and control-flow hijack.\nA:H - Concurrent iso_sock_kill and iso_conn_ready can dereference freed socket memory, causing kernel oops/panic from invalid lock_sock/sk_state access; UAF in the Bluetooth ISO path is inherently a high-availability risk even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74537","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74556","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised iSCSI target delivers crafted SCSI Command Response PDUs over the established TCP iSCSI session; reception flows through iscsi_sw_tcp_recv/iscsi_tcp_recv_skb into iscsi_tcp_hdr_dissect without local access.\nAC:L - The attacker controls the target and can set DataSegmentLength between 8193 and negotiated max_recv_dlength (open-iscsi commonly 262144) on SCSI_CMD_RSP for any outstanding command ITT; no races or victim-specific heap layout are required.\nPR:N - No privileges on the victim host are needed; a remote attacker acting as or MITMing the iSCSI target sends malicious responses after session login, independent of victim user accounts or capabilities.\nUI:N - On systems with persistent iSCSI sessions (cloud VMs, SAN-boot hosts, Kubernetes iSCSI volumes), exploitation triggers automatically during normal SCSI I/O when command responses are received; no victim action is needed at attack time.\nS:U - Heap corruption is confined to the kernel iSCSI initiator on the affected host; successful exploitation yields kernel compromise or DoS within the same security authority, not a VM escape or cross-boundary scope change.\nC:H - iscsi_tcp_segment_recv memcpy writes up to max_recv_dlength bytes into an 8192-byte conn->data buffer, causing a large heap overflow whose controlled corruption can be leveraged for arbitrary kernel memory disclosure.\nI:H - Attacker-controlled response data is copied past the fixed conn->data allocation via iscsi_tcp_data_recv_prep/iscsi_segment_init_linear, enabling heap metadata/object corruption exploitable for arbitrary kernel write and privilege escalation.\nA:H - Overflowing the conn->data heap buffer can immediately corrupt adjacent kernel allocations and cause oops/panic; a malicious target can repeatedly trigger this on active sessions to deny storage availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74556","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74581","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - fib6_rule_suppress() runs on every IPv6 route lookup via fib6_rule_lookup(), including ip6_route_input() for received packets and icmp6/icmpv6 redirect handlers; WireGuard/VPN servers commonly deploy suppress_prefixlength rules (wg-quick), so remote IPv6 traffic to those hosts reaches the bug.\nAC:L - Once suppress_prefixlength IPv6 policy routing rules exist, any matching packet deterministically triggers fib6_rule_suppress() to release the route while leaving a stale res->rt6 pointer; no race or uncontrollable memory layout is required.\nPR:N - Remote exploitation needs only the ability to send IPv6 packets through a host whose operator already configured suppress rules (e.g., wg-quick); CAP_NET_ADMIN is an admin deployment prerequisite, not attacker privilege on the target.\nUI:N - No victim action is required beyond normal delivery of attacker-generated IPv6 traffic (or ICMPv6 redirect) to a host performing policy-route lookup.\nS:U - The stale rt6_info/dst_entry UAF corrupts kernel heap memory within the same host security boundary; it is not a VM escape or cross-authority sandbox break.\nC:H - Returning a released rt6_info leaves a dangling dst_entry in ip6_dst_cache; subsequent reads through ip6_dst_idev(), dst metrics, or error paths are classic slab UAF with attacker-influencable heap reuse via sustained IPv6 traffic.\nI:H - Double-free/imbalanced rcuref put and post-free use of rt6_info fields give heap corruption primitives; UAF on dst/route cache objects is routinely leveraged for kernel write and control-flow hijack.\nA:H - Commit explicitly reports rcuref_put_slowpath() WARN from dst_release() on the freed route; UAF and refcount corruption can oops/panic the kernel, fully denying availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74582","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb->data before skb->head, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74612","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":10,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Remote packets routed through container/host veth pairs reach veth_xdp_rcv_skb() after veth_xmit on the peer; cloud and edge nodes routinely forward Internet traffic across veth links with XDP attached, matching the reproduced UDP receive path.\nAC:L - The fix commit shows 10/10 reliable reproduction with a 60000-byte UDP datagram and XDP bpf_xdp_adjust_tail()/bpf_xdp_pull_data() fragment shrink; the attacker controls packet size, timing, and both veth ends without races or uncontrollable kernel state.\nPR:N - Exploitation only requires an XDP program using bpf_xdp_adjust_tail or bpf_xdp_pull_data to already be attached on a reachable veth peer; the remote packet sender needs no local account, capabilities, or authentication to trigger the bad skb length accounting.\nUI:N - No victim interaction is needed beyond normal always-on packet reception and socket delivery; corrupted payloads and leaked kernel metadata are produced automatically when a userspace process reads the affected datagram.