{"schema_version":"2","view":"grouped","data":[{"id":70967,"cve_ids":["CVE-2026-31482","CVE-2026-31483","CVE-2026-31542","CVE-2026-31598","CVE-2026-31628","CVE-2026-43033","CVE-2026-43046","CVE-2026-43056","CVE-2026-43276","CVE-2026-43440","CVE-2026-43475","CVE-2026-45904","CVE-2026-46056","CVE-2026-46080","CVE-2026-46084","CVE-2026-46109","CVE-2026-46117","CVE-2026-46126","CVE-2026-46144","CVE-2026-46145","CVE-2026-46174","CVE-2026-46193","CVE-2026-46243","CVE-2026-46323","CVE-2026-46324","CVE-2026-46333","CVE-2026-52967","CVE-2026-52986","CVE-2026-53050","CVE-2026-53129","CVE-2026-53131","CVE-2026-53177","CVE-2026-53224","CVE-2026-53246","CVE-2026-53250","CVE-2026-53262","CVE-2026-53267","CVE-2026-53297","CVE-2026-53324","CVE-2026-53354","CVE-2026-53375","CVE-2026-53388","CVE-2026-53391","CVE-2026-53402","CVE-2026-63794","CVE-2026-63802","CVE-2026-63806","CVE-2026-63807","CVE-2026-63824","CVE-2026-63826","CVE-2026-63829","CVE-2026-63884","CVE-2026-63893","CVE-2026-63912","CVE-2026-63917","CVE-2026-63919","CVE-2026-63921","CVE-2026-63922","CVE-2026-63924","CVE-2026-63946","CVE-2026-63952","CVE-2026-63968","CVE-2026-63971","CVE-2026-63975","CVE-2026-63984","CVE-2026-63994","CVE-2026-64106","CVE-2026-64189","CVE-2026-64530","CVE-2026-64560","CVE-2026-64561","CVE-2026-64564","CVE-2026-64600"],"payload":{"kind":"advisory","title":"Security update for the Linux Kernel","summary":"The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435). - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656). - CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995). - CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181). - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289). - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188). - CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633). - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773). - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997). - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988). - CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808). - CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000). - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577). - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230). - CVE-2026-53375: drm/amdgpu/vce: ","evidence":"osv:SUSE-SU-2026:3602-1","products":[{"name":{"value":"kernel-default","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-livepatch-SLE15-SP6_Update_30","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1-150600.13.5.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-64kb","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1.150600.12.60.3","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-zfcpdump","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1.150600.12.60.3","evidence":"/affected/12/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/13/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/13/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/14/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/14/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/15/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/15/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/16/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/16/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:3602-1","aliases":["SUSE-SU-2026:3602-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.130.1","kernel-default-livepatch-devel":"6.4.0-150600.23.130.1","kernel-livepatch-6_4_0-150600_23_130-default":"1-150600.13.5.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.5.1"}]}],"package":{"name":"kernel-livepatch-SLE15-SP6_Update_30","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_30&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.130.1","kernel-default-livepatch-devel":"6.4.0-150600.23.130.1","kernel-livepatch-6_4_0-150600_23_130-default":"1-150600.13.5.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-64kb","purl":"pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1.150600.12.60.3"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-zfcpdump","purl":"pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1.150600.12.60.3"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}}],"modified":"2026-10-02T18:42:47.946147883Z","provider":"osv","upstream":["CVE-2026-31482","CVE-2026-31483","CVE-2026-31542","CVE-2026-31598","CVE-2026-31628","CVE-2026-43033","CVE-2026-43046","CVE-2026-43056","CVE-2026-43276","CVE-2026-43440","CVE-2026-43475","CVE-2026-45904","CVE-2026-46056","CVE-2026-46080","CVE-2026-46084","CVE-2026-46109","CVE-2026-46117","CVE-2026-46126","CVE-2026-46144","CVE-2026-46145","CVE-2026-46174","CVE-2026-46193","CVE-2026-46243","CVE-2026-46323","CVE-2026-46324","CVE-2026-46333","CVE-2026-52967","CVE-2026-52986","CVE-2026-53050","CVE-2026-53129","CVE-2026-53131","CVE-2026-53177","CVE-2026-53224","CVE-2026-53246","CVE-2026-53250","CVE-2026-53262","CVE-2026-53267","CVE-2026-53297","CVE-2026-53324","CVE-2026-53354","CVE-2026-53375","CVE-2026-53388","CVE-2026-53391","CVE-2026-53402","CVE-2026-63794","CVE-2026-63802","CVE-2026-63806","CVE-2026-63807","CVE-2026-63824","CVE-2026-63826","CVE-2026-63829","CVE-2026-63884","CVE-2026-63893","CVE-2026-63912","CVE-2026-63917","CVE-2026-63919","CVE-2026-63921","CVE-2026-63922","CVE-2026-63924","CVE-2026-63946","CVE-2026-63952","CVE-2026-63968","CVE-2026-63971","CVE-2026-63975","CVE-2026-63984","CVE-2026-63994","CVE-2026-64106","CVE-2026-64189","CVE-2026-64530","CVE-2026-64560","CVE-2026-64561","CVE-2026-64564","CVE-2026-64600"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20263602-1/","https://bugzilla.suse.com/1185845","https://bugzilla.suse.com/1253262","https://bugzilla.suse.com/1258718","https://bugzilla.suse.com/1260347","https://bugzilla.suse.com/1262745","https://bugzilla.suse.com/1262771","https://bugzilla.suse.com/1263010","https://bugzilla.suse.com/1263068","https://bugzilla.suse.com/1263718","https://bugzilla.suse.com/1263788","https://bugzilla.suse.com/1264053","https://bugzilla.suse.com/1264089","https://bugzilla.suse.com/1264090","https://bugzilla.suse.com/1264558","https://bugzilla.suse.com/1264779","https://bugzilla.suse.com/1264795","https://bugzilla.suse.com/1265308","https://bugzilla.suse.com/1266238","https://bugzilla.suse.com/1266758","https://bugzilla.suse.com/1266850","https://bugzilla.suse.com/1266890","https://bugzilla.suse.com/1266913","https://bugzilla.suse.com/1267375","https://bugzilla.suse.com/1267384","https://bugzilla.suse.com/1267435","https://bugzilla.suse.com/1267584","https://bugzilla.suse.com/1267596","https://bugzilla.suse.com/1267656","https://bugzilla.suse.com/1267682","https://bugzilla.suse.com/1267715","https://bugzilla.suse.com/1267995","https://bugzilla.suse.com/1268029","https://bugzilla.suse.com/1268307","https://bugzilla.suse.com/1269181","https://bugzilla.suse.com/1269188","https://bugzilla.suse.com/1269289","https://bugzilla.suse.com/1269383","https://bugzilla.suse.com/1269512","https://bugzilla.suse.com/1269513","https://bugzilla.suse.com/1269577","https://bugzilla.suse.com/1269633","https://bugzilla.suse.com/1269773","https://bugzilla.suse.com/1269808","https://bugzilla.suse.com/1269981","https://bugzilla.suse.com/1269988","https://bugzilla.suse.com/1269997","https://bugzilla.suse.com/1270000","https://bugzilla.suse.com/1270230","https://bugzilla.suse.com/1271349","https://bugzilla.suse.com/1271368","https://bugzilla.suse.com/1271526","https://bugzilla.suse.com/1271825","https://bugzilla.suse.com/1271866","https://bugzilla.suse.com/1271899","https://bugzilla.suse.com/1271904","https://bugzilla.suse.com/1271908","https://bugzilla.suse.com/1271912","https://bugzilla.suse.com/1271964","https://bugzilla.suse.com/1272176","https://bugzilla.suse.com/1272180","https://bugzilla.suse.com/1272183","https://bugzilla.suse.com/1272207","https://bugzilla.suse.com/1272242","https://bugzilla.suse.com/1272263","https://bugzilla.suse.com/1272268","https://bugzilla.suse.com/1272282","https://bugzilla.suse.com/1272466","https://bugzilla.suse.com/1272468","https://bugzilla.suse.com/1272573","https://bugzilla.suse.com/1272607","https://bugzilla.suse.com/1272665","https://bugzilla.suse.com/1272678","https://bugzilla.suse.com/1272693","https://bugzilla.suse.com/1272694","https://bugzilla.suse.com/1272836","https://bugzilla.suse.com/1272855","https://bugzilla.suse.com/1272865","https://bugzilla.suse.com/1272904","https://bugzilla.suse.com/1272907","https://bugzilla.suse.com/1272918","https://bugzilla.suse.com/1273004","https://bugzilla.suse.com/1273035","https://bugzilla.suse.com/1273231","https://bugzilla.suse.com/1274072","https://www.suse.com/security/cve/CVE-2026-31482","https://www.suse.com/security/cve/CVE-2026-31483","https://www.suse.com/security/cve/CVE-2026-31542","https://www.suse.com/security/cve/CVE-2026-31598","https://www.suse.com/security/cve/CVE-2026-31628","https://www.suse.com/security/cve/CVE-2026-43033","https://www.suse.com/security/cve/CVE-2026-43046","https://www.suse.com/security/cve/CVE-2026-43056","https://www.suse.com/security/cve/CVE-2026-43276","https://www.suse.com/security/cve/CVE-2026-43440","https://www.suse.com/security/cve/CVE-2026-43475","https://www.suse.com/security/cve/CVE-2026-45904","https://www.suse.com/security/cve/CVE-2026-46056","https://www.suse.com/security/cve/CVE-2026-46080","https://www.suse.com/security/cve/CVE-2026-46084","https://www.suse.com/security/cve/CVE-2026-46109","https://www.suse.com/security/cve/CVE-2026-46117","https://www.suse.com/security/cve/CVE-2026-46126","https://www.suse.com/security/cve/CVE-2026-46144","https://www.suse.com/security/cve/CVE-2026-46145","https://www.suse.com/security/cve/CVE-2026-46174","https://www.suse.com/security/cve/CVE-2026-46193","https://www.suse.com/security/cve/CVE-2026-46243","https://www.suse.com/security/cve/CVE-2026-46323","https://www.suse.com/security/cve/CVE-2026-46324","https://www.suse.com/security/cve/CVE-2026-46333","https://www.suse.com/security/cve/CVE-2026-52967","https://www.suse.com/security/cve/CVE-2026-52986","https://www.suse.com/security/cve/CVE-2026-53050","https://www.suse.com/security/cve/CVE-2026-53129","https://www.suse.com/security/cve/CVE-2026-53131","https://www.suse.com/security/cve/CVE-2026-53177","https://www.suse.com/security/cve/CVE-2026-53224","https://www.suse.com/security/cve/CVE-2026-53246","https://www.suse.com/security/cve/CVE-2026-53250","https://www.suse.com/security/cve/CVE-2026-53262","https://www.suse.com/security/cve/CVE-2026-53267","https://www.suse.com/security/cve/CVE-2026-53297","https://www.suse.com/security/cve/CVE-2026-53324","https://www.suse.com/security/cve/CVE-2026-53354","https://www.suse.com/security/cve/CVE-2026-53375","https://www.suse.com/security/cve/CVE-2026-53388","https://www.suse.com/security/cve/CVE-2026-53391","https://www.suse.com/security/cve/CVE-2026-53402","https://www.suse.com/security/cve/CVE-2026-63794","https://www.suse.com/security/cve/CVE-2026-63802","https://www.suse.com/security/cve/CVE-2026-63806","https://www.suse.com/security/cve/CVE-2026-63807","https://www.suse.com/security/cve/CVE-2026-63824","https://www.suse.com/security/cve/CVE-2026-63826","https://www.suse.com/security/cve/CVE-2026-63829","https://www.suse.com/security/cve/CVE-2026-63884","https://www.suse.com/security/cve/CVE-2026-63893","https://www.suse.com/security/cve/CVE-2026-63912","https://www.suse.com/security/cve/CVE-2026-63917","https://www.suse.com/security/cve/CVE-2026-63919","https://www.suse.com/security/cve/CVE-2026-63921","https://www.suse.com/security/cve/CVE-2026-63922","https://www.suse.com/security/cve/CVE-2026-63924","https://www.suse.com/security/cve/CVE-2026-63946","https://www.suse.com/security/cve/CVE-2026-63952","https://www.suse.com/security/cve/CVE-2026-63968","https://www.suse.com/security/cve/CVE-2026-63971","https://www.suse.com/security/cve/CVE-2026-63975","https://www.suse.com/security/cve/CVE-2026-63984","https://www.suse.com/security/cve/CVE-2026-63994","https://www.suse.com/security/cve/CVE-2026-64106","https://www.suse.com/security/cve/CVE-2026-64189","https://www.suse.com/security/cve/CVE-2026-64530","https://www.suse.com/security/cve/CVE-2026-64560","https://www.suse.com/security/cve/CVE-2026-64561","https://www.suse.com/security/cve/CVE-2026-64564","https://www.suse.com/security/cve/CVE-2026-64600"]},"related_cves":[{"value":"CVE-2026-31482","evidence":"/upstream"},{"value":"CVE-2026-31483","evidence":"/upstream"},{"value":"CVE-2026-31542","evidence":"/upstream"},{"value":"CVE-2026-31598","evidence":"/upstream"},{"value":"CVE-2026-31628","evidence":"/upstream"},{"value":"CVE-2026-43033","evidence":"/upstream"},{"value":"CVE-2026-43046","evidence":"/upstream"},{"value":"CVE-2026-43056","evidence":"/upstream"},{"value":"CVE-2026-43276","evidence":"/upstream"},{"value":"CVE-2026-43440","evidence":"/upstream"},{"value":"CVE-2026-43475","evidence":"/upstream"},{"value":"CVE-2026-45904","evidence":"/upstream"},{"value":"CVE-2026-46056","evidence":"/upstream"},{"value":"CVE-2026-46080","evidence":"/upstream"},{"value":"CVE-2026-46084","evidence":"/upstream"},{"value":"CVE-2026-46109","evidence":"/upstream"},{"value":"CVE-2026-46117","evidence":"/upstream"},{"value":"CVE-2026-46126","evidence":"/upstream"},{"value":"CVE-2026-46144","evidence":"/upstream"},{"value":"CVE-2026-46145","evidence":"/upstream"},{"value":"CVE-2026-46174","evidence":"/upstream"},{"value":"CVE-2026-46193","evidence":"/upstream"},{"value":"CVE-2026-46243","evidence":"/upstream"},{"value":"CVE-2026-46323","evidence":"/upstream"},{"value":"CVE-2026-46324","evidence":"/upstream"},{"value":"CVE-2026-46333","evidence":"/upstream"},{"value":"CVE-2026-52967","evidence":"/upstream"},{"value":"CVE-2026-52986","evidence":"/upstream"},{"value":"CVE-2026-53050","evidence":"/upstream"},{"value":"CVE-2026-53129","evidence":"/upstream"},{"value":"CVE-2026-53131","evidence":"/upstream"},{"value":"CVE-2026-53177","evidence":"/upstream"},{"value":"CVE-2026-53224","evidence":"/upstream"},{"value":"CVE-2026-53246","evidence":"/upstream"},{"value":"CVE-2026-53250","evidence":"/upstream"},{"value":"CVE-2026-53262","evidence":"/upstream"},{"value":"CVE-2026-53267","evidence":"/upstream"},{"value":"CVE-2026-53297","evidence":"/upstream"},{"value":"CVE-2026-53324","evidence":"/upstream"},{"value":"CVE-2026-53354","evidence":"/upstream"},{"value":"CVE-2026-53375","evidence":"/upstream"},{"value":"CVE-2026-53388","evidence":"/upstream"},{"value":"CVE-2026-53391","evidence":"/upstream"},{"value":"CVE-2026-53402","evidence":"/upstream"},{"value":"CVE-2026-63794","evidence":"/upstream"},{"value":"CVE-2026-63802","evidence":"/upstream"},{"value":"CVE-2026-63806","evidence":"/upstream"},{"value":"CVE-2026-63807","evidence":"/upstream"},{"value":"CVE-2026-63824","evidence":"/upstream"},{"value":"CVE-2026-63826","evidence":"/upstream"},{"value":"CVE-2026-63829","evidence":"/upstream"},{"value":"CVE-2026-63884","evidence":"/upstream"},{"value":"CVE-2026-63893","evidence":"/upstream"},{"value":"CVE-2026-63912","evidence":"/upstream"},{"value":"CVE-2026-63917","evidence":"/upstream"},{"value":"CVE-2026-63919","evidence":"/upstream"},{"value":"CVE-2026-63921","evidence":"/upstream"},{"value":"CVE-2026-63922","evidence":"/upstream"},{"value":"CVE-2026-63924","evidence":"/upstream"},{"value":"CVE-2026-63946","evidence":"/upstream"},{"value":"CVE-2026-63952","evidence":"/upstream"},{"value":"CVE-2026-63968","evidence":"/upstream"},{"value":"CVE-2026-63971","evidence":"/upstream"},{"value":"CVE-2026-63975","evidence":"/upstream"},{"value":"CVE-2026-63984","evidence":"/upstream"},{"value":"CVE-2026-63994","evidence":"/upstream"},{"value":"CVE-2026-64106","evidence":"/upstream"},{"value":"CVE-2026-64189","evidence":"/upstream"},{"value":"CVE-2026-64530","evidence":"/upstream"},{"value":"CVE-2026-64560","evidence":"/upstream"},{"value":"CVE-2026-64561","evidence":"/upstream"},{"value":"CVE-2026-64564","evidence":"/upstream"},{"value":"CVE-2026-64600","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:130b8b86-0b9f-4b76-b8c0-96bf6997a30c","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-31598","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Although the core bug is in ocfs2 filesystem code, ocfs2 is exportable and nfsd can issue direct writes with IOCB_DIRECT while remote REMOVE operations reach vfs_unlink, making the vulnerable lock chains reachable over the network on a writable exported ocfs2 volume.\nAC:L - The bug is an ABBA deadlock where the attacker can drive both sides with concurrent extending direct writes and unlink/remove operations. Once the target deployment exposes those operations, winning the race is attacker-controlled.\nPR:N - A remote NFS client can trigger the operations through an exported writable share without kernel capabilities on the target. In permissive or anonymous export scenarios, no prior authenticated privileges are required.\nUI:N - No victim user action is required after the vulnerable service/filesystem is available. The attacker can send the write and remove operations directly.\nS:U - The impact remains within the same kernel/filesystem security authority. There is no VM escape, sandbox boundary crossing, or separate security scope.\nC:N - The issue is a lock-ordering deadlock, not memory corruption or information disclosure. It does not provide a read primitive or leak data.\nI:N - The vulnerable behavior does not corrupt memory or allow unauthorized data modification. It only causes threads to block on locks.\nA:H - The deadlock can permanently hang ocfs2 operations and affected kernel worker/syscall contexts. A kernel/filesystem hang is a high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31598","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43033","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable out-of-place AEAD decrypt path is reachable by a local process through AF_ALG sockets using authencesn, while normal inbound ESP uses in-place src==dst. This requires local syscall access rather than remote packets directly reaching the bad branch.\nAC:L - The attacker controls the AF_ALG request buffers, associated-data length, operation type, key, and authsize, and no race or hard-to-influence state is required. The fault occurs before ICV verification, so a valid packet/tag is not needed.\nPR:L - AF_ALG socket creation, bind, key setup, and AEAD decrypt do not require CAP_NET_ADMIN or CAP_SYS_ADMIN, but the attacker needs local unprivileged code execution. XFRM state management is privileged, but the lower-privilege AF_ALG path reaches the bug.\nUI:N - No victim action is required once the local attacker runs the AF_ALG syscall sequence. The attacker supplies both input and output buffers directly.\nS:U - The vulnerability is in kernel crypto processing and impacts the same kernel security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:H - The bug is a kernel memory-corruption condition from writing ESN high sequence bytes past the intended out-of-place destination; successful exploitation of such corruption could expose arbitrary kernel memory. Under the required uncertainty rule, this is scored as high confidentiality impact.\nI:H - The vulnerable code performs an attacker-influenced out-of-bounds write of four bytes before authentication succeeds. Kernel out-of-bounds writes are scored as high integrity impact because they can plausibly be shaped into control-flow or data corruption.\nA:H - At minimum, the AF_ALG path can drive scatterwalk past the end of the destination scatterlist and crash the kernel. A local attacker can repeat the trigger without authentication, causing high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43033","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43056","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable `add_adev()` error path is reached during MANA PCI driver probe/resume/recovery or auxiliary RDMA service handling, not by processing received network packets. The highest defensible attacker path is local influence over driver/device lifecycle or resource-failure conditions.\nAC:L - Once `auxiliary_device_add()` fails, the UAF is deterministic because `auxiliary_device_uninit()` releases the embedded object and the cleanup path immediately reads `adev->id`. No attacker-uncontrolled race is required beyond reaching that failure path.\nPR:L - The path is not exposed to unauthenticated remote peers, but a local attacker can plausibly influence resource exhaustion/failure conditions around driver lifecycle events. Direct sysfs/module lifecycle control is privileged, but Low is the higher-severity defensible choice under the conservative scoring rule.\nUI:N - No separate victim action is required once the attacker can exercise or influence the local driver lifecycle/failure path. Probe, resume, and service-event handling run in kernel context.\nS:U - The affected component and impacts are within the Linux kernel security scope. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel use-after-free of an auxiliary-device container object after its release callback frees it. Under conservative kernel UAF scoring, freed slab reuse can support information disclosure, so confidentiality is High.\nI:H - The UAF lets stale object contents influence cleanup through `mana_adev_idx_free()`, and kernel UAFs are conservatively treated as potentially exploitable memory corruption. Integrity is therefore High.\nA:H - At minimum, the stale access can trigger a kernel UAF report, invalid IDA cleanup, oops, or panic during probe/resume error unwinding. Availability impact is High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43056","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46056","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handlers process HCI Secure Simple Pairing events (User Passkey Notify / Keypress Notify) driven by a remote Bluetooth peer during SSP pairing, so the attacker must be within Bluetooth radio range (adjacent), matching kernel guidance that Bluetooth = Adjacent.\nAC:L - This is a use-after-free where a remote peer drives the passkey/keypress events while connection teardown frees the conn from a concurrent context; the attacker influences both sides of the race and can retry, and UAF bugs are scored AC:L unless the race is uncontrollable.