\nS:C - veth links intentionally cross container/host network namespaces on multi-tenant servers, and skb_shared_info metadata plus kernel pointers leaked into a tenant userspace recv buffer exceed that tenant's authorized security boundary.\nC:H - Desynchronized skb->len makes skb_headlen() exceed the real linear tail, so __skb_datagram_iter() copies up to 1024 bytes past the skb into userspace, exposing nr_frags, xdp_frags_size, and a kernel pointer from skb_shinfo(skb)->frags[0].\nI:H - The same length mismatch inflates the linear region, displacing and truncating real datagram bytes in the delivered UDP buffer and corrupting application-visible data beyond intended packet bounds while compounding misuse of leaked kernel metadata.\nA:H - bpf_xdp_pull_data() can leave frags present while the old __skb_put() path hits SKB_LINEAR_ASSERT()/BUG_ON on nonlinear skbs; the commit reports deterministic kernel asserts and crashes in addition to datagram corruption."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74612","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74669","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74669","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74695","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug fires in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS when remotely sourced IPv4/IPv6 packets matching an offloaded flow are received on nftables flowtable-bound interfaces, not via netlink configuration APIs.\nAC:L - Once a flowtable ingress hook and offloaded TCP/UDP flow exist, an attacker can reliably send matching traffic that reaches FLOW_OFFLOAD_XMIT_NEIGH or the XFRM offload path with a ref-counted skb dst; syzbot reproduced this without uncontrollable races.\nPR:N - Exploitation requires only sending network traffic through an already deployed nftables flow-offload path on an ingress device; no local account, authentication, or CAP_NET_ADMIN on the victim is needed to trigger the leak.\nUI:N - No victim interaction is required beyond normal network delivery; packets are processed automatically in softirq on the netdev ingress netfilter hook without opening files or mounting filesystems.\nS:U - Impact is confined to kernel refcount imbalance and availability degradation on the affected host; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:N - The flaw leaks a dst_entry reference by overwriting skb->_skb_refdst without releasing the prior dst; it does not expose kernel memory or provide an arbitrary read primitive.\nI:N - No unauthorized data modification occurs; the skb is forwarded using the intended flowtable destination while the previous dst reference is orphaned, not corrupted into a controllable write primitive.\nA:H - Each matching packet leaks a dst_entry refcount on the flowtable fast path, enabling sustained unauthenticated remote memory exhaustion on high-volume routers; CONFIG_DEBUG_NET builds also emit WARN_ON_ONCE during the overwrite."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74695","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-80722","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - Malformed S1G TWT setup action frames reach mac80211 via normal WiFi RX (driver -> ieee80211_rx_h_action -> ieee80211_process_rx_twt_action -> ieee80211_s1g_rx_twt_setup); an adjacent attacker within radio range sends crafted 802.11 management frames to a vulnerable AP.\nAC:L - The attacker fully controls the TWT element length and payload; ieee80211_process_rx_twt_action() only validates two bytes of req_type before queueing, so a short individual agreement reliably reaches drv_add_twt_setup() without races or victim-specific timing.\nPR:N - No Linux privileges on the victim AP are required; exploitation needs only normal 802.11 association as a WiFi client to an S1G AP with twt_responder enabled and a driver implementing add_twt_setup (e.g. MediaTek mt7915/mt7996).\nUI:N - No deliberate victim action is needed beyond operating an S1G AP that accepts associated stations; the attacker directly injects the malformed TWT setup frame and mac80211 processes it automatically on receive.\nS:U - Impact is kernel/driver heap memory corruption on the AP host within the same security authority; it does not cross VM, IOMMU, or sandbox boundaries (standard kernel compromise scope).\nC:H - drv_add_twt_setup(), its tracepoint, and driver callbacks read the full ieee80211_twt_params (twt, min_twt_dur, mantissa, channel) beyond the validated skb bounds, causing out-of-bounds reads of adjacent skb/heap memory that can disclose kernel data.\nI:H - MediaTek add_twt_setup() handlers write twt_agrt fields (req_type, min_twt_dur, twt) past the undersized params block into skb tail/heap memory, providing out-of-bounds write primitives exploitable for further memory corruption or code execution.\nA:H - Out-of-bounds access in mac80211/driver TWT setup can kernel-oops the AP or hang/crash WiFi firmware when corrupted parameters are programmed into hardware TWT state from attacker-controlled short frames."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80722","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4369-1","advisory_id":"ddb2c304-0ccc-4573-96b3-606b178f0dff","event_types":["advisory"],"published_at":"2026-10-25T22:45:55.826745+00:00","technologies":["core-osv","kernel-64kb","kernel-default","kernel-default-base","kernel-docs","kernel-livepatch-sle15-sp6-update-31","kernel-obs-build","kernel-source","kernel-syms","kernel-zfcpdump"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:46:28+00:00","detail_url":"/events/71343"}]}}],"next_after":70970,"next_before":70970}