\nPR:N - The code path is reached by a remote Bluetooth device participating in the SSP pairing handshake, requiring no credentials or privileges on the target system.\nUI:N - The handlers execute automatically when the controller forwards the SSP passkey/keypress HCI events during the pairing protocol exchange; no local user action is required to reach the vulnerable code.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The use-after-free reads fields (dst, type, dst_type, passkey) from a freed and potentially reallocated hci_conn object, which can disclose attacker-controlled or sensitive kernel heap contents.\nI:H - The handlers write to the freed object (passkey_notify and passkey_entered fields), giving a UAF write into reallocated heap memory that can be leveraged for heap grooming and control-flow corruption.\nA:H - A use-after-free on the hci_conn structure readily causes kernel oops/panic, yielding high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46056","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46117","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through the RDMA userspace verbs interface (/dev/infiniband/uverbs<N>) by issuing a create-QP command locally; it is not exposed to network peers.\nAC:L - The condition is created entirely by the attacker (building an RWQ indirection table whose WQs share one CQ) and is deterministically triggered on the second loop iteration; there is no race or uncontrolled state.\nPR:L - Triggering only requires an unprivileged local process with access to the RDMA verbs device — the normal configuration on RDMA-enabled hosts — and no CAP_* check exists on the create-QP path.\nUI:N - The attacker performs all steps via its own verbs calls; no action by another user is required.\nS:U - The corruption stays within the kernel's own memory/security authority and does not cross a VM/IOMMU/sandbox boundary.\nC:H - The overwrite leaks/dangles objects in cq_table[], and a use-after-free on these IRQ-dispatched structures can be leveraged to read kernel memory contents.\nI:H - The driver \"goes on to corrupt the kernel,\" leaving dangling function-pointer/context entries in a table called from interrupt context, providing a write/control-flow corruption primitive.\nA:H - The user-triggerable WARN_ON panics the system when panic_on_warn is set, and the subsequent kernel state corruption causes oopses/crashes regardless."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46117","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46145","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only by issuing RDMA verbs to the local /dev/infiniband/uverbs* character device; `rx_hash_key_len` arrives via `ib_copy_from_udata` from a local process, with no remote network path.\nAC:L - The attacker directly controls `rx_hash_key_len` in the uAPI struct and can set it arbitrarily large to trigger the overflow on every call; there is no race or condition outside the attacker's control.\nPR:L - Reaching the raw-packet QP path requires CAP_NET_RAW, but that is a narrow, non-root capability (not the \"real root/admin\" bar for High) and is routinely granted to unprivileged networking/RDMA applications such as DPDK workloads.\nUI:N - The overflow is triggered entirely by the attacker's own QP-creation request; no action by any other user is required.\nS:U - The corruption is of the kernel's own heap allocation within the same kernel security authority; no crossing into a separate scope (VM/IOMMU) occurs.\nC:H - The memcpy over-reads the 40-byte stack source by an unbounded amount and the heap overflow can be leveraged to disclose adjacent kernel memory, so confidentiality impact is High.\nI:H - An attacker-controlled-length memcpy writes past a 40-byte heap field, giving a heap out-of-bounds write that corrupts adjacent kernel objects and is exploitable toward arbitrary write/control-flow hijack.\nA:H - A large `rx_hash_key_len` corrupts the kernel heap and/or faults reading unmapped stack/heap pages, reliably causing a kernel panic/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46145","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46174","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in the CPU's op cache and requires executing instructions on the affected core to drive improper resource sharing; it is not reachable over a network. Triggering it needs local code execution on the machine.\nAC:L - An attacker who can co-schedule code on SMT siblings of an affected Zen2 core controls both sides of the shared op-cache contention and can reliably drive the improper-isolation condition. Following the higher-severity rule, this is Low.\nPR:L - Triggering the op-cache resource sharing only requires the ability to run code (an unprivileged local user or a guest VM tenant); no root or admin capability is needed. It does, however, require at least some local execution access, so not None.\nUI:N - The attacker's own executing code populates and contends for the op cache; no victim action is required.\nS:C - The bug is an isolation failure of a microarchitectural resource shared across SMT threads, so instruction corruption can cross from the attacker's context into a different security authority (another VM/tenant or the host kernel), impacting resources beyond the attacking component's scope.\nC:H - Improper isolation of a shared op-cache resource is an information-disclosure vector across contexts, and the resulting instruction corruption can be leveraged to read memory belonging to another security domain.\nI:H - The defining impact is \"instruction corruption\" — the CPU executes corrupted/wrong instructions in a victim context, which is a direct, severe integrity violation enabling control-flow and data corruption across the isolation boundary.\nA:H - Instruction corruption causes incorrect execution, crashes, and hangs in the affected (potentially cross-context) code, resulting in high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46174","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46243","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local `request_key(2)` or `add_key(2)` from an unprivileged process; the flaw is missing origin validation in the keyring path, not remote SMB/CIFS protocol input.\nAC:L - On typical affected systems (CIFS module with upcall, cifs-utils request-key rule, unprivileged user/mount namespaces), the attacker fully controls the forged description, target pid, and namespace layout for a reliable root upcall chain.\nPR:L - Any local unprivileged user account can invoke the key syscalls; user/mount namespaces are part of the standard exploit setup and map to basic local user capability, not root-only access.\nUI:N - No victim action such as mounting a Kerberos CIFS share is required; the attacker forges the key request directly without depending on another user’s mount or session.\nS:U - Successful exploitation elevates privileges within the same host/kernel security domain (local root) and does not cross a VM/hypervisor or hardware isolation boundary by itself.\nC:H - The attack chain yields root-equivalent access in the root upcall helper, enabling arbitrary read of host data (full confidentiality compromise of the system).\nI:H - Malicious NSS modules run as root inside `cifs.upcall`, giving arbitrary code execution and full integrity compromise of the host, not merely limited data modification.\nA:N - The kernel bug is a trust-boundary failure without memory corruption or guaranteed kernel panic; primary impact is privilege escalation rather than kernel crash or sustained denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46243","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46323","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local attacker to inject zerocopy/managed-frags skbs via io_uring SEND_ZC, TUN/TAP, or similar local APIs; ordinary remote wire packets processed by GRO do not carry SKBFL_MANAGED_FRAG_REFS, so a network-only attacker cannot reach the buggy merge path.\nAC:L - The attacker fully controls both sides of the GRO merge (seed and zerocopy TCP segments over a veth pair), timing (netem delay, RST race), and buffer setup; a public working LPE exploit exists, so success does not depend on conditions outside attacker control.\nPR:L - Triggering requires only a basic unprivileged local account with io_uring and user-namespace access (unshare -Urn), which is the default on many distributions; no init-namespace root or CAP_NET_ADMIN is needed.\nUI:N - No victim user action is required; the attacker drives the entire exploit autonomously through syscalls and local network namespace setup.\nS:U - Impact is standard host-kernel privilege escalation (root on the same kernel); it does not cross a distinct hypervisor/IOMMU security boundary such as VM-guest-to-host escape.\nC:H - The flaw is a use-after-free on page structures; the known exploit leverages the refcount underflow to obtain stale read access to freed physical pages and extract kernel PTE contents, enabling arbitrary memory disclosure primitives.\nI:H - UAF page refcount corruption enables crafting writable PTE entries against read-only page-cache pages; the public exploit demonstrates integrity compromise by rewriting /etc/passwd and obtaining root via su.\nA:H - Use-after-free of page structures can cause kernel oops/panic during skb teardown; even failed exploitation attempts can crash the system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46323","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46324","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in nf_tables netdev hook teardown reached only via Netfilter netlink (nft) syscalls—chain/flowtable updates, dumps, netns teardown, and netlink socket release—not from remote packet handling alone. Per kernel guidance, nftables/netfilter is Local (L).\nAC:L - Exploitation is a race between hook-list removal (`list_del()` + RCU free) and concurrent RCU walkers (`nft_dump_basechain_hook_list`, flowtable dump, or packet-path `list_for_each_entry_rcu`). An attacker with CAP_NET_ADMIN can drive both sides concurrently (e.g., one thread dumping chains/flowtables while another deletes hooks or tears down the netns).\nPR:L - All nf_tables netlink operations are gated by `netlink_net_capable(skb, CAP_NET_ADMIN)` in `nfnetlink_rcv()`. CAP_NET_ADMIN is obtainable by an unprivileged user via user+network namespaces (`unshare -Urn`), not real init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers hook teardown and concurrent dumps or traffic entirely through their own netlink sockets and namespace lifecycle.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries.\nC:H - Using `list_del()` instead of `list_del_rcu()` on lists walked under `rcu_read_lock()` is a use-after-free/list-corruption bug; concurrent dumpers dereference `nft_hook` fields (e.g., `ifname`) after unlink/free, enabling arbitrary kernel memory read via heap grooming.\nI:H - The freed `nft_hook` kmalloc object can be reallocated and corrupted through the dangling RCU list pointers, providing a standard kernel UAF primitive exploitable for arbitrary write and control-flow hijacking.\nA:H - The race reliably causes kernel list corruption and use-after-free, leading to oops/panic during hook dumps, flowtable lookups, or netns cleanup; UAF in this path has inherent high availability impact even when not fully weaponized."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46324","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46333","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable authorization check is reached through local interfaces such as ptrace-style checks, procfs, and pidfd_getfd; it is not reachable from network packets or adjacent/physical input.\nAC:L - A local attacker can repeatedly trigger the relevant check and, for exiting tasks, can race pidfd_getfd/procfs access against a target's exit path after exit_mm() but before exit_files(). The race is attacker-driven and does not require unusual kernel configuration or conditions outside the attacker's influence.\nPR:L - An unprivileged local user can target same-UID nondumpable tasks because the vulnerable code skips the dumpability requirement once task->mm is NULL. User-namespace root does not help against init-namespace root kernel threads, but low local privileges are enough for the same-UID exiting-task case.\nUI:N - Exploitation does not require a victim user to open a file or perform an interactive action; the attacker can use local syscalls/procfs against an existing or attacker-terminated target task.\nS:U - The bug bypasses Linux kernel task-access authorization within the same OS security authority. It does not cross a VM, IOMMU, or hypervisor boundary.\nC:H - The bypass can allow access to sensitive task details and, most importantly, pidfd_getfd can duplicate file descriptors from a nondumpable task during the exit window. In a plausible helper/sandbox scenario, those descriptors can expose highly sensitive files or privileged resources.\nI:H - If the duplicated descriptor is writable, the attacker can modify the protected resource reachable through the victim's file descriptor despite the dumpability restriction. This is a high-impact integrity bypass even though the bug is not memory corruption.\nA:N - The issue is an access-control bypass around ptrace/dumpability checks and does not by itself provide a kernel crash, hang, deadlock, or sustained denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46333","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52967","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable SMB client parser consumes an SMB2 CREATE error response supplied by a remote SMB server over the network. A malicious or compromised SMB share can send the crafted `STATUS_STOPPED_ON_SYMLINK` response.\nAC:L - The server directly controls `ErrorContextCount`, `ByteCount`, `ErrorId`, and `ErrorDataLength`, and no race or hard-to-hit state is required. Although the wraparound behavior is 32-bit specific, that is a deployment property rather than an attacker-uncontrolled exploitation condition.\nPR:N - The attacker needs no privileges on the victim system; they only need to operate or control the SMB server endpoint that the client connects to. The path can also be reached through guest or null-auth SMB sessions.\nUI:R - The victim client must mount/connect to the SMB share and perform a path operation such as lookup, stat, open, or create that causes an SMB2 CREATE response to be parsed. The remote server cannot trigger this parser without client-side filesystem activity.\nS:U - The affected component is the Linux kernel SMB client, and the impact is to the same kernel/client security authority. This is not a VM escape, IOMMU bypass, or cross-scope sandbox escape.\nC:H - The bug is an out-of-bounds kernel read in a server-controlled response parser, and the read is not strictly bounded to only a few harmless bytes. Following the required conservative rule, this is scored as high confidentiality impact.\nI:N - The defect advances a parser pointer incorrectly and reads from the wrong location, but it does not write out of bounds or provide a kernel memory write primitive. No direct integrity impact beyond normal malicious-server control of SMB content was identified.\nA:H - The crafted length can make the parser loop indefinitely on 32-bit systems, causing a reliable denial of service. Other malformed pointer positions can also lead to invalid kernel reads and possible oops conditions."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52967","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52986","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable SIP conntrack helper parses SIP payload carried in TCP/UDP network packets once the SIP helper is enabled, which is a reasonable deployment for NAT/firewall SIP gateways. A remote SIP peer can send crafted packets to that packet-processing path.\nAC:L - The trigger is a malformed numeric SIP field or URI port at the parser buffer boundary; no race or victim-controlled timing is required. Helper/NAT configuration is an environmental prerequisite, not an attacker-controlled complexity condition.\nPR:N - In the network gateway scenario, the attacker only needs to send unauthenticated SIP traffic through a system using the SIP conntrack helper. No local account or kernel privilege is required.\nUI:N - Exploitation is driven by packet processing in netfilter/conntrack. No user action is needed after the affected helper is configured.\nS:U - The impact is within the kernel/network stack security authority of the vulnerable system. It does not cross a separate scope such as guest-to-host or IOMMU isolation.\nC:H - The bug is an unbounded out-of-bounds read from non-NUL-terminated skb data via simple_strtoul and missing limit checks. Following the required guidance, an unbounded OOB read is high confidentiality impact.\nI:H - In NATed SIP paths, an out-of-bounds parser end pointer can feed attacker-influenced match lengths into NAT packet mangling, whose memmove/memcpy path lacks a bounds check against the skb payload. That creates a defensible kernel memory-corruption/code-execution risk.\nA:H - The same OOB read and possible invalid NAT mangle lengths can cause kernel faults, skb corruption, or panic. Crafted packets can be sent repeatedly, so availability impact is high."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52986","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53050","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local filesystem quota activity on a mounted OCFS2 filesystem, via ordinary dquot lifetime changes racing with the OCFS2 quota sync worker. It is not reachable by remote packets or adjacent/physical input.\nAC:L - This is a race, but a local attacker can repeatedly churn dquot references with filesystem operations while the periodic scanner runs. When uncertain, the higher-severity AC:L is appropriate.\nPR:L - After OCFS2 quotas are enabled, an unprivileged local user with write access to the filesystem can trigger dquot allocation and release paths. Mounting/configuring quotas is an environmental prerequisite, not a privilege needed for each exploit attempt.\nUI:N - No victim interaction is required once the affected filesystem is mounted and quotas are active. The attacker can trigger the relevant filesystem operations directly.\nS:U - The impact remains within the kernel and the same host security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The bug can lead to use-after-free of a dquot object under memory pressure. Kernel UAF conditions can be leveraged for memory disclosure, so confidentiality impact is High.\nI:H - The stale dquot/list state creates kernel heap use-after-free/list corruption, which can plausibly be shaped into write primitives or code execution. Integrity impact is therefore High.\nA:H - The race already produces kernel WARN/oops-style failure conditions and can dereference freed kernel objects. This can crash or destabilize the kernel, so availability impact is High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53050","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53131","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.4,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable netfilter match, ipset, and logging paths run while processing packets in receive/netdev hooks. In a reasonable firewall, router, VPN, or tunnel deployment with these rules installed, unauthenticated remote packets can reach the vulnerable code.\nAC:L - No race or difficult timing is required; a packet reaching a vulnerable rule with an invalid, unset, non-Ethernet, or too-short MAC header deterministically drives the bad eth_hdr(skb) access. The needed rule/interface setup is a plausible deployment condition, not an exploit race.\nPR:N - The remote packet sender does not need credentials or local privileges once the affected rule or logger is configured. Although rule installation requires CAP_NET_ADMIN, that is not required for the runtime remote-trigger scenario.\nUI:N - Exploitation is triggered by packet processing and does not require a victim user to open a file, mount anything, or perform another action.\nS:U - The impact remains within the kernel/network stack security authority. There is no VM, IOMMU, or separate sandbox boundary crossing.\nC:H - The flaw causes invalid or out-of-bounds reads from the skb MAC header, and those bytes can be copied into logs/ipset state or influence observable match behavior. Per the required guidance, out-of-bounds reads are scored High when not proven strictly harmless.\nI:L - The primitive is a read rather than an arbitrary write or control-flow hijack. However, the wrongly read MAC bytes can influence firewall matches and ipset add/delete/test behavior, giving limited integrity impact.\nA:H - Invalid eth_hdr(skb) access can produce slab out-of-bounds/KASAN reports or kernel oops/panic conditions, and packets can be sent repeatedly. Kernel crashes are High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53224","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - An unauthenticated remote SCTP peer can reach the vulnerable COOKIE_ECHO processing path by sending SCTP packets to a listening SCTP endpoint. In deployments with cookie HMAC disabled, the attacker can obtain and modify the state cookie over the network.\nAC:L - The bug is triggered with a malformed COOKIE_ECHO and attacker-controlled embedded INIT/address-list lengths; no race or hard-to-control timing condition is required. The no-cookie-auth deployment condition is a reasonable supported SCTP configuration.\nPR:N - No credentials or local privileges are needed to send SCTP INIT/COOKIE_ECHO traffic to a listening service. The vulnerable parsing occurs before any application authentication.\nUI:N - Exploitation only requires sending network packets to the target SCTP endpoint. No victim user action is required.\nS:U - The impact is within the kernel/network stack security authority of the target system. It does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The malformed lengths can drive out-of-bounds kernel reads beyond the COOKIE_ECHO payload, including attacker-controlled oversized address-list parsing. Because the read is not strictly bounded to a few bytes and related SCTP COOKIE_ECHO bugs demonstrate kernel memory leakage potential, confidentiality impact is High.\nI:N - The investigated fix addresses out-of-bounds reads and missing length validation, not an out-of-bounds write or direct arbitrary memory modification primitive. I did not find a defensible direct integrity impact from this bug alone.\nA:H - The attacker-controlled out-of-bounds reads can walk beyond the skb/cookie buffer and fault or trigger KASAN/oops conditions. A remotely triggerable kernel crash is High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53224","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53246","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable COOKIE_ECHO processing is reached by remote SCTP packets delivered through the IPv4/IPv6 SCTP protocol handlers to a listening SCTP endpoint.\nAC:L - In a deployment with SCTP cookie HMAC disabled, the attacker can obtain a cookie through the normal INIT/INIT_ACK exchange, modify the cached INIT length, and send the forged COOKIE_ECHO without races or conditions outside attacker control.\nPR:N - The path is pre-authentication network protocol handling for a listening SCTP server; no local account or SCTP authentication is required when cookie HMAC is disabled.\nUI:N - Exploitation only requires sending SCTP handshake packets to the target listener and does not require victim user action.\nS:U - The impact is within the Linux kernel/network stack security authority and does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The inflated cached INIT length drives out-of-bounds parameter walking and attacker-sized kmemdup() reads beyond the received skb, which can expose kernel memory.\nI:H - The bug is kernel memory-safety corruption during nested parameter handling, and the higher-severity choice is appropriate because attacker-controlled parsing and copies beyond the valid buffer can corrupt kernel association state and plausibly support stronger primitives.\nA:H - The out-of-bounds reads and large attacker-controlled copies can trigger kernel faults, KASAN splats, allocation failure paths, or repeated remote crashes of SCTP processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53246","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53250","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached by a local process using AF_XDP socket setup, UMEM registration, TX ring submission, and send/poll-driven transmit; it is not reachable directly from remote network packets.\nAC:L - The attacker controls the UMEM metadata and can trigger TX from the same process, so the TOCTOU race can be created with attacker-controlled concurrent writes.\nPR:L - AF_XDP socket creation requires CAP_NET_RAW in the relevant network namespace, which is attainable by a low-privileged local user in user/network namespace deployments.\nUI:N - No victim action is needed after the attacker has local execution; the attacker sets up the socket, UMEM, metadata, and transmit operation directly.\nS:U - The vulnerability corrupts or reads kernel networking memory within the same kernel security authority; this is standard local kernel attack surface, not a VM or hardware boundary crossing.\nC:H - Racing csum_start/csum_offset can bypass validation and drive out-of-bounds checksum reads in kernel transmit checksum handling, so potential kernel memory disclosure is high.\nI:H - The same unvalidated checksum offsets can cause checksum writes to an attacker-influenced out-of-bounds location relative to skb data, making kernel memory corruption plausible.\nA:H - The out-of-bounds memory access in the kernel transmit path can trigger warnings, faults, or kernel crashes and can be repeatedly exercised by the local attacker."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53250","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53262","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through a local `ioctl()` on a connected PPPoL2TP `AF_PPPOX` socket. Remote L2TP packets do not invoke `pppol2tp_ioctl()`.\nAC:L - The attacker controls both sides of the race by blocking `copy_from_user()` in the ioctl thread and closing the same socket concurrently. No external victim state is required.\nPR:L - A local unprivileged user can reach the PPPoL2TP socket/ioctl path; L2TP management also uses user-namespace admin permissions rather than requiring real init-namespace root. This is not remotely reachable without local code execution.\nUI:N - No victim action is required after the attacker runs local code. The attacker creates/connects the socket, issues the ioctl, and closes the socket.\nS:U - The impact is within the kernel security authority on the same system. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel heap use-after-free of `struct l2tp_session`, and the resumed ioctl can read from reclaimed/faked session and tunnel data before copying results to userspace. Per conservative kernel UAF scoring, this supports high confidentiality impact.\nI:H - Kernel UAFs with attacker-controlled timing and heap reuse can be leveraged beyond a simple stale read, including corruption or control-flow primitives. When uncertain, the higher severity option is appropriate.\nA:H - At minimum, dereferencing the stale session or tunnel pointer can trigger a kernel oops or panic. The attacker can repeatedly trigger the race locally."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53262","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53267","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached by installing crafted nftables/netfilter rules through NETLINK_NETFILTER and then triggering packet evaluation locally. Remote packets alone cannot install the rule, so this is a local attack vector.\nAC:L - A single crafted rule sequence such as `ct zone set` followed by `ct original saddr` can deterministically trigger the bug on matching packets. No race or external condition beyond the attacker's control is required.\nPR:L - Rule creation requires CAP_NET_ADMIN for the relevant network namespace via nfnetlink. Because nftables is reachable with CAP_NET_ADMIN in a user-created network namespace on systems permitting unprivileged user namespaces, this is low privileges rather than high.\nUI:N - After the attacker installs the crafted rule, triggering occurs through packet processing without any victim user action. No user needs to open a file, mount anything, or interact with attacker-controlled content.\nS:U - The bug corrupts kernel memory during kernel packet-filter evaluation and impacts the same kernel security authority. This is standard kernel privilege escalation/DoS behavior, not a VM, IOMMU, or distinct security-scope escape.\nC:H - The bug is a kernel stack out-of-bounds write past `struct nft_regs`, a memory corruption primitive. Under the required higher-severity rule, such memory corruption is defensibly treated as capable of enabling high confidentiality impact.\nI:H - The vulnerable 16-byte memcpy can overwrite beyond the validated destination register on the kernel stack. Out-of-bounds kernel writes are high integrity impact because they can plausibly be developed into control-flow or privilege-modification primitives.\nA:H - The stack overwrite can corrupt adjacent stack state or registers during packet evaluation and can crash or oops the kernel. Kernel crash or panic is high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53267","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53354","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable TLBI completion path is reachable by locally executing code that drives memory permission/unmap activity through syscalls or guest/KVM memory-management activity. It is not directly exposed by network packets.\nAC:L - Although the erratum depends on timing, the attacker can repeatedly arrange concurrent stores and translation invalidations on affected multicore Arm systems. The triggering race is therefore attacker-influenced rather than dependent on a one-off external condition.\nPR:L - A basic unprivileged local user or guest workload can reach the relevant Stage-1/Stage-2 TLBI paths without host administrative privileges. No real root capability in the init namespace is required.\nUI:N - After the attacker has local code execution, exploitation only requires attacker-driven memory operations/syscalls or guest activity. No separate victim action is needed.\nS:C - In a severe reasonable deployment such as Arm KVM/cloud virtualization, bypassing Stage-2 or higher-level translation protections can let guest-controlled writes affect hypervisor/host resources. That crosses a security authority boundary.\nC:H - The primitive can enable privilege escalation to kernel or hypervisor context, making protected memory and secrets accessible. Even though the erratum affects stores, successful control of privileged context supports high confidentiality impact.\nI:H - The core issue permits writes to memory after translation permissions or ownership should have been revoked. This is a high-integrity memory corruption primitive with plausible kernel or hypervisor privilege escalation.\nA:H - Incorrect late writes into protected or reused memory can corrupt kernel/hypervisor state. Failed exploitation or corruption can plausibly cause kernel panic, guest/host crash, or system instability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53354","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53375","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through the AMDGPU_CS DRM ioctl on a render node (/dev/dri/renderD*), requiring local access to submit crafted VCE indirect buffers to the GPU driver.\nAC:L - An attacker fully controls the VCE command stream and per-command length fields, and can reliably craft commands where exactly one relocation index is out of bounds (e.g., 0x0500000d with len=32) to trigger partial address patching.\nPR:L - Exploitation requires only unprivileged local access to the amdgpu DRM render node; AMDGPU_CS is gated by DRM_AUTH|DRM_RENDER_ALLOW, not root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the entire malicious command submission through the render node.\nS:C - Partial address patching causes VCE firmware to DMA using attacker-influenced GPU addresses outside the intended buffer object boundaries, crossing the GPU memory/DMA isolation boundary that the relocation logic is meant to enforce.\nC:H - VCE firmware performs DMA reads using the malformed 64-bit address, enabling arbitrary reads from GPU-accessible memory regions (including GTT-mapped system memory) beyond the validated buffer scope.\nI:H - VCE firmware performs DMA writes (encoded bitstreams, feedback, and context buffers) to attacker-influenced addresses, enabling arbitrary GPU-mapped memory corruption and potential privilege escalation primitives.\nA:H - Submitting commands with malformed firmware addresses can cause GPU page faults, driver hangs, GPU resets, or kernel oops/panic when the VCE engine accesses invalid memory regions."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53375","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53388","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local syscalls: mounting a FUSE filesystem, reading files to trigger readpages, and the FUSE daemon writing replies to /dev/fuse via splice_write with SPLICE_F_MOVE.\nAC:L - The race is between the attacker's own splice reply and a concurrent abort they trigger (e.g., via sysfs abort or unmount); the attacker controls both threads and can retry until the window is hit.\nPR:L - Exploitation requires mounting and operating a FUSE filesystem via /dev/fuse, which needs local user privileges; on typical systems this is reachable by unprivileged users via user namespaces (CAP_SYS_ADMIN in a user namespace) without init-namespace root.\nUI:N - No victim interaction is required; the attacker mounts the filesystem, runs the FUSE daemon, and triggers the concurrent abort themselves.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as guest-to-host or sandbox breakout.\nC:H - The vulnerability is a use-after-free of fuse_io_args and associated folio pointers in kernel heap memory, which can be leveraged for arbitrary kernel memory read via heap reuse.\nI:H - Use-after-free of fuse_io_args enables heap spraying and controlled reuse of freed kernel objects, providing a path to arbitrary kernel memory write or code execution.\nA:H - The UAF and the race with folio replacement can cause kernel oops/panic, including NULL pointer dereference when fuse_readpages_end accesses a folio with a NULL mapping."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53388","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53391","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The crash is triggered by processing a malicious GETDEVICEINFO RPC response from an NFS metadata server over the network, on the standard NFSv4 client path used by pNFS file and flexfile layouts.\nAC:L - Once a victim is a pNFS client, the attacker reliably triggers the bug by sending a GETDEVICEINFO body with a zero-length r_netid or r_addr opaque; no race or special memory layout is required.\nPR:N - The attacker acts as (or compromises) the remote NFS metadata server and needs no local privileges on the victim client; exploitation is delivered entirely through NFS protocol responses to an already-established mount.\nUI:N - In the highest-impact scenario—a compromised enterprise/HPC metadata server or autofs-managed pNFS mount—no further victim action is needed beyond normal file I/O that provokes GETDEVICEINFO.\nS:U - The vulnerability causes a kernel panic on the NFS client itself and does not cross a security boundary such as a VM escape or sandbox breakout.\nC:N - This is a NULL pointer dereference in strrchr() with no out-of-bounds read or use-after-free; it does not disclose kernel memory or attacker-controlled data.\nI:N - There is no memory corruption, arbitrary write, or control-flow hijack primitive—only an immediate NULL dereference that terminates kernel execution.\nA:H - The NULL pointer dereference in kernel context causes an oops or panic, fully denying availability of the affected client (and any co-hosted workloads until reboot)."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53391","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53402","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the KDFONTOP ioctl on a framebuffer-console virtual terminal (/dev/ttyN), which is a local syscall path with no network or physical-access vector.\nAC:L - An attacker who controls a session on an fbcon-backed VT can reliably trigger the bug by issuing a font-change ioctl with different dimensions and a 256↔512 glyph transition, then inducing vc_resize() failure through self-controlled memory pressure; no race or victim-dependent timing is required.\nPR:L - KDFONTOP font-set operations require only that the caller owns the controlling TTY (current->signal->tty == tty), which any unprivileged local user with a console or VT session has; CAP_SYS_TTY_CONFIG is not required on that path.\nUI:N - Exploitation requires only the attacker's own ioctl and memory-pressure actions on their TTY; no action by another user or administrator is needed.\nS:U - Impact is confined to kernel memory disclosure and potential kernel crash within the same kernel security authority; there is no VM escape, sandbox escape, or cross-security-boundary effect.\nC:H - The desynchronized hi_font_mask causes deterministic out-of-bounds reads from the kernel font glyph buffer during fbcon rendering (e.g., bit_cursor and rotated putcs paths), enabling disclosure of adjacent kernel memory.\nI:N - The flaw is an out-of-bounds read with console state desynchronization; it does not provide an arbitrary kernel write, code execution, or other data-modification primitive.\nA:H - Out-of-bounds reads from kernel font data can cause kernel page faults and oopses, consistent with the prior syzkaller-reported fbcon font/resize failure class that produced unhandled page faults."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53402","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63802","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local cgroup management (rmdir on cgroupfs) and concurrent block I/O to populate per-blkcg rstat lists; the vulnerable code is in the block cgroup teardown path, not in any network protocol handler.\nAC:L - The attacker controls both sides of the race by issuing I/O on multiple block devices to create multiple blkgs with pending stats, then concurrently destroying the cgroup to trigger parallel blkg_release() calls on multiple CPUs.\nPR:L - Triggering cgroup deletion and block I/O requires only delegated cgroup write access or namespace/container root (CAP_SYS_ADMIN in a user namespace), not init-namespace root; this is routinely available in containers, Kubernetes pods, and systemd user cgroup hierarchies.\nUI:N - No victim interaction is required; the attacker programmatically performs I/O and cgroup teardown from their own process or container.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it does not inherently cross a VM, container, or IOMMU boundary without a separate privilege-escalation step.\nC:H - The use-after-free dereferences freed blkg structures and associated iostat data during list iteration, enabling arbitrary kernel memory read primitives typical of slab UAF bugs.\nI:H - UAF on kmalloc-allocated blkg objects allows heap grooming and write through dangling pointers, which can be leveraged for arbitrary kernel memory modification or code execution.\nA:H - Concurrent use-after-free during blkg teardown can cause immediate kernel oops/panic from accessing freed memory, and repeated triggering enables reliable denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63802","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63806","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - A malicious KVM guest triggers this via guest-executed MMIO stores handled by the x86 instruction emulator (KVM_RUN → vmx_handle_exit → kvm_mmu_page_fault → x86_emulate_instruction → emulator_read_write → vcpu_mmio_write → ioeventfd_write), not via remote network input to the host.\nAC:L - The guest fully controls the spanning store address, size, and timing; with standard QEMU/virtio datamatch ioeventfd MMIO layouts, a page-boundary write reliably reaches ioeventfd_in_range() with a misaligned val pointer and fires the BUG_ON().\nPR:N - Exploitation requires only unprivileged code execution inside an already-running guest VM (reproducer ran as UID 1000); no host capabilities, KVM ioctls, or guest root are needed beyond what any cloud VM tenant or compromised guest process already has.\nUI:N - No victim interaction is required once the attacker can run code in a KVM guest with a datamatch ioeventfd configured, which is the default virtio/QEMU setup.\nS:C - The vulnerable component is the host kernel KVM subsystem, but exploitation is initiated from a guest VM and causes a host kernel BUG/oops, crossing the hypervisor security boundary.\nC:N - The failure mode is an explicit BUG_ON() alignment check before any datamatch comparison; there is no out-of-bounds read, use-after-free, or other memory corruption that could disclose host data.\nI:N - The bug triggers a deliberate kernel BUG and does not corrupt or modify host memory; it is a crash-only denial-of-service with no integrity impact.\nA:H - A guest-triggered BUG_ON() in ioeventfd_write() causes a host kernel oops/panic, denying availability of the entire physical host and all co-resident VMs on multi-tenant KVM hypervisors."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63807","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the KVM VM file descriptor ioctl path (KVM_SET_USER_MEMORY_REGION), which requires local syscall access to /dev/kvm rather than any network-facing protocol.\nAC:L - An attacker with KVM access can deterministically set up the required state (partial hugepage memslot, dirty logging enabled then disabled, guest hugepage mapping extending below slot bounds) and trigger the bug without depending on conditions outside their control.\nPR:L - Exploitation requires only local access to /dev/kvm and control of a VM (e.g., membership in the kvm group), as demonstrated by the reproducer running as UID 1000; it does not require host root in the init namespace.\nUI:N - No victim user interaction is required beyond the attacker issuing the KVM ioctl to disable dirty logging on a memslot they control.\nS:C - The vulnerable KVM x86 MMU code runs in the host kernel and a VM operator can corrupt or crash host kernel memory from their guest/VM management context, crossing the guest-to-host virtualization security boundary.\nC:H - The bug is an out-of-bounds kernel read of memslot lpage_info metadata via an invalid gfn index in kvm_mmu_max_mapping_level(), which per kernel guidance qualifies as high confidentiality impact even though it typically manifests as a page fault.\nI:H - Out-of-bounds access to kernel heap metadata in the KVM MMU subsystem can potentially be steered for memory corruption and control-flow influence; similar KVM shadow MMU memory safety bugs are scored at high integrity impact.\nA:H - The vulnerability reliably causes a host kernel oops/page fault (supervisor read to non-present vmalloc address) when triggered, constituting high availability impact via host kernel crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63807","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63824","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reachable only through the keyctl(2) syscall (KEYCTL_PKEY_ENCRYPT, KEYCTL_PKEY_DECRYPT, or KEYCTL_PKEY_SIGN); there is no network, adjacent, or physical attack path to the affected code.\nAC:L - An attacker fully controls the undersized out_len parameter and can reliably trigger the bug on demand with no races or victim-dependent state; CONFIG_ASYMMETRIC_KEY_TYPE is commonly enabled on server and desktop kernels.\nPR:L - Exploitation requires KEY_NEED_SEARCH on an asymmetric key, which any unprivileged local user can satisfy by loading their own RSA/EC key into a session keyring; no real root or init-namespace capabilities are needed.\nUI:N - Exploitation requires only attacker-initiated keyctl calls and does not depend on any victim user action such as opening a file or mounting a filesystem.\nS:U - Impact is confined to kernel heap memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - When out_len is smaller than the cryptographic output (including out_len=0 where kmalloc(0) yields ZERO_SIZE_PTR), asym_eds_op returns the full primitive output size and copy_to_user reads far beyond the allocated buffer, leaking adjacent kernel heap contents to userspace.\nI:H - The undersized kmalloc buffer is passed directly as the crypto output target; asymmetric operations can write up to the primitive maximum (hundreds of bytes for RSA-4096) past the allocation, enabling heap corruption and potential control-flow hijacking.\nA:H - Heap out-of-bounds read/write against kmalloc objects or writes through ZERO_SIZE_PTR can cause kernel oops, panic, or KASAN-detected corruption, satisfying high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63824","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63829","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires sending RTM_NEWLINK changelink requests over rtnetlink (netlink socket), matching the kernel guidance that tc/netlink configuration paths are Local.\nAC:L - Once a cross-namespace GRE/ERSPAN device is present in the caller's netns, triggering the bug is a single deterministic netlink changelink with no races or attacker-uncontrollable timing.\nPR:L - The rtnl entry path requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user can obtain inside a user namespace via unshare --user --map-root-user --net without real init-namespace root.\nUI:N - Exploitation is fully programmatic through netlink; no victim user action such as opening a file or mounting a filesystem is required.\nS:C - The changelink mutates tunnel state in t->net while authorization is checked only against dev_net(dev), crossing from the attacker's net/user namespace into another tenant's or the host's network namespace tunnel tables.\nC:H - An attacker can rewrite IFLA_GRE_REMOTE/LOCAL, keys, and related tunnel parameters to redirect GRE/ERSPAN traffic through attacker-controlled endpoints and read tunneled payloads.\nI:H - Unauthorized changelink updates live tunnel fields (including collect_md and encap parameters parsed before the missing check), enabling arbitrary redirection or injection of traffic in the victim link netns.\nA:H - Rewriting tunnel endpoints, keys, or metadata handling can break production GRE/ERSPAN overlays and VPN paths, causing sustained loss of connectivity for dependent services."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63829","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63884","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local DRM ioctls on the Intel GPU render node (notably I915_GEM_EXECBUFFER2 and I915_GEM_MADVISE); there is no network, adjacent-radio, or physical-access entry path.\nAC:L - An attacker controls the triggering workload (concurrent execbuffers, madvise DONTNEED, and GPU memory pressure to force eviction), and the UAF is a deterministic stale-pointer bug rather than a race against uncontrollable system state.\nPR:L - Exploitation requires only access to the DRM render node and standard unprivileged GEM ioctls (DRM_RENDER_ALLOW); no CAP_SYS_ADMIN, DRM master, or init-namespace root is needed.\nUI:N - No victim interaction is required beyond the attacker (or a compromised local GPU client) issuing its own ioctl submissions to the render node.\nS:U - Successful exploitation yields kernel memory corruption and local privilege escalation within the same kernel security authority; it does not constitute a VM escape or IOMMU/DMA boundary bypass.\nC:H - This is a kernel heap use-after-free on a freed i915_ttm_tt structure; attacker-controlled reuse of the freed object can provide arbitrary kernel memory read primitives.\nI:H - UAF on the i915_ttm_tt/filp path enables heap grooming and corrupting kernel objects, providing a standard path to arbitrary kernel write and code execution.\nA:H - The vulnerability was observed causing a kernel general protection fault/oops under real workloads, and UAF in this path can reliably crash or hang the system even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63884","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63893","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:A - A malicious Thunderbolt XDomain peer (adjacent host, dock, or in-line device on a direct Thunderbolt/USB4 link) delivers crafted PROPERTIES_RESPONSE data that the victim kernel parses during automatic XDomain discovery.\nAC:L - The peer fully controls property entry value/length fields and can reliably craft the u32 wrap (e.g. value=0xffffff00, length=0x100) without races or special memory layout.\nPR:N - Exploitation requires no privileges on the victim system; the attacker only needs to be the connected XDomain peer responding to the kernel-initiated property exchange, with no authentication on that control-plane path.\nUI:N - Once a Thunderbolt XDomain link exists, property fetching and parsing run automatically in the kernel handshake state machine without any additional victim user action at exploitation time.\nS:U - Impact is confined to the victim kernel/userspace boundary (kernel heap disclosure to local sysfs and possible kernel crash); it does not cross VM, IOMMU, or sandbox security boundaries.\nC:H - Integer-wrap bypass enables an out-of-bounds kernel memory read of up to entry->length dwords, which for deviceid/vendorid TEXT properties is copied into world-readable sysfs attributes, disclosing kernel heap contents.\nI:N - The bug is an out-of-bounds read via parse_dwdata(); destination buffers are properly sized kcalloc allocations, so there is no out-of-bounds write or integrity modification of victim kernel structures.\nA:H - Reading from block+0xffffff00 dwords (~4 GB past the allocation) will access unmapped kernel addresses, causing a kernel fault/oops/panic in addition to any information disclosure."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63893","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63912","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the ESP outbound encryption path reached when IPsec-protected traffic is sent through xfrm (e.g., from an internet-facing VPN/tunnel gateway encrypting responses or forwarded flows to a remote peer). A network peer can influence outbound skb fragment sizes to hit the vulnerable fast path without local shell access.\nAC:L - An attacker can reliably craft payload sizes so ALIGN(skb->data_len) and ALIGN(tailen) each pass the broken per-field PAGE_SIZE gate while their combined aligned length exceeds PAGE_SIZE, repeatedly probing until the out-of-place page-frag path is taken.\nPR:N - Exploitation does not require configuring xfrm or host admin rights; it only needs the target to already run ESP and the attacker to send traffic that is encrypted on output (e.g., as a remote VPN/site-to-site peer), which is network-layer access rather than local OS privilege.\nUI:N - Triggering the vulnerable ESP output path requires only attacker-controlled network traffic and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - The flaw is a heap out-of-bounds write during AEAD encryption over an undersized page frag; such memory corruption can expose adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - Writing past the allocated page-frag buffer corrupts adjacent heap memory and can be developed into arbitrary write or control-flow hijack primitives, matching kernel guidance for out-of-bounds writes.\nA:H - Corrupting kernel heap memory during crypto output can cause immediate kernel oops/panic or persistent instability, and repeated triggering can deny service on VPN gateways and other IPsec endpoints."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63912","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63917","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through rtnetlink configuration (RTM_NEWLINK changelink and RTM_SETLINK netns move via `ip link`), not through remote packet handling on the vti6 tunnel itself.\nAC:L - Exploitation is a deterministic, attacker-controlled sequence (create vti6, move netns, changelink, delete netns) with no races or external victim state required.\nPR:L - The fix commit and rtnetlink path confirm reachability with CAP_NET_ADMIN inside an unprivileged user+network namespace (`unshare --user --map-root-user --net`), not init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug entirely through their own netlink operations.\nS:C - On container hosts, an unprivileged tenant can corrupt namespace teardown and panic the host kernel, impacting resources outside the attacker's security scope (other tenants and the host).\nC:H - The stale per-netns hash leaves `cleanup_net()`/`vti6_exit_rtnl_net()` walking freed `ip6_tnl` list nodes, constituting a use-after-free with arbitrary kernel memory read potential.\nI:H - Cross-netns hash corruption can leave dangling pointers and drive `unregister_netdevice_queue()` on already-freed devices (kernel BUG at net/core/dev.c:12376), enabling memory corruption exploitable for control-flow hijacking.\nA:H - The published reproducer reliably triggers a kernel BUG during namespace cleanup, causing host-wide denial of service via kernel panic/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63917","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63919","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable path is reached when IPsec ESP/AH packets are received and processed through xfrm_input transport-mode reinjection, which is a network packet receive path in net/xfrm. Remote peers can send ESP traffic to trigger deferred queueing on systems with IPsec configured.\nAC:L - The attacker controls both sides of the race by flooding IPsec packets to queue deferred reinjection work while concurrently destroying the network namespace, making the UAF reliably triggerable without conditions outside attacker control.\nPR:L - Exploitation requires configuring xfrm/IPsec and managing network namespace lifecycle, both reachable with CAP_NET_ADMIN obtainable by an unprivileged user via user namespaces (unshare -Urn), not requiring real root in the init namespace.\nUI:N - No victim user interaction is required; exploitation is achieved through automated packet transmission and namespace teardown scripted by the attacker.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The deferred callback dereferences a freed struct net (e.g., ip6_rcv_finish_core reads sysctl fields from the UAF pointer), providing an information disclosure primitive from attacker-influenced freed slab memory.\nI:H - Use-after-free on the large struct net slab object enables heap grooming and memory corruption exploitable for arbitrary kernel writes and control-flow hijacking, not merely a bounded modification.\nA:H - Dereferencing a freed network namespace structure causes kernel oops/panic from the workqueue callback path, and UAF reliably threatens system availability even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63919","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63921","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl(SIOCCHGTUNNEL) on a migrated vti6 netdev via socket/dev_ioctl; the bug is in vti6_siocdevprivate(), not in remote packet reception.\nAC:L - The attacker fully controls namespace creation, tunnel migration (IFLA_NET_NS_FD), and ioctl parameters to collide with a victim tunnel; the commit documents a deterministic, reproducible sequence with no uncontrollable race.\nPR:L - Only CAP_NET_ADMIN in the migrated (attacker) network namespace is required, obtainable via unprivileged user namespaces (unshare --user --map-root-user --net); the missing check against the creation namespace's user_ns is the core flaw.\nUI:N - No victim interaction is needed; the attacker performs all setup steps (create/migrate tunnel, issue SIOCCHGTUNNEL) autonomously.\nS:C - The attack hijacks IPsec/XFRM traffic destined for tunnels in a different tenant's network namespace on container hosts, crossing container/tenant security boundaries rather than staying within the attacker's own scope.\nC:H - After hash poisoning, xfrm receive delivers matched/decapsulated packets to the attacker-controlled netdev, enabling interception of victim VPN/IPsec traffic including potentially sensitive plaintext after decryption.\nI:H - The attacker gains control over which netdev receives victim tunnel traffic and can read, drop, or forward/modify decapsulated packets, constituting unauthorized manipulation of another tenant's network data path.\nA:H - Hijacking the creation-namespace hash bucket causes the legitimate victim tunnel to stop receiving matched traffic, producing denial of service to the victim's IPsec connectivity."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63921","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63922","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached on the standard IPv6 input path (ipv6_rcv → ip6_input → ip6_protocol_deliver_rcu → ipv6_destopt_rcv) when a remotely sent IPv6 packet carries a Destination Options header processed by ip6_parse_tlv().\nAC:L - The attacker fully controls the crafted IPv6 Destination Options layout (HAO TLV followed by trailing TLVs/padding); once CONFIG_IPV6_MIP6 and matching XFRM state exist on the target, triggering the stale-pointer condition is a reliable single-packet attack without races or victim-specific timing.\nPR:N - No local privileges or authentication are required; any remote host that can deliver IPv6 traffic to a listening interface can reach this pre-authentication receive-path parser (destopt_protocol uses INET6_PROTO_NOPOLICY).\nUI:N - Exploitation requires only sending a malicious IPv6 packet; no victim interaction such as opening files, clicking links, or mounting filesystems is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the kernel’s security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - After pskb_expand_head() frees the old skb head, ip6_parse_tlv() continues parsing trailing TLVs through the stale nh pointer, causing out-of-bounds/use-after-free reads of kernel heap memory that can disclose sensitive kernel data.\nI:H - Use-after-free of the skb head buffer during TLV parsing is heap memory corruption that can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a bounded parse error.\nA:H - Reading through the stale network-header pointer into freed or invalid memory can cause kernel oops/panic or unrecoverable instability, satisfying high availability impact even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63922","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63924","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPv6 input path (ipv6_rcv → ip6_rcv_core → ipv6_parse_hopopts) triggered by a crafted IPv6 packet with hop-by-hop options containing a Jumbo Payload TLV, reachable from any remote peer that can deliver IPv6 to the host.\nAC:L - An attacker fully controls the crafted IPv6 packet (HBH layout, jumbo length, trailing TLVs) and can send it repeatedly; once the skb is cloned/shared during receive and pskb_trim_rcsum reallocates the head, the stale-pointer UAF is deterministically triggered without races or victim-specific state.\nPR:N - No authentication or local privileges are required; any unauthenticated remote host that can send IPv6 traffic to a listening interface reaches the vulnerable receive handler with no capability or namespace checks along the path.\nUI:N - Exploitation requires only delivery of a malicious IPv6 packet and does not depend on any victim user action such as opening files, clicking links, or mounting filesystems.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary by itself.\nC:H - Continued HBH TLV parsing through the stale nh pointer is a use-after-free read of freed skb head memory, which per kernel guidance enables arbitrary kernel memory disclosure when the freed slab is reused.\nI:H - Stale-pointer UAF during TLV length/type parsing can yield unbounded out-of-bounds reads and corrupt subsequent parsing state, providing memory corruption primitives that can be developed into arbitrary kernel writes or code execution.\nA:H - Dereferencing the freed network-header pointer during TLV parsing can cause immediate kernel oops/panic from invalid memory access, and UAF-triggered parsing errors reliably drop or crash the receive path."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63924","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63946","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when the kernel processes inbound Bluetooth LE ISO data (HCI_ISODATA_PKT) from a remote peer over the radio; per kernel guidance Bluetooth is Adjacent, not Network.\nAC:L - An attacker can reliably win the race by flooding ISO frames while concurrently closing the ISO socket (or inducing disconnect that triggers stack teardown), controlling both the receive path and the iso_sock_kill() teardown path.\nPR:N - Exploitation requires only an established ISO connection with a malicious adjacent Bluetooth device; the vulnerable receive path needs no local privileges, and socket teardown can occur automatically when the remote peer disconnects.\nUI:N - No victim interaction is required during exploitation; ISO socket closure on disconnect is handled automatically by the Bluetooth stack and userspace daemons without user action.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The use-after-free dereferences freed struct sock memory (sk->sk_state) after iso_sock_kill() can sock_put() the socket, enabling arbitrary kernel memory read primitives via heap reuse.\nI:H - The UAF continues into sock_queue_rcv_skb() on the freed socket, corrupting socket receive-queue state and enabling heap-based write/control-flow hijack primitives typical of kernel UAF bugs.\nA:H - Use-after-free on struct sock during receive processing can cause kernel oops/panic from invalid memory access, and UAF bugs in the kernel are rated High availability impact even when not fully weaponized."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63946","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63952","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (memfd_create, mmap, fcntl) with no network-facing code path; the vulnerable logic is reached only through the local fcntl(F_ADD_SEALS) interface on a memfd file descriptor.\nAC:L - The attack is a reliable, deterministic syscall sequence (create executable memfd, establish a writable MAP_SHARED mapping, then apply F_SEAL_EXEC) with no race or attacker-uncontrollable conditions.\nPR:L - Any unprivileged local user can invoke memfd_create, mmap, and fcntl without capabilities; these interfaces are available inside unprivileged user namespaces with no real-root requirement.\nUI:N - Exploitation does not require a human victim action; in the highest-impact scenario a sandboxed process programmatically passes the sealed-appearing memfd to a trusting peer via IPC (e.g., SCM_RIGHTS) without user interaction.\nS:C - The bug breaks the memfd seal security contract designed for mutually untrusted parties, allowing a malicious local peer to deceive a separate process that relies on F_SEAL_WRITE immutability, crossing the inter-process trust boundary (sandbox/W^X enforcement).\nC:H - Bypassing write-seal/W^X guarantees enables arbitrary modification of executable memfd contents presented as immutable, which can be leveraged for arbitrary code execution in a trusting victim process and thereby full read of that process's memory.\nI:H - The vulnerability allows arbitrary modification of memory that is advertised as write-sealed (F_SEAL_WRITE), defeating the kernel's immutability guarantee and enabling W^X bypass and code injection into trusted execution contexts.\nA:N - The flaw is a logic error in seal enforcement that does not cause kernel crashes, panics, hangs, or denial of service; exploitation maintains availability while subverting integrity guarantees."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63952","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63968","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable function is reached from the IPv6 packet receive path (ipv6_rcv → ip6_route_input → ip6_pol_route → fib6_select_path) in softirq context, and production lockups were observed during processing of incoming IPv6 traffic on internet-facing edge routers.\nAC:L - The race is reliably triggerable when an attacker influences both packet flow and route churn (e.g., user-namespace ECMP setup plus traffic, or remote traffic coinciding with BGP nexthop updates); a dedicated selftest reproduces soft lockups in under a minute under controlled conditions.\nPR:N - Triggering fib6_select_path() during packet processing requires only the ability to send IPv6 traffic to destinations using multipath routes; concurrent route-table updates can occur from infrastructure (BGP/dynamic routing) without the attacker holding any local privileges.\nUI:N - Exploitation requires no victim interaction beyond normal network traffic delivery to a host or router processing IPv6 packets.\nS:U - The impact is kernel CPU soft lockup and watchdog panic within the same kernel security boundary; there is no sandbox, VM, or IOMMU boundary crossing.\nC:N - The bug is an infinite loop over stale sibling-list pointers during RCU read-side traversal; it does not read or disclose attacker-controlled memory or kernel secrets.\nI:N - No data modification or memory corruption occurs; the failure mode is CPU hang from unbounded list iteration, not arbitrary write or code execution.\nA:H - The infinite loop in softirq context causes CPU soft lockup, and documented production and test cases show this leads to watchdog-triggered kernel panic, a complete loss of system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63968","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63971","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls on an SCTP socket (`sendmsg`/`sendto` to trigger `sctp_wait_for_connect`, and `getsockopt(SCTP_SOCKOPT_PEELOFF)` to peel off the association). A remote peer can only help complete the SCTP handshake; it cannot invoke peeloff or the racing send path.\nAC:L - The attacker controls both sides of the race by running concurrent threads on the same SCTP one-to-many socket, timing peeloff during the window where `sctp_wait_for_connect()` has released the socket lock. Required options (`SCTP_FRAGMENT_INTERLEAVE`, `SCTP_INTERLEAVING_SUPPORTED`, and `net.sctp.intl_enable`) are attacker-settable in a user/net namespace.\nPR:L - No real-root capability is required; an unprivileged user can create SCTP sockets and drive the full race from a user namespace (`unshare -Urn`), including enabling `net.sctp.intl_enable` and the interleaving socket options needed to reach the vulnerable `sctp_sendmsg_to_asoc()` path.\nUI:N - Exploitation is fully attacker-driven through coordinated local threads and does not require any action from a victim user or administrator beyond normal SCTP socket use.\nS:U - Impact is confined to kernel memory integrity/availability within the same security authority; successful exploitation would be local privilege escalation, not a cross-boundary escape such as VM or container breakout by itself.\nC:H - After peeloff migrates `asoc->base.sk`, the caller continues in `sctp_datamsg_from_user()` while holding the wrong socket lock, creating unsynchronized concurrent access to association/stream state that can corrupt kernel heap metadata and be leveraged for arbitrary kernel memory disclosure.\nI:H - The post-race path builds and queues DATA/I-DATA chunks via `sctp_datamsg_from_user()` and `sctp_primitive_SEND()` without the correct socket lock, enabling concurrent modification of association output queues and stream structures that can be turned into arbitrary kernel writes or control-flow hijacking.\nA:H - Concurrent unsynchronized access to a live SCTP association after peeloff can cause kernel oops/panic or wedged associations, and the underlying race is a classic kernel concurrency defect with high availability impact even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63971","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63975","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when a remote Bluetooth LE peer sends a crafted L2CAP_ECRED_CONN_RSP on the LE signaling channel, processed via hci_recv_frame → l2cap_recv_acldata → l2cap_le_sig_channel → l2cap_ecred_conn_rsp. Bluetooth is Adjacent per kernel CVSS guidance.\nAC:L - An adjacent attacker who establishes a BLE ACL link can reliably trigger this by first creating an L2CAP channel with a chosen DCID (via ECRED_CONN_REQ SCIDs) and then sending a connection response reusing that DCID for a pending outgoing ECRED connection; no race or rare layout is required.\nPR:N - Exploitation requires only the ability to act as a remote Bluetooth peer on an established ACL connection; no local shell access, capabilities, or root on the victim system is needed.\nUI:N - The malicious signaling traffic is delivered entirely by the remote attacker once a BLE link exists; no additional victim-side file open, mount, or application action beyond normal Bluetooth connectivity is required to reach the vulnerable handler.\nS:U - The failure is a kernel L2CAP channel-list use-after-free and crash within the Bluetooth stack on the victim host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Calling l2cap_chan_del() on the original channel during list_for_each_entry_safe can free the saved tmp list node, causing a use-after-free on struct l2cap_chan when iteration continues; UAF is scored as High confidentiality impact.\nI:H - The same iterator invalidation frees and later dereferences l2cap_chan objects under attacker-influenced connection state, providing a heap UAF primitive that can be groomed toward arbitrary memory corruption and code execution.\nA:H - The bug reliably produces kernel list corruption and use-after-free in softirq/context Bluetooth receive path, leading to kernel oops or panic and denial of service on phones, laptops, and embedded devices with Bluetooth enabled."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63975","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63984","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code runs in the IPv6 routing-header receive handler on incoming packets; a remote attacker can deliver a crafted RFC 6554 type-3 RPL SRH to an RPL-enabled router or gateway over the network.\nAC:L - Triggering requires only a deterministically crafted SRH (e.g., n=127, CmprI=15, CmprE=15, pad=0, hdrlen=16, segments_left>0); all of these fields are fully attacker-controlled once the target has rpl_seg_enabled.\nPR:N - No authentication or local privileges are needed to send the malicious IPv6 packet; rpl_seg_enabled is a victim-side deployment setting on RPL routers/gateways (IoT/industrial mesh), not an attacker privilege requirement.\nUI:N - Exploitation is achieved solely by sending a malformed network packet and does not require any action from a victim user.\nS:U - Impact is confined to kernel memory corruption and packet forwarding within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The hdrlen truncation causes overlapping read/write of the same kmalloc buffer during decompress/recompress, constituting kernel heap memory corruption that can be leveraged for information disclosure primitives.\nI:H - ipv6_rpl_srh_compress() performs out-of-bounds writes into the overlapping decompressed region, corrupting routing-header data that is then memcpy'd into the forwarded skb, enabling memory corruption exploitable for control-flow or data modification.\nA:H - Kernel heap corruption during SRH processing can cause kernel oops, panics, or repeated crashes when processing or forwarding the corrupted packet, consistent with high availability impact for memory-corruption bugs."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63984","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63994","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when remotely injected VXLAN/GENEVE UDP packets traverse a bridged/OVS overlay and fail PMTU checks during encapsulation transmit, the same network path previously demonstrated in CVE-2023-53600 via vxlan_xmit through bridge forwarding.\nAC:L - An attacker can reliably send oversized DF-marked inner IP packets over the overlay to force PMTU ICMP generation, and can influence skb_cow() reallocation through bridge flooding/multicast cloning or headroom pressure; no uncontrollable victim state is required.\nPR:N - Exploitation requires no privileges on the victim host; any remote entity that can send VXLAN/GENEVE traffic to a VTEP with a bridged tunnel interface (standard cloud/SDN deployment) can reach the vulnerable code without authentication.\nUI:N - Triggering is fully automatic during kernel packet forwarding and tunnel encapsulation; no victim user action is needed beyond normal network operation of an overlay endpoint.\nS:U - Impact is confined to kernel memory on the affected host (UAF read/crash/potential escalation); it does not inherently cross VM, container, or IOMMU security boundaries.\nC:H - Stale ip_hdr/ipv6_hdr pointers cause reads from freed slab memory; leaked values are incorporated into ICMP error IP headers that are sent back to the attacker, constituting arbitrary kernel heap content disclosure.\nI:H - Use-after-free on skb header memory is a heap corruption primitive that can be developed into controlled writes or code execution via heap grooming, consistent with kernel UAF severity guidance.\nA:H - Dereferencing freed skb head memory during ICMP construction can cause kernel oops/panic and denial of service, as with other confirmed bugs in this same code path."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63994","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64106","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through the KVM device ioctl path (KVM_SET_DEVICE_ATTR with KVM_DEV_ARM_ITS_RESTORE_TABLES), which requires a local process with access to a VM file descriptor; it is not triggered by network packets or guest MMIO/ITS commands.\nAC:L - An attacker can reliably plant a crafted Device Table Entry in guest RAM (Size field encoding 17–32 EventID bits) and have it processed during migration/snapshot restore; no race or attacker-uncontrollable memory layout is required, and the live MAPD path already proves the invalid state is straightforward to supply.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant who needs no host privileges: they write a malformed DTE directly into guest physical memory (bypassing MAPD validation) and trigger host-side restore during automated live migration or snapshot resume, without requiring /dev/kvm or root on the host.\nUI:N - Exploitation does not require victim interaction beyond normal hypervisor operations such as automated live migration or snapshot restore that the attacker can initiate as a VM tenant; no end-user action like opening a file is needed.\nS:C - The vulnerability crosses the VM security boundary because guest-controlled saved state causes the host kernel to perform an oversized ITS table scan and mass kernel allocations, impacting host availability outside the guest's security scope.\nC:H - The unchecked num_eventid_bits value inflates scan_its_table()'s range up to BIT_ULL(32)*8 bytes (and can wrap the int size parameter for values 28–31), causing the host kernel to read far beyond the valid ITT bounds through kvm_read_guest_lock across a large guest GPA span.\nI:N - The flaw causes excessive guest-memory reads and kernel object allocation but does not corrupt or write host kernel memory; there is no demonstrated arbitrary host write, use-after-free, or code-execution primitive from this bug alone.\nA:H - The oversized scan can loop for an enormous number of kvm_read_guest_lock iterations (worse when the truncated int size wraps to a huge unsigned length), and valid-looking restored ITEs can drive unbounded vgic_add_lpi/kzalloc allocations, exhausting host CPU and memory and causing severe denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64106","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64189","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable dump and resize paths are reached through local NETLINK_NETFILTER send and receive syscalls, not through remotely received packets.\nAC:L - The attacker controls both sides by issuing an ipset dump and concurrent CREATE requests that grow ip_set_list, and can repeat the race without any victim-controlled condition.\nPR:L - NFNETLINK requires CAP_NET_ADMIN in the network namespace's owning user namespace, which an unprivileged user can obtain through user and network namespaces on deployments permitting unprivileged user namespaces.\nUI:N - After obtaining local execution, the attacker can trigger both racing operations without any action by another user.\nS:U - Exploitation compromises the kernel of the same host and constitutes standard local privilege escalation rather than crossing a VM, hypervisor, or IOMMU boundary.\nC:H - Reclaiming the freed array can make the loaded struct ip_set pointer attacker-influenced, after which variant-pointer dereferences can enable kernel code execution and arbitrary memory disclosure.\nI:H - The release path performs an indirect uref callback and decrements ref_netlink through the stale pointer, providing control-flow and kernel-memory-write opportunities after heap reclamation.\nA:H - The reported use-after-free produced a general-protection fault and kernel panic, and an attacker can trigger the race repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64189","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64530","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On a transparent bridge or traffic-shaping gateway configured with the RED qevent and act_ct, unauthenticated remote IP fragments reach red_enqueue() through normal receive, bridge-forwarding, and egress-qdisc processing. No local netlink access is required to trigger the deployed configuration.\nAC:L - The attacker controls fragment contents and ordering and can drive RED into deterministic hard-mark or drop conditions with sustained traffic. No race or condition outside the attacker's control must be won.\nPR:N - CAP_NET_ADMIN is required to create the vulnerable configuration, but a remote attacker sending fragments through an already configured appliance needs no privileges or authentication. Local triggering is also possible with namespaced CAP_NET_ADMIN.\nUI:N - Triggering requires only attacker-generated fragmented traffic and does not depend on a victim performing any action.\nS:U - The corruption occurs within the host kernel and compromises resources governed by that same security authority. This remains unchanged scope even when used for namespace escape or kernel privilege escalation.\nC:H - The reclaimable sk_buff use-after-free and corrupted defragmentation-tree links can be leveraged through attacker-controlled network heap spraying to disclose arbitrary kernel memory.\nI:H - RED overwrites linkage fields that overlap the defragmentation RB node and may free the object while it remains referenced, enabling subsequent writes through freed or attacker-reclaimed kernel objects and potential code execution.\nA:H - The dangling fragment-tree entry can cause immediate or deferred use-after-free, double-free, invalid tree operations, and kernel panic when another fragment arrives or the queue expires. The attacker can trigger this repeatedly with fragmented traffic."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64530","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64560","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached purely through local syscalls (`timer_create`/`timer_settime`/`timer_delete`/`clock_nanosleep`) raced against `execve()` from a non-leader thread in the attacker's own process. No network or remote data path reaches posix-cpu-timers.\nAC:L - The attacker controls both sides of the race — one thread arms and deletes a process-wide CPU timer while a non-leader thread in the same process calls `execve()` — and can loop indefinitely with CPU pinning/thread spraying to widen the window between `pid_task()` and `lock_task_sighand()`. No condition depends on anything outside attacker control.\nPR:L - Any ordinary unprivileged local user can create and delete `CLOCK_PROCESS_CPUTIME_ID` timers; `pid_for_clock()` performs no capability check when the encoded PID is 0, and `CONFIG_POSIX_TIMERS` is `default y` on essentially all deployments.\nUI:N - The attacker performs every step — timer creation, arming, deletion, and the concurrent non-leader exec — entirely within its own multithreaded process. No victim action is involved.\nS:U - The corruption stays within the kernel's own security authority; it is a standard local kernel memory-corruption/privilege-escalation primitive with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The stale timerqueue node yields UAF reads of the freed `k_itimer` and causes `current` (a live `task_struct` pointer) plus rbtree pointers to be written into the freed/reallocated slot, and the freed object can be reclaimed by another attacker-created `k_itimer`, enabling kernel pointer disclosure and broad memory read.\nI:H - `collect_timerqueue()` writes into freed memory (`ctmr->firing`, `ctmr->handling`, rbtree rebalancing, list insertion) and the `do_cpu_nanosleep()` variant does so into a live, attacker-groomed kernel stack frame, followed by `cpu_timer_fire()` dereferencing attacker-controlled `it_process`/`it_signal` — a control-flow-hijack-capable write primitive.\nA:H - Even without exploitation the dangling timerqueue node produces rbtree/list corruption and a kernel oops, and the pre-fix `WARN_ON_ONCE(timerqueue_node_queued(...))` is an immediate panic under `panic_on_warn`; the race can be triggered repeatedly by any local user."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64560","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64561","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable shadow-MMU page-fault path is reached via local KVM_RUN handling of guest EPT/shadow faults (and nested EPT via paging_tmpl), not by network or adjacent-radio packets.\nAC:L - An attacker who can run nested or shadow-MMU guests controls MMU pressure (heavy nested mappings and/or KVM_SET_NR_MMU_PAGES) and concurrent faults so reclaim zaps an in-use root during make_mmu_pages_available; no attacker-uncontrollable condition is required.\nPR:L - Exploitation needs /dev/kvm access or a nested-capable guest on the host, privileges commonly available to kvm-group users or cloud tenants, not real init-namespace root or CAP_SYS_ADMIN on the create/run path.\nUI:N - Once the attacker can run the guest, they trigger reclaim and page faults entirely through their own vCPU activity with no action by another user.\nS:C - Guest-controlled faults corrupt host KVM MMU state (invalid shadow pages on active_mmu_pages and subsequent list handling), crossing the guest-to-host virtualization boundary into the host kernel authority.\nC:H - Invalid children on active_mmu_pages break zap accounting assumptions so later prepare_zap list_add on still-linked entries corrupts kernel lists, a memory-corruption primitive that can be leveraged for arbitrary host reads.\nI:H - The same active-list invariant break and linked-list corruption in host MMU teardown/reclaim paths yield writable host corruption suitable for control-flow or structure hijacking, not merely a benign accounting glitch.\nA:H - WARN_ON_ONCE skips, infinite zap loops, list corruption, and host oops/hangs are reachable when invalid shadow pages remain on active_mmu_pages, causing host and co-located VM denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64561","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64564","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in SCTP ASCONF receive processing (sctp_rcv → sctp_sf_do_asconf → sctp_process_asconf → sctp_process_asconf_param); a remote peer triggers it by sending a crafted ASCONF over IP/IPv6 on an established association, matching kernel guidance that net/ stack bugs reachable via received packets are Network.\nAC:L - A single attacker-controlled ASCONF with [Address Parameter L][DEL-IP L][DEL-IP 0.0.0.0] reliably frees asconf->transport then reuses it in the same softirq; the peer fully controls multi-homing, serial, and parameter order, with no race or other condition outside attacker influence.\nPR:N - Any remote SCTP peer that completes a normal association with ADD-IP negotiated can send the ASCONF; SCTP-AUTH keys come from the handshake the peer itself performs (or addip_noauth), and no local credentials or capabilities on the target are required.\nUI:N - Exploitation requires only attacker-sent SCTP packets processed automatically in the receive/state-machine path; no victim user action such as opening a file or mounting a device is needed.\nS:U - Impact is confined to the vulnerable host kernel (sctp_transport UAF / crash or privilege escalation) and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - This is a heap use-after-free of an sctp_transport planted into primary_path/active_path after RCU-deferred free; freed-object reuse yields arbitrary kernel read primitives, scored High per UAF guidance.\nI:H - The same transport UAF enables heap spraying and write/control-flow hijacking via later dereferences of the dangling primary_path/active_path, so integrity impact is High.\nA:H - set_primary() immediately dereferences the freed transport and leaves the association with transport_count 0 and dangling path pointers, causing a reproducible kernel oops/panic on subsequent use, which is High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64564","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64600","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation uses local FICLONE and concurrent O_DIRECT write syscalls against an XFS filesystem.\nAC:L - The attacker controls both racing writers, can amplify the transaction-allocation window, and demonstrated exploitation typically succeeds within seconds.\nPR:L - A basic unprivileged local user needs only read access to the protected source and write access to a scratch file; no capabilities are required.\nUI:N - The attacker creates the reflink and triggers both sides of the race without any victim action.\nS:U - This is a standard local kernel-mediated privilege escalation affecting resources within the host operating system's existing security authority.\nC:H - Overwriting /etc/passwd or a readable SUID-root binary yields full root access and consequently unrestricted access to system-confidential data.\nI:H - The stale physical mapping provides attacker-controlled persistent writes into protected readable files while preserving their ownership and SUID metadata, enabling full root compromise.\nA:H - The attacker can persistently corrupt boot-critical binaries or configuration files and, after obtaining root, cause complete system unavailability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64600","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A3602-1","advisory_id":"130b8b86-0b9f-4b76-b8c0-96bf6997a30c","event_types":["advisory"],"published_at":"2026-10-25T22:45:52.959384+00:00","technologies":["core-osv","kernel-64kb","kernel-default","kernel-default-base","kernel-docs","kernel-livepatch-sle15-sp6-update-30","kernel-obs-build","kernel-source","kernel-syms","kernel-zfcpdump"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T15:40:54+00:00","detail_url":"/advisories/advisory%3A130b8b86-0b9f-4b76-b8c0-96bf6997a30c","group":{"id":"advisory:130b8b86-0b9f-4b76-b8c0-96bf6997a30c","revision":1,"primary_event_id":71340,"change":"published","superseded_by":[],"changed":{"id":71340,"cve_ids":["CVE-2026-31482","CVE-2026-31483","CVE-2026-31542","CVE-2026-31598","CVE-2026-31628","CVE-2026-43033","CVE-2026-43046","CVE-2026-43056","CVE-2026-43276","CVE-2026-43440","CVE-2026-43475","CVE-2026-45904","CVE-2026-46056","CVE-2026-46080","CVE-2026-46084","CVE-2026-46109","CVE-2026-46117","CVE-2026-46126","CVE-2026-46144","CVE-2026-46145","CVE-2026-46174","CVE-2026-46193","CVE-2026-46243","CVE-2026-46323","CVE-2026-46324","CVE-2026-46333","CVE-2026-52967","CVE-2026-52986","CVE-2026-53050","CVE-2026-53129","CVE-2026-53131","CVE-2026-53177","CVE-2026-53224","CVE-2026-53246","CVE-2026-53250","CVE-2026-53262","CVE-2026-53267","CVE-2026-53297","CVE-2026-53324","CVE-2026-53354","CVE-2026-53375","CVE-2026-53388","CVE-2026-53391","CVE-2026-53402","CVE-2026-63794","CVE-2026-63802","CVE-2026-63806","CVE-2026-63807","CVE-2026-63824","CVE-2026-63826","CVE-2026-63829","CVE-2026-63884","CVE-2026-63893","CVE-2026-63912","CVE-2026-63917","CVE-2026-63919","CVE-2026-63921","CVE-2026-63922","CVE-2026-63924","CVE-2026-63946","CVE-2026-63952","CVE-2026-63968","CVE-2026-63971","CVE-2026-63975","CVE-2026-63984","CVE-2026-63994","CVE-2026-64106","CVE-2026-64189","CVE-2026-64530","CVE-2026-64560","CVE-2026-64561","CVE-2026-64564","CVE-2026-64600"],"payload":{"kind":"advisory","title":"Security update for the Linux Kernel","summary":"The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435). - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656). - CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995). - CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181). - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289). - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188). - CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633). - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773). - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997). - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988). - CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808). - CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000). - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577). - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230). - CVE-2026-53375: drm/amdgpu/vce: ","evidence":"osv:SUSE-SU-2026:3602-1","products":[{"name":{"value":"kernel-default","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-livepatch-SLE15-SP6_Update_30","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1-150600.13.5.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-64kb","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1.150600.12.60.3","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-zfcpdump","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1.150600.12.60.3","evidence":"/affected/12/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/13/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/13/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/14/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/14/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/15/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/15/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/16/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/16/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:3602-1","aliases":["SUSE-SU-2026:3602-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.130.1","kernel-default-livepatch-devel":"6.4.0-150600.23.130.1","kernel-livepatch-6_4_0-150600_23_130-default":"1-150600.13.5.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.5.1"}]}],"package":{"name":"kernel-livepatch-SLE15-SP6_Update_30","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_30&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.130.1","kernel-default-livepatch-devel":"6.4.0-150600.23.130.1","kernel-livepatch-6_4_0-150600_23_130-default":"1-150600.13.5.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-64kb","purl":"pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1.150600.12.60.3"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-zfcpdump","purl":"pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1.150600.12.60.3"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}}],"modified":"2026-10-02T18:42:47.946147883Z","provider":"osv","upstream":["CVE-2026-31482","CVE-2026-31483","CVE-2026-31542","CVE-2026-31598","CVE-2026-31628","CVE-2026-43033","CVE-2026-43046","CVE-2026-43056","CVE-2026-43276","CVE-2026-43440","CVE-2026-43475","CVE-2026-45904","CVE-2026-46056","CVE-2026-46080","CVE-2026-46084","CVE-2026-46109","CVE-2026-46117","CVE-2026-46126","CVE-2026-46144","CVE-2026-46145","CVE-2026-46174","CVE-2026-46193","CVE-2026-46243","CVE-2026-46323","CVE-2026-46324","CVE-2026-46333","CVE-2026-52967","CVE-2026-52986","CVE-2026-53050","CVE-2026-53129","CVE-2026-53131","CVE-2026-53177","CVE-2026-53224","CVE-2026-53246","CVE-2026-53250","CVE-2026-53262","CVE-2026-53267","CVE-2026-53297","CVE-2026-53324","CVE-2026-53354","CVE-2026-53375","CVE-2026-53388","CVE-2026-53391","CVE-2026-53402","CVE-2026-63794","CVE-2026-63802","CVE-2026-63806","CVE-2026-63807","CVE-2026-63824","CVE-2026-63826","CVE-2026-63829","CVE-2026-63884","CVE-2026-63893","CVE-2026-63912","CVE-2026-63917","CVE-2026-63919","CVE-2026-63921","CVE-2026-63922","CVE-2026-63924","CVE-2026-63946","CVE-2026-63952","CVE-2026-63968","CVE-2026-63971","CVE-2026-63975","CVE-2026-63984","CVE-2026-63994","CVE-2026-64106","CVE-2026-64189","CVE-2026-64530","CVE-2026-64560","CVE-2026-64561","CVE-2026-64564","CVE-2026-64600"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20263602-1/","https://bugzilla.suse.com/1185845","https://bugzilla.suse.com/1253262","https://bugzilla.suse.com/1258718","https://bugzilla.suse.com/1260347","https://bugzilla.suse.com/1262745","https://bugzilla.suse.com/1262771","https://bugzilla.suse.com/1263010","https://bugzilla.suse.com/1263068","https://bugzilla.suse.com/1263718","https://bugzilla.suse.com/1263788","https://bugzilla.suse.com/1264053","https://bugzilla.suse.com/1264089","https://bugzilla.suse.com/1264090","https://bugzilla.suse.com/1264558","https://bugzilla.suse.com/1264779","https://bugzilla.suse.com/1264795","https://bugzilla.suse.com/1265308","https://bugzilla.suse.com/1266238","https://bugzilla.suse.com/1266758","https://bugzilla.suse.com/1266850","https://bugzilla.suse.com/1266890","https://bugzilla.suse.com/1266913","https://bugzilla.suse.com/1267375","https://bugzilla.suse.com/1267384","https://bugzilla.suse.com/1267435","https://bugzilla.suse.com/1267584","https://bugzilla.suse.com/1267596","https://bugzilla.suse.com/1267656","https://bugzilla.suse.com/1267682","https://bugzilla.suse.com/1267715","https://bugzilla.suse.com/1267995","https://bugzilla.suse.com/1268029","https://bugzilla.suse.com/1268307","https://bugzilla.suse.com/1269181","https://bugzilla.suse.com/1269188","https://bugzilla.suse.com/1269289","https://bugzilla.suse.com/1269383","https://bugzilla.suse.com/1269512","https://bugzilla.suse.com/1269513","https://bugzilla.suse.com/1269577","https://bugzilla.suse.com/1269633","https://bugzilla.suse.com/1269773","https://bugzilla.suse.com/1269808","https://bugzilla.suse.com/1269981","https://bugzilla.suse.com/1269988","https://bugzilla.suse.com/1269997","https://bugzilla.suse.com/1270000","https://bugzilla.suse.com/1270230","https://bugzilla.suse.com/1271349","https://bugzilla.suse.com/1271368","https://bugzilla.suse.com/1271526","https://bugzilla.suse.com/1271825","https://bugzilla.suse.com/1271866","https://bugzilla.suse.com/1271899","https://bugzilla.suse.com/1271904","https://bugzilla.suse.com/1271908","https://bugzilla.suse.com/1271912","https://bugzilla.suse.com/1271964","https://bugzilla.suse.com/1272176","https://bugzilla.suse.com/1272180","https://bugzilla.suse.com/1272183","https://bugzilla.suse.com/1272207","https://bugzilla.suse.com/1272242","https://bugzilla.suse.com/1272263","https://bugzilla.suse.com/1272268","https://bugzilla.suse.com/1272282","https://bugzilla.suse.com/1272466","https://bugzilla.suse.com/1272468","https://bugzilla.suse.com/1272573","https://bugzilla.suse.com/1272607","https://bugzilla.suse.com/1272665","https://bugzilla.suse.com/1272678","https://bugzilla.suse.com/1272693","https://bugzilla.suse.com/1272694","https://bugzilla.suse.com/1272836","https://bugzilla.suse.com/1272855","https://bugzilla.suse.com/1272865","https://bugzilla.suse.com/1272904","https://bugzilla.suse.com/1272907","https://bugzilla.suse.com/1272918","https://bugzilla.suse.com/1273004","https://bugzilla.suse.com/1273035","https://bugzilla.suse.com/1273231","https://bugzilla.suse.com/1274072","https://www.suse.com/security/cve/CVE-2026-31482","https://www.suse.com/security/cve/CVE-2026-31483","https://www.suse.com/security/cve/CVE-2026-31542","https://www.suse.com/security/cve/CVE-2026-31598","https://www.suse.com/security/cve/CVE-2026-31628","https://www.suse.com/security/cve/CVE-2026-43033","https://www.suse.com/security/cve/CVE-2026-43046","https://www.suse.com/security/cve/CVE-2026-43056","https://www.suse.com/security/cve/CVE-2026-43276","https://www.suse.com/security/cve/CVE-2026-43440","https://www.suse.com/security/cve/CVE-2026-43475","https://www.suse.com/security/cve/CVE-2026-45904","https://www.suse.com/security/cve/CVE-2026-46056","https://www.suse.com/security/cve/CVE-2026-46080","https://www.suse.com/security/cve/CVE-2026-46084","https://www.suse.com/security/cve/CVE-2026-46109","https://www.suse.com/security/cve/CVE-2026-46117","https://www.suse.com/security/cve/CVE-2026-46126","https://www.suse.com/security/cve/CVE-2026-46144","https://www.suse.com/security/cve/CVE-2026-46145","https://www.suse.com/security/cve/CVE-2026-46174","https://www.suse.com/security/cve/CVE-2026-46193","https://www.suse.com/security/cve/CVE-2026-46243","https://www.suse.com/security/cve/CVE-2026-46323","https://www.suse.com/security/cve/CVE-2026-46324","https://www.suse.com/security/cve/CVE-2026-46333","https://www.suse.com/security/cve/CVE-2026-52967","https://www.suse.com/security/cve/CVE-2026-52986","https://www.suse.com/security/cve/CVE-2026-53050","https://www.suse.com/security/cve/CVE-2026-53129","https://www.suse.com/security/cve/CVE-2026-53131","https://www.suse.com/security/cve/CVE-2026-53177","https://www.suse.com/security/cve/CVE-2026-53224","https://www.suse.com/security/cve/CVE-2026-53246","https://www.suse.com/security/cve/CVE-2026-53250","https://www.suse.com/security/cve/CVE-2026-53262","https://www.suse.com/security/cve/CVE-2026-53267","https://www.suse.com/security/cve/CVE-2026-53297","https://www.suse.com/security/cve/CVE-2026-53324","https://www.suse.com/security/cve/CVE-2026-53354","https://www.suse.com/security/cve/CVE-2026-53375","https://www.suse.com/security/cve/CVE-2026-53388","https://www.suse.com/security/cve/CVE-2026-53391","https://www.suse.com/security/cve/CVE-2026-53402","https://www.suse.com/security/cve/CVE-2026-63794","https://www.suse.com/security/cve/CVE-2026-63802","https://www.suse.com/security/cve/CVE-2026-63806","https://www.suse.com/security/cve/CVE-2026-63807","https://www.suse.com/security/cve/CVE-2026-63824","https://www.suse.com/security/cve/CVE-2026-63826","https://www.suse.com/security/cve/CVE-2026-63829","https://www.suse.com/security/cve/CVE-2026-63884","https://www.suse.com/security/cve/CVE-2026-63893","https://www.suse.com/security/cve/CVE-2026-63912","https://www.suse.com/security/cve/CVE-2026-63917","https://www.suse.com/security/cve/CVE-2026-63919","https://www.suse.com/security/cve/CVE-2026-63921","https://www.suse.com/security/cve/CVE-2026-63922","https://www.suse.com/security/cve/CVE-2026-63924","https://www.suse.com/security/cve/CVE-2026-63946","https://www.suse.com/security/cve/CVE-2026-63952","https://www.suse.com/security/cve/CVE-2026-63968","https://www.suse.com/security/cve/CVE-2026-63971","https://www.suse.com/security/cve/CVE-2026-63975","https://www.suse.com/security/cve/CVE-2026-63984","https://www.suse.com/security/cve/CVE-2026-63994","https://www.suse.com/security/cve/CVE-2026-64106","https://www.suse.com/security/cve/CVE-2026-64189","https://www.suse.com/security/cve/CVE-2026-64530","https://www.suse.com/security/cve/CVE-2026-64560","https://www.suse.com/security/cve/CVE-2026-64561","https://www.suse.com/security/cve/CVE-2026-64564","https://www.suse.com/security/cve/CVE-2026-64600"]},"related_cves":[{"value":"CVE-2026-31482","evidence":"/upstream"},{"value":"CVE-2026-31483","evidence":"/upstream"},{"value":"CVE-2026-31542","evidence":"/upstream"},{"value":"CVE-2026-31598","evidence":"/upstream"},{"value":"CVE-2026-31628","evidence":"/upstream"},{"value":"CVE-2026-43033","evidence":"/upstream"},{"value":"CVE-2026-43046","evidence":"/upstream"},{"value":"CVE-2026-43056","evidence":"/upstream"},{"value":"CVE-2026-43276","evidence":"/upstream"},{"value":"CVE-2026-43440","evidence":"/upstream"},{"value":"CVE-2026-43475","evidence":"/upstream"},{"value":"CVE-2026-45904","evidence":"/upstream"},{"value":"CVE-2026-46056","evidence":"/upstream"},{"value":"CVE-2026-46080","evidence":"/upstream"},{"value":"CVE-2026-46084","evidence":"/upstream"},{"value":"CVE-2026-46109","evidence":"/upstream"},{"value":"CVE-2026-46117","evidence":"/upstream"},{"value":"CVE-2026-46126","evidence":"/upstream"},{"value":"CVE-2026-46144","evidence":"/upstream"},{"value":"CVE-2026-46145","evidence":"/upstream"},{"value":"CVE-2026-46174","evidence":"/upstream"},{"value":"CVE-2026-46193","evidence":"/upstream"},{"value":"CVE-2026-46243","evidence":"/upstream"},{"value":"CVE-2026-46323","evidence":"/upstream"},{"value":"CVE-2026-46324","evidence":"/upstream"},{"value":"CVE-2026-46333","evidence":"/upstream"},{"value":"CVE-2026-52967","evidence":"/upstream"},{"value":"CVE-2026-52986","evidence":"/upstream"},{"value":"CVE-2026-53050","evidence":"/upstream"},{"value":"CVE-2026-53129","evidence":"/upstream"},{"value":"CVE-2026-53131","evidence":"/upstream"},{"value":"CVE-2026-53177","evidence":"/upstream"},{"value":"CVE-2026-53224","evidence":"/upstream"},{"value":"CVE-2026-53246","evidence":"/upstream"},{"value":"CVE-2026-53250","evidence":"/upstream"},{"value":"CVE-2026-53262","evidence":"/upstream"},{"value":"CVE-2026-53267","evidence":"/upstream"},{"value":"CVE-2026-53297","evidence":"/upstream"},{"value":"CVE-2026-53324","evidence":"/upstream"},{"value":"CVE-2026-53354","evidence":"/upstream"},{"value":"CVE-2026-53375","evidence":"/upstream"},{"value":"CVE-2026-53388","evidence":"/upstream"},{"value":"CVE-2026-53391","evidence":"/upstream"},{"value":"CVE-2026-53402","evidence":"/upstream"},{"value":"CVE-2026-63794","evidence":"/upstream"},{"value":"CVE-2026-63802","evidence":"/upstream"},{"value":"CVE-2026-63806","evidence":"/upstream"},{"value":"CVE-2026-63807","evidence":"/upstream"},{"value":"CVE-2026-63824","evidence":"/upstream"},{"value":"CVE-2026-63826","evidence":"/upstream"},{"value":"CVE-2026-63829","evidence":"/upstream"},{"value":"CVE-2026-63884","evidence":"/upstream"},{"value":"CVE-2026-63893","evidence":"/upstream"},{"value":"CVE-2026-63912","evidence":"/upstream"},{"value":"CVE-2026-63917","evidence":"/upstream"},{"value":"CVE-2026-63919","evidence":"/upstream"},{"value":"CVE-2026-63921","evidence":"/upstream"},{"value":"CVE-2026-63922","evidence":"/upstream"},{"value":"CVE-2026-63924","evidence":"/upstream"},{"value":"CVE-2026-63946","evidence":"/upstream"},{"value":"CVE-2026-63952","evidence":"/upstream"},{"value":"CVE-2026-63968","evidence":"/upstream"},{"value":"CVE-2026-63971","evidence":"/upstream"},{"value":"CVE-2026-63975","evidence":"/upstream"},{"value":"CVE-2026-63984","evidence":"/upstream"},{"value":"CVE-2026-63994","evidence":"/upstream"},{"value":"CVE-2026-64106","evidence":"/upstream"},{"value":"CVE-2026-64189","evidence":"/upstream"},{"value":"CVE-2026-64530","evidence":"/upstream"},{"value":"CVE-2026-64560","evidence":"/upstream"},{"value":"CVE-2026-64561","evidence":"/upstream"},{"value":"CVE-2026-64564","evidence":"/upstream"},{"value":"CVE-2026-64600","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:130b8b86-0b9f-4b76-b8c0-96bf6997a30c","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-31598","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Although the core bug is in ocfs2 filesystem code, ocfs2 is exportable and nfsd can issue direct writes with IOCB_DIRECT while remote REMOVE operations reach vfs_unlink, making the vulnerable lock chains reachable over the network on a writable exported ocfs2 volume.\nAC:L - The bug is an ABBA deadlock where the attacker can drive both sides with concurrent extending direct writes and unlink/remove operations. Once the target deployment exposes those operations, winning the race is attacker-controlled.\nPR:N - A remote NFS client can trigger the operations through an exported writable share without kernel capabilities on the target. In permissive or anonymous export scenarios, no prior authenticated privileges are required.\nUI:N - No victim user action is required after the vulnerable service/filesystem is available. The attacker can send the write and remove operations directly.\nS:U - The impact remains within the same kernel/filesystem security authority. There is no VM escape, sandbox boundary crossing, or separate security scope.\nC:N - The issue is a lock-ordering deadlock, not memory corruption or information disclosure. It does not provide a read primitive or leak data.\nI:N - The vulnerable behavior does not corrupt memory or allow unauthorized data modification. It only causes threads to block on locks.\nA:H - The deadlock can permanently hang ocfs2 operations and affected kernel worker/syscall contexts. A kernel/filesystem hang is a high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31598","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43033","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable out-of-place AEAD decrypt path is reachable by a local process through AF_ALG sockets using authencesn, while normal inbound ESP uses in-place src==dst. This requires local syscall access rather than remote packets directly reaching the bad branch.\nAC:L - The attacker controls the AF_ALG request buffers, associated-data length, operation type, key, and authsize, and no race or hard-to-influence state is required. The fault occurs before ICV verification, so a valid packet/tag is not needed.\nPR:L - AF_ALG socket creation, bind, key setup, and AEAD decrypt do not require CAP_NET_ADMIN or CAP_SYS_ADMIN, but the attacker needs local unprivileged code execution. XFRM state management is privileged, but the lower-privilege AF_ALG path reaches the bug.\nUI:N - No victim action is required once the local attacker runs the AF_ALG syscall sequence. The attacker supplies both input and output buffers directly.\nS:U - The vulnerability is in kernel crypto processing and impacts the same kernel security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:H - The bug is a kernel memory-corruption condition from writing ESN high sequence bytes past the intended out-of-place destination; successful exploitation of such corruption could expose arbitrary kernel memory. Under the required uncertainty rule, this is scored as high confidentiality impact.\nI:H - The vulnerable code performs an attacker-influenced out-of-bounds write of four bytes before authentication succeeds. Kernel out-of-bounds writes are scored as high integrity impact because they can plausibly be shaped into control-flow or data corruption.\nA:H - At minimum, the AF_ALG path can drive scatterwalk past the end of the destination scatterlist and crash the kernel. A local attacker can repeat the trigger without authentication, causing high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43033","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43056","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable `add_adev()` error path is reached during MANA PCI driver probe/resume/recovery or auxiliary RDMA service handling, not by processing received network packets. The highest defensible attacker path is local influence over driver/device lifecycle or resource-failure conditions.\nAC:L - Once `auxiliary_device_add()` fails, the UAF is deterministic because `auxiliary_device_uninit()` releases the embedded object and the cleanup path immediately reads `adev->id`. No attacker-uncontrolled race is required beyond reaching that failure path.\nPR:L - The path is not exposed to unauthenticated remote peers, but a local attacker can plausibly influence resource exhaustion/failure conditions around driver lifecycle events. Direct sysfs/module lifecycle control is privileged, but Low is the higher-severity defensible choice under the conservative scoring rule.\nUI:N - No separate victim action is required once the attacker can exercise or influence the local driver lifecycle/failure path. Probe, resume, and service-event handling run in kernel context.\nS:U - The affected component and impacts are within the Linux kernel security scope. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel use-after-free of an auxiliary-device container object after its release callback frees it. Under conservative kernel UAF scoring, freed slab reuse can support information disclosure, so confidentiality is High.\nI:H - The UAF lets stale object contents influence cleanup through `mana_adev_idx_free()`, and kernel UAFs are conservatively treated as potentially exploitable memory corruption. Integrity is therefore High.\nA:H - At minimum, the stale access can trigger a kernel UAF report, invalid IDA cleanup, oops, or panic during probe/resume error unwinding. Availability impact is High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43056","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46056","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handlers process HCI Secure Simple Pairing events (User Passkey Notify / Keypress Notify) driven by a remote Bluetooth peer during SSP pairing, so the attacker must be within Bluetooth radio range (adjacent), matching kernel guidance that Bluetooth = Adjacent.\nAC:L - This is a use-after-free where a remote peer drives the passkey/keypress events while connection teardown frees the conn from a concurrent context; the attacker influences both sides of the race and can retry, and UAF bugs are scored AC:L unless the race is uncontrollable.\nPR:N - The code path is reached by a remote Bluetooth device participating in the SSP pairing handshake, requiring no credentials or privileges on the target system.\nUI:N - The handlers execute automatically when the controller forwards the SSP passkey/keypress HCI events during the pairing protocol exchange; no local user action is required to reach the vulnerable code.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The use-after-free reads fields (dst, type, dst_type, passkey) from a freed and potentially reallocated hci_conn object, which can disclose attacker-controlled or sensitive kernel heap contents.\nI:H - The handlers write to the freed object (passkey_notify and passkey_entered fields), giving a UAF write into reallocated heap memory that can be leveraged for heap grooming and control-flow corruption.\nA:H - A use-after-free on the hci_conn structure readily causes kernel oops/panic, yielding high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46056","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46117","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through the RDMA userspace verbs interface (/dev/infiniband/uverbs<N>) by issuing a create-QP command locally; it is not exposed to network peers.\nAC:L - The condition is created entirely by the attacker (building an RWQ indirection table whose WQs share one CQ) and is deterministically triggered on the second loop iteration; there is no race or uncontrolled state.\nPR:L - Triggering only requires an unprivileged local process with access to the RDMA verbs device — the normal configuration on RDMA-enabled hosts — and no CAP_* check exists on the create-QP path.\nUI:N - The attacker performs all steps via its own verbs calls; no action by another user is required.\nS:U - The corruption stays within the kernel's own memory/security authority and does not cross a VM/IOMMU/sandbox boundary.\nC:H - The overwrite leaks/dangles objects in cq_table[], and a use-after-free on these IRQ-dispatched structures can be leveraged to read kernel memory contents.\nI:H - The driver \"goes on to corrupt the kernel,\" leaving dangling function-pointer/context entries in a table called from interrupt context, providing a write/control-flow corruption primitive.\nA:H - The user-triggerable WARN_ON panics the system when panic_on_warn is set, and the subsequent kernel state corruption causes oopses/crashes regardless."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46117","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46145","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only by issuing RDMA verbs to the local /dev/infiniband/uverbs* character device; `rx_hash_key_len` arrives via `ib_copy_from_udata` from a local process, with no remote network path.\nAC:L - The attacker directly controls `rx_hash_key_len` in the uAPI struct and can set it arbitrarily large to trigger the overflow on every call; there is no race or condition outside the attacker's control.\nPR:L - Reaching the raw-packet QP path requires CAP_NET_RAW, but that is a narrow, non-root capability (not the \"real root/admin\" bar for High) and is routinely granted to unprivileged networking/RDMA applications such as DPDK workloads.\nUI:N - The overflow is triggered entirely by the attacker's own QP-creation request; no action by any other user is required.\nS:U - The corruption is of the kernel's own heap allocation within the same kernel security authority; no crossing into a separate scope (VM/IOMMU) occurs.\nC:H - The memcpy over-reads the 40-byte stack source by an unbounded amount and the heap overflow can be leveraged to disclose adjacent kernel memory, so confidentiality impact is High.\nI:H - An attacker-controlled-length memcpy writes past a 40-byte heap field, giving a heap out-of-bounds write that corrupts adjacent kernel objects and is exploitable toward arbitrary write/control-flow hijack.\nA:H - A large `rx_hash_key_len` corrupts the kernel heap and/or faults reading unmapped stack/heap pages, reliably causing a kernel panic/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46145","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46174","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in the CPU's op cache and requires executing instructions on the affected core to drive improper resource sharing; it is not reachable over a network. Triggering it needs local code execution on the machine.\nAC:L - An attacker who can co-schedule code on SMT siblings of an affected Zen2 core controls both sides of the shared op-cache contention and can reliably drive the improper-isolation condition. Following the higher-severity rule, this is Low.\nPR:L - Triggering the op-cache resource sharing only requires the ability to run code (an unprivileged local user or a guest VM tenant); no root or admin capability is needed. It does, however, require at least some local execution access, so not None.\nUI:N - The attacker's own executing code populates and contends for the op cache; no victim action is required.\nS:C - The bug is an isolation failure of a microarchitectural resource shared across SMT threads, so instruction corruption can cross from the attacker's context into a different security authority (another VM/tenant or the host kernel), impacting resources beyond the attacking component's scope.\nC:H - Improper isolation of a shared op-cache resource is an information-disclosure vector across contexts, and the resulting instruction corruption can be leveraged to read memory belonging to another security domain.\nI:H - The defining impact is \"instruction corruption\" — the CPU executes corrupted/wrong instructions in a victim context, which is a direct, severe integrity violation enabling control-flow and data corruption across the isolation boundary.\nA:H - Instruction corruption causes incorrect execution, crashes, and hangs in the affected (potentially cross-context) code, resulting in high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46174","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46243","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local `request_key(2)` or `add_key(2)` from an unprivileged process; the flaw is missing origin validation in the keyring path, not remote SMB/CIFS protocol input.\nAC:L - On typical affected systems (CIFS module with upcall, cifs-utils request-key rule, unprivileged user/mount namespaces), the attacker fully controls the forged description, target pid, and namespace layout for a reliable root upcall chain.\nPR:L - Any local unprivileged user account can invoke the key syscalls; user/mount namespaces are part of the standard exploit setup and map to basic local user capability, not root-only access.\nUI:N - No victim action such as mounting a Kerberos CIFS share is required; the attacker forges the key request directly without depending on another user’s mount or session.\nS:U - Successful exploitation elevates privileges within the same host/kernel security domain (local root) and does not cross a VM/hypervisor or hardware isolation boundary by itself.\nC:H - The attack chain yields root-equivalent access in the root upcall helper, enabling arbitrary read of host data (full confidentiality compromise of the system).\nI:H - Malicious NSS modules run as root inside `cifs.upcall`, giving arbitrary code execution and full integrity compromise of the host, not merely limited data modification.\nA:N - The kernel bug is a trust-boundary failure without memory corruption or guaranteed kernel panic; primary impact is privilege escalation rather than kernel crash or sustained denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46243","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46323","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local attacker to inject zerocopy/managed-frags skbs via io_uring SEND_ZC, TUN/TAP, or similar local APIs; ordinary remote wire packets processed by GRO do not carry SKBFL_MANAGED_FRAG_REFS, so a network-only attacker cannot reach the buggy merge path.\nAC:L - The attacker fully controls both sides of the GRO merge (seed and zerocopy TCP segments over a veth pair), timing (netem delay, RST race), and buffer setup; a public working LPE exploit exists, so success does not depend on conditions outside attacker control.\nPR:L - Triggering requires only a basic unprivileged local account with io_uring and user-namespace access (unshare -Urn), which is the default on many distributions; no init-namespace root or CAP_NET_ADMIN is needed.\nUI:N - No victim user action is required; the attacker drives the entire exploit autonomously through syscalls and local network namespace setup.\nS:U - Impact is standard host-kernel privilege escalation (root on the same kernel); it does not cross a distinct hypervisor/IOMMU security boundary such as VM-guest-to-host escape.\nC:H - The flaw is a use-after-free on page structures; the known exploit leverages the refcount underflow to obtain stale read access to freed physical pages and extract kernel PTE contents, enabling arbitrary memory disclosure primitives.\nI:H - UAF page refcount corruption enables crafting writable PTE entries against read-only page-cache pages; the public exploit demonstrates integrity compromise by rewriting /etc/passwd and obtaining root via su.\nA:H - Use-after-free of page structures can cause kernel oops/panic during skb teardown; even failed exploitation attempts can crash the system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46323","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46324","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in nf_tables netdev hook teardown reached only via Netfilter netlink (nft) syscalls—chain/flowtable updates, dumps, netns teardown, and netlink socket release—not from remote packet handling alone. Per kernel guidance, nftables/netfilter is Local (L).\nAC:L - Exploitation is a race between hook-list removal (`list_del()` + RCU free) and concurrent RCU walkers (`nft_dump_basechain_hook_list`, flowtable dump, or packet-path `list_for_each_entry_rcu`). An attacker with CAP_NET_ADMIN can drive both sides concurrently (e.g., one thread dumping chains/flowtables while another deletes hooks or tears down the netns).\nPR:L - All nf_tables netlink operations are gated by `netlink_net_capable(skb, CAP_NET_ADMIN)` in `nfnetlink_rcv()`. CAP_NET_ADMIN is obtainable by an unprivileged user via user+network namespaces (`unshare -Urn`), not real init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers hook teardown and concurrent dumps or traffic entirely through their own netlink sockets and namespace lifecycle.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries.\nC:H - Using `list_del()` instead of `list_del_rcu()` on lists walked under `rcu_read_lock()` is a use-after-free/list-corruption bug; concurrent dumpers dereference `nft_hook` fields (e.g., `ifname`) after unlink/free, enabling arbitrary kernel memory read via heap grooming.\nI:H - The freed `nft_hook` kmalloc object can be reallocated and corrupted through the dangling RCU list pointers, providing a standard kernel UAF primitive exploitable for arbitrary write and control-flow hijacking.\nA:H - The race reliably causes kernel list corruption and use-after-free, leading to oops/panic during hook dumps, flowtable lookups, or netns cleanup; UAF in this path has inherent high availability impact even when not fully weaponized."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46324","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46333","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable authorization check is reached through local interfaces such as ptrace-style checks, procfs, and pidfd_getfd; it is not reachable from network packets or adjacent/physical input.\nAC:L - A local attacker can repeatedly trigger the relevant check and, for exiting tasks, can race pidfd_getfd/procfs access against a target's exit path after exit_mm() but before exit_files(). The race is attacker-driven and does not require unusual kernel configuration or conditions outside the attacker's influence.\nPR:L - An unprivileged local user can target same-UID nondumpable tasks because the vulnerable code skips the dumpability requirement once task->mm is NULL. User-namespace root does not help against init-namespace root kernel threads, but low local privileges are enough for the same-UID exiting-task case.\nUI:N - Exploitation does not require a victim user to open a file or perform an interactive action; the attacker can use local syscalls/procfs against an existing or attacker-terminated target task.\nS:U - The bug bypasses Linux kernel task-access authorization within the same OS security authority. It does not cross a VM, IOMMU, or hypervisor boundary.\nC:H - The bypass can allow access to sensitive task details and, most importantly, pidfd_getfd can duplicate file descriptors from a nondumpable task during the exit window. In a plausible helper/sandbox scenario, those descriptors can expose highly sensitive files or privileged resources.\nI:H - If the duplicated descriptor is writable, the attacker can modify the protected resource reachable through the victim's file descriptor despite the dumpability restriction. This is a high-impact integrity bypass even though the bug is not memory corruption.\nA:N - The issue is an access-control bypass around ptrace/dumpability checks and does not by itself provide a kernel crash, hang, deadlock, or sustained denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46333","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52967","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable SMB client parser consumes an SMB2 CREATE error response supplied by a remote SMB server over the network. A malicious or compromised SMB share can send the crafted `STATUS_STOPPED_ON_SYMLINK` response.\nAC:L - The server directly controls `ErrorContextCount`, `ByteCount`, `ErrorId`, and `ErrorDataLength`, and no race or hard-to-hit state is required. Although the wraparound behavior is 32-bit specific, that is a deployment property rather than an attacker-uncontrolled exploitation condition.\nPR:N - The attacker needs no privileges on the victim system; they only need to operate or control the SMB server endpoint that the client connects to. The path can also be reached through guest or null-auth SMB sessions.\nUI:R - The victim client must mount/connect to the SMB share and perform a path operation such as lookup, stat, open, or create that causes an SMB2 CREATE response to be parsed. The remote server cannot trigger this parser without client-side filesystem activity.\nS:U - The affected component is the Linux kernel SMB client, and the impact is to the same kernel/client security authority. This is not a VM escape, IOMMU bypass, or cross-scope sandbox escape.\nC:H - The bug is an out-of-bounds kernel read in a server-controlled response parser, and the read is not strictly bounded to only a few harmless bytes. Following the required conservative rule, this is scored as high confidentiality impact.\nI:N - The defect advances a parser pointer incorrectly and reads from the wrong location, but it does not write out of bounds or provide a kernel memory write primitive. No direct integrity impact beyond normal malicious-server control of SMB content was identified.\nA:H - The crafted length can make the parser loop indefinitely on 32-bit systems, causing a reliable denial of service. Other malformed pointer positions can also lead to invalid kernel reads and possible oops conditions."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52967","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52986","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable SIP conntrack helper parses SIP payload carried in TCP/UDP network packets once the SIP helper is enabled, which is a reasonable deployment for NAT/firewall SIP gateways. A remote SIP peer can send crafted packets to that packet-processing path.\nAC:L - The trigger is a malformed numeric SIP field or URI port at the parser buffer boundary; no race or victim-controlled timing is required. Helper/NAT configuration is an environmental prerequisite, not an attacker-controlled complexity condition.\nPR:N - In the network gateway scenario, the attacker only needs to send unauthenticated SIP traffic through a system using the SIP conntrack helper. No local account or kernel privilege is required.\nUI:N - Exploitation is driven by packet processing in netfilter/conntrack. No user action is needed after the affected helper is configured.\nS:U - The impact is within the kernel/network stack security authority of the vulnerable system. It does not cross a separate scope such as guest-to-host or IOMMU isolation.\nC:H - The bug is an unbounded out-of-bounds read from non-NUL-terminated skb data via simple_strtoul and missing limit checks. Following the required guidance, an unbounded OOB read is high confidentiality impact.\nI:H - In NATed SIP paths, an out-of-bounds parser end pointer can feed attacker-influenced match lengths into NAT packet mangling, whose memmove/memcpy path lacks a bounds check against the skb payload. That creates a defensible kernel memory-corruption/code-execution risk.\nA:H - The same OOB read and possible invalid NAT mangle lengths can cause kernel faults, skb corruption, or panic. Crafted packets can be sent repeatedly, so availability impact is high."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52986","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53050","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local filesystem quota activity on a mounted OCFS2 filesystem, via ordinary dquot lifetime changes racing with the OCFS2 quota sync worker. It is not reachable by remote packets or adjacent/physical input.\nAC:L - This is a race, but a local attacker can repeatedly churn dquot references with filesystem operations while the periodic scanner runs. When uncertain, the higher-severity AC:L is appropriate.\nPR:L - After OCFS2 quotas are enabled, an unprivileged local user with write access to the filesystem can trigger dquot allocation and release paths. Mounting/configuring quotas is an environmental prerequisite, not a privilege needed for each exploit attempt.\nUI:N - No victim interaction is required once the affected filesystem is mounted and quotas are active. The attacker can trigger the relevant filesystem operations directly.\nS:U - The impact remains within the kernel and the same host security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The bug can lead to use-after-free of a dquot object under memory pressure. Kernel UAF conditions can be leveraged for memory disclosure, so confidentiality impact is High.\nI:H - The stale dquot/list state creates kernel heap use-after-free/list corruption, which can plausibly be shaped into write primitives or code execution. Integrity impact is therefore High.\nA:H - The race already produces kernel WARN/oops-style failure conditions and can dereference freed kernel objects. This can crash or destabilize the kernel, so availability impact is High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53050","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53131","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.4,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable netfilter match, ipset, and logging paths run while processing packets in receive/netdev hooks. In a reasonable firewall, router, VPN, or tunnel deployment with these rules installed, unauthenticated remote packets can reach the vulnerable code.\nAC:L - No race or difficult timing is required; a packet reaching a vulnerable rule with an invalid, unset, non-Ethernet, or too-short MAC header deterministically drives the bad eth_hdr(skb) access. The needed rule/interface setup is a plausible deployment condition, not an exploit race.\nPR:N - The remote packet sender does not need credentials or local privileges once the affected rule or logger is configured. Although rule installation requires CAP_NET_ADMIN, that is not required for the runtime remote-trigger scenario.\nUI:N - Exploitation is triggered by packet processing and does not require a victim user to open a file, mount anything, or perform another action.\nS:U - The impact remains within the kernel/network stack security authority. There is no VM, IOMMU, or separate sandbox boundary crossing.\nC:H - The flaw causes invalid or out-of-bounds reads from the skb MAC header, and those bytes can be copied into logs/ipset state or influence observable match behavior. Per the required guidance, out-of-bounds reads are scored High when not proven strictly harmless.\nI:L - The primitive is a read rather than an arbitrary write or control-flow hijack. However, the wrongly read MAC bytes can influence firewall matches and ipset add/delete/test behavior, giving limited integrity impact.\nA:H - Invalid eth_hdr(skb) access can produce slab out-of-bounds/KASAN reports or kernel oops/panic conditions, and packets can be sent repeatedly. Kernel crashes are High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53224","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - An unauthenticated remote SCTP peer can reach the vulnerable COOKIE_ECHO processing path by sending SCTP packets to a listening SCTP endpoint. In deployments with cookie HMAC disabled, the attacker can obtain and modify the state cookie over the network.\nAC:L - The bug is triggered with a malformed COOKIE_ECHO and attacker-controlled embedded INIT/address-list lengths; no race or hard-to-control timing condition is required. The no-cookie-auth deployment condition is a reasonable supported SCTP configuration.\nPR:N - No credentials or local privileges are needed to send SCTP INIT/COOKIE_ECHO traffic to a listening service. The vulnerable parsing occurs before any application authentication.\nUI:N - Exploitation only requires sending network packets to the target SCTP endpoint. No victim user action is required.\nS:U - The impact is within the kernel/network stack security authority of the target system. It does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The malformed lengths can drive out-of-bounds kernel reads beyond the COOKIE_ECHO payload, including attacker-controlled oversized address-list parsing. Because the read is not strictly bounded to a few bytes and related SCTP COOKIE_ECHO bugs demonstrate kernel memory leakage potential, confidentiality impact is High.\nI:N - The investigated fix addresses out-of-bounds reads and missing length validation, not an out-of-bounds write or direct arbitrary memory modification primitive. I did not find a defensible direct integrity impact from this bug alone.\nA:H - The attacker-controlled out-of-bounds reads can walk beyond the skb/cookie buffer and fault or trigger KASAN/oops conditions. A remotely triggerable kernel crash is High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53224","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53246","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable COOKIE_ECHO processing is reached by remote SCTP packets delivered through the IPv4/IPv6 SCTP protocol handlers to a listening SCTP endpoint.\nAC:L - In a deployment with SCTP cookie HMAC disabled, the attacker can obtain a cookie through the normal INIT/INIT_ACK exchange, modify the cached INIT length, and send the forged COOKIE_ECHO without races or conditions outside attacker control.\nPR:N - The path is pre-authentication network protocol handling for a listening SCTP server; no local account or SCTP authentication is required when cookie HMAC is disabled.\nUI:N - Exploitation only requires sending SCTP handshake packets to the target listener and does not require victim user action.\nS:U - The impact is within the Linux kernel/network stack security authority and does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The inflated cached INIT length drives out-of-bounds parameter walking and attacker-sized kmemdup() reads beyond the received skb, which can expose kernel memory.\nI:H - The bug is kernel memory-safety corruption during nested parameter handling, and the higher-severity choice is appropriate because attacker-controlled parsing and copies beyond the valid buffer can corrupt kernel association state and plausibly support stronger primitives.\nA:H - The out-of-bounds reads and large attacker-controlled copies can trigger kernel faults, KASAN splats, allocation failure paths, or repeated remote crashes of SCTP processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53246","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53250","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached by a local process using AF_XDP socket setup, UMEM registration, TX ring submission, and send/poll-driven transmit; it is not reachable directly from remote network packets.\nAC:L - The attacker controls the UMEM metadata and can trigger TX from the same process, so the TOCTOU race can be created with attacker-controlled concurrent writes.\nPR:L - AF_XDP socket creation requires CAP_NET_RAW in the relevant network namespace, which is attainable by a low-privileged local user in user/network namespace deployments.\nUI:N - No victim action is needed after the attacker has local execution; the attacker sets up the socket, UMEM, metadata, and transmit operation directly.\nS:U - The vulnerability corrupts or reads kernel networking memory within the same kernel security authority; this is standard local kernel attack surface, not a VM or hardware boundary crossing.\nC:H - Racing csum_start/csum_offset can bypass validation and drive out-of-bounds checksum reads in kernel transmit checksum handling, so potential kernel memory disclosure is high.\nI:H - The same unvalidated checksum offsets can cause checksum writes to an attacker-influenced out-of-bounds location relative to skb data, making kernel memory corruption plausible.\nA:H - The out-of-bounds memory access in the kernel transmit path can trigger warnings, faults, or kernel crashes and can be repeatedly exercised by the local attacker."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53250","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53262","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through a local `ioctl()` on a connected PPPoL2TP `AF_PPPOX` socket. Remote L2TP packets do not invoke `pppol2tp_ioctl()`.\nAC:L - The attacker controls both sides of the race by blocking `copy_from_user()` in the ioctl thread and closing the same socket concurrently. No external victim state is required.\nPR:L - A local unprivileged user can reach the PPPoL2TP socket/ioctl path; L2TP management also uses user-namespace admin permissions rather than requiring real init-namespace root. This is not remotely reachable without local code execution.\nUI:N - No victim action is required after the attacker runs local code. The attacker creates/connects the socket, issues the ioctl, and closes the socket.\nS:U - The impact is within the kernel security authority on the same system. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel heap use-after-free of `struct l2tp_session`, and the resumed ioctl can read from reclaimed/faked session and tunnel data before copying results to userspace. Per conservative kernel UAF scoring, this supports high confidentiality impact.\nI:H - Kernel UAFs with attacker-controlled timing and heap reuse can be leveraged beyond a simple stale read, including corruption or control-flow primitives. When uncertain, the higher severity option is appropriate.\nA:H - At minimum, dereferencing the stale session or tunnel pointer can trigger a kernel oops or panic. The attacker can repeatedly trigger the race locally."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53262","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53267","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached by installing crafted nftables/netfilter rules through NETLINK_NETFILTER and then triggering packet evaluation locally. Remote packets alone cannot install the rule, so this is a local attack vector.\nAC:L - A single crafted rule sequence such as `ct zone set` followed by `ct original saddr` can deterministically trigger the bug on matching packets. No race or external condition beyond the attacker's control is required.\nPR:L - Rule creation requires CAP_NET_ADMIN for the relevant network namespace via nfnetlink. Because nftables is reachable with CAP_NET_ADMIN in a user-created network namespace on systems permitting unprivileged user namespaces, this is low privileges rather than high.\nUI:N - After the attacker installs the crafted rule, triggering occurs through packet processing without any victim user action. No user needs to open a file, mount anything, or interact with attacker-controlled content.\nS:U - The bug corrupts kernel memory during kernel packet-filter evaluation and impacts the same kernel security authority. This is standard kernel privilege escalation/DoS behavior, not a VM, IOMMU, or distinct security-scope escape.\nC:H - The bug is a kernel stack out-of-bounds write past `struct nft_regs`, a memory corruption primitive. Under the required higher-severity rule, such memory corruption is defensibly treated as capable of enabling high confidentiality impact.\nI:H - The vulnerable 16-byte memcpy can overwrite beyond the validated destination register on the kernel stack. Out-of-bounds kernel writes are high integrity impact because they can plausibly be developed into control-flow or privilege-modification primitives.\nA:H - The stack overwrite can corrupt adjacent stack state or registers during packet evaluation and can crash or oops the kernel. Kernel crash or panic is high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53267","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53354","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable TLBI completion path is reachable by locally executing code that drives memory permission/unmap activity through syscalls or guest/KVM memory-management activity. It is not directly exposed by network packets.\nAC:L - Although the erratum depends on timing, the attacker can repeatedly arrange concurrent stores and translation invalidations on affected multicore Arm systems. The triggering race is therefore attacker-influenced rather than dependent on a one-off external condition.\nPR:L - A basic unprivileged local user or guest workload can reach the relevant Stage-1/Stage-2 TLBI paths without host administrative privileges. No real root capability in the init namespace is required.\nUI:N - After the attacker has local code execution, exploitation only requires attacker-driven memory operations/syscalls or guest activity. No separate victim action is needed.\nS:C - In a severe reasonable deployment such as Arm KVM/cloud virtualization, bypassing Stage-2 or higher-level translation protections can let guest-controlled writes affect hypervisor/host resources. That crosses a security authority boundary.\nC:H - The primitive can enable privilege escalation to kernel or hypervisor context, making protected memory and secrets accessible. Even though the erratum affects stores, successful control of privileged context supports high confidentiality impact.\nI:H - The core issue permits writes to memory after translation permissions or ownership should have been revoked. This is a high-integrity memory corruption primitive with plausible kernel or hypervisor privilege escalation.\nA:H - Incorrect late writes into protected or reused memory can corrupt kernel/hypervisor state. Failed exploitation or corruption can plausibly cause kernel panic, guest/host crash, or system instability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53354","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53375","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through the AMDGPU_CS DRM ioctl on a render node (/dev/dri/renderD*), requiring local access to submit crafted VCE indirect buffers to the GPU driver.\nAC:L - An attacker fully controls the VCE command stream and per-command length fields, and can reliably craft commands where exactly one relocation index is out of bounds (e.g., 0x0500000d with len=32) to trigger partial address patching.\nPR:L - Exploitation requires only unprivileged local access to the amdgpu DRM render node; AMDGPU_CS is gated by DRM_AUTH|DRM_RENDER_ALLOW, not root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the entire malicious command submission through the render node.\nS:C - Partial address patching causes VCE firmware to DMA using attacker-influenced GPU addresses outside the intended buffer object boundaries, crossing the GPU memory/DMA isolation boundary that the relocation logic is meant to enforce.\nC:H - VCE firmware performs DMA reads using the malformed 64-bit address, enabling arbitrary reads from GPU-accessible memory regions (including GTT-mapped system memory) beyond the validated buffer scope.\nI:H - VCE firmware performs DMA writes (encoded bitstreams, feedback, and context buffers) to attacker-influenced addresses, enabling arbitrary GPU-mapped memory corruption and potential privilege escalation primitives.\nA:H - Submitting commands with malformed firmware addresses can cause GPU page faults, driver hangs, GPU resets, or kernel oops/panic when the VCE engine accesses invalid memory regions."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53375","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53388","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local syscalls: mounting a FUSE filesystem, reading files to trigger readpages, and the FUSE daemon writing replies to /dev/fuse via splice_write with SPLICE_F_MOVE.\nAC:L - The race is between the attacker's own splice reply and a concurrent abort they trigger (e.g., via sysfs abort or unmount); the attacker controls both threads and can retry until the window is hit.\nPR:L - Exploitation requires mounting and operating a FUSE filesystem via /dev/fuse, which needs local user privileges; on typical systems this is reachable by unprivileged users via user namespaces (CAP_SYS_ADMIN in a user namespace) without init-namespace root.\nUI:N - No victim interaction is required; the attacker mounts the filesystem, runs the FUSE daemon, and triggers the concurrent abort themselves.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as guest-to-host or sandbox breakout.\nC:H - The vulnerability is a use-after-free of fuse_io_args and associated folio pointers in kernel heap memory, which can be leveraged for arbitrary kernel memory read via heap reuse.\nI:H - Use-after-free of fuse_io_args enables heap spraying and controlled reuse of freed kernel objects, providing a path to arbitrary kernel memory write or code execution.\nA:H - The UAF and the race with folio replacement can cause kernel oops/panic, including NULL pointer dereference when fuse_readpages_end accesses a folio with a NULL mapping."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53388","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53391","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The crash is triggered by processing a malicious GETDEVICEINFO RPC response from an NFS metadata server over the network, on the standard NFSv4 client path used by pNFS file and flexfile layouts.\nAC:L - Once a victim is a pNFS client, the attacker reliably triggers the bug by sending a GETDEVICEINFO body with a zero-length r_netid or r_addr opaque; no race or special memory layout is required.\nPR:N - The attacker acts as (or compromises) the remote NFS metadata server and needs no local privileges on the victim client; exploitation is delivered entirely through NFS protocol responses to an already-established mount.\nUI:N - In the highest-impact scenario—a compromised enterprise/HPC metadata server or autofs-managed pNFS mount—no further victim action is needed beyond normal file I/O that provokes GETDEVICEINFO.\nS:U - The vulnerability causes a kernel panic on the NFS client itself and does not cross a security boundary such as a VM escape or sandbox breakout.\nC:N - This is a NULL pointer dereference in strrchr() with no out-of-bounds read or use-after-free; it does not disclose kernel memory or attacker-controlled data.\nI:N - There is no memory corruption, arbitrary write, or control-flow hijack primitive—only an immediate NULL dereference that terminates kernel execution.\nA:H - The NULL pointer dereference in kernel context causes an oops or panic, fully denying availability of the affected client (and any co-hosted workloads until reboot)."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53391","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53402","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the KDFONTOP ioctl on a framebuffer-console virtual terminal (/dev/ttyN), which is a local syscall path with no network or physical-access vector.\nAC:L - An attacker who controls a session on an fbcon-backed VT can reliably trigger the bug by issuing a font-change ioctl with different dimensions and a 256↔512 glyph transition, then inducing vc_resize() failure through self-controlled memory pressure; no race or victim-dependent timing is required.\nPR:L - KDFONTOP font-set operations require only that the caller owns the controlling TTY (current->signal->tty == tty), which any unprivileged local user with a console or VT session has; CAP_SYS_TTY_CONFIG is not required on that path.\nUI:N - Exploitation requires only the attacker's own ioctl and memory-pressure actions on their TTY; no action by another user or administrator is needed.\nS:U - Impact is confined to kernel memory disclosure and potential kernel crash within the same kernel security authority; there is no VM escape, sandbox escape, or cross-security-boundary effect.\nC:H - The desynchronized hi_font_mask causes deterministic out-of-bounds reads from the kernel font glyph buffer during fbcon rendering (e.g., bit_cursor and rotated putcs paths), enabling disclosure of adjacent kernel memory.\nI:N - The flaw is an out-of-bounds read with console state desynchronization; it does not provide an arbitrary kernel write, code execution, or other data-modification primitive.\nA:H - Out-of-bounds reads from kernel font data can cause kernel page faults and oopses, consistent with the prior syzkaller-reported fbcon font/resize failure class that produced unhandled page faults."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53402","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63802","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local cgroup management (rmdir on cgroupfs) and concurrent block I/O to populate per-blkcg rstat lists; the vulnerable code is in the block cgroup teardown path, not in any network protocol handler.\nAC:L - The attacker controls both sides of the race by issuing I/O on multiple block devices to create multiple blkgs with pending stats, then concurrently destroying the cgroup to trigger parallel blkg_release() calls on multiple CPUs.\nPR:L - Triggering cgroup deletion and block I/O requires only delegated cgroup write access or namespace/container root (CAP_SYS_ADMIN in a user namespace), not init-namespace root; this is routinely available in containers, Kubernetes pods, and systemd user cgroup hierarchies.\nUI:N - No victim interaction is required; the attacker programmatically performs I/O and cgroup teardown from their own process or container.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it does not inherently cross a VM, container, or IOMMU boundary without a separate privilege-escalation step.\nC:H - The use-after-free dereferences freed blkg structures and associated iostat data during list iteration, enabling arbitrary kernel memory read primitives typical of slab UAF bugs.\nI:H - UAF on kmalloc-allocated blkg objects allows heap grooming and write through dangling pointers, which can be leveraged for arbitrary kernel memory modification or code execution.\nA:H - Concurrent use-after-free during blkg teardown can cause immediate kernel oops/panic from accessing freed memory, and repeated triggering enables reliable denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63802","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63806","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - A malicious KVM guest triggers this via guest-executed MMIO stores handled by the x86 instruction emulator (KVM_RUN → vmx_handle_exit → kvm_mmu_page_fault → x86_emulate_instruction → emulator_read_write → vcpu_mmio_write → ioeventfd_write), not via remote network input to the host.\nAC:L - The guest fully controls the spanning store address, size, and timing; with standard QEMU/virtio datamatch ioeventfd MMIO layouts, a page-boundary write reliably reaches ioeventfd_in_range() with a misaligned val pointer and fires the BUG_ON().\nPR:N - Exploitation requires only unprivileged code execution inside an already-running guest VM (reproducer ran as UID 1000); no host capabilities, KVM ioctls, or guest root are needed beyond what any cloud VM tenant or compromised guest process already has.\nUI:N - No victim interaction is required once the attacker can run code in a KVM guest with a datamatch ioeventfd configured, which is the default virtio/QEMU setup.\nS:C - The vulnerable component is the host kernel KVM subsystem, but exploitation is initiated from a guest VM and causes a host kernel BUG/oops, crossing the hypervisor security boundary.\nC:N - The failure mode is an explicit BUG_ON() alignment check before any datamatch comparison; there is no out-of-bounds read, use-after-free, or other memory corruption that could disclose host data.\nI:N - The bug triggers a deliberate kernel BUG and does not corrupt or modify host memory; it is a crash-only denial-of-service with no integrity impact.\nA:H - A guest-triggered BUG_ON() in ioeventfd_write() causes a host kernel oops/panic, denying availability of the entire physical host and all co-resident VMs on multi-tenant KVM hypervisors."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63807","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the KVM VM file descriptor ioctl path (KVM_SET_USER_MEMORY_REGION), which requires local syscall access to /dev/kvm rather than any network-facing protocol.\nAC:L - An attacker with KVM access can deterministically set up the required state (partial hugepage memslot, dirty logging enabled then disabled, guest hugepage mapping extending below slot bounds) and trigger the bug without depending on conditions outside their control.\nPR:L - Exploitation requires only local access to /dev/kvm and control of a VM (e.g., membership in the kvm group), as demonstrated by the reproducer running as UID 1000; it does not require host root in the init namespace.\nUI:N - No victim user interaction is required beyond the attacker issuing the KVM ioctl to disable dirty logging on a memslot they control.\nS:C - The vulnerable KVM x86 MMU code runs in the host kernel and a VM operator can corrupt or crash host kernel memory from their guest/VM management context, crossing the guest-to-host virtualization security boundary.\nC:H - The bug is an out-of-bounds kernel read of memslot lpage_info metadata via an invalid gfn index in kvm_mmu_max_mapping_level(), which per kernel guidance qualifies as high confidentiality impact even though it typically manifests as a page fault.\nI:H - Out-of-bounds access to kernel heap metadata in the KVM MMU subsystem can potentially be steered for memory corruption and control-flow influence; similar KVM shadow MMU memory safety bugs are scored at high integrity impact.\nA:H - The vulnerability reliably causes a host kernel oops/page fault (supervisor read to non-present vmalloc address) when triggered, constituting high availability impact via host kernel crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63807","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63824","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reachable only through the keyctl(2) syscall (KEYCTL_PKEY_ENCRYPT, KEYCTL_PKEY_DECRYPT, or KEYCTL_PKEY_SIGN); there is no network, adjacent, or physical attack path to the affected code.\nAC:L - An attacker fully controls the undersized out_len parameter and can reliably trigger the bug on demand with no races or victim-dependent state; CONFIG_ASYMMETRIC_KEY_TYPE is commonly enabled on server and desktop kernels.\nPR:L - Exploitation requires KEY_NEED_SEARCH on an asymmetric key, which any unprivileged local user can satisfy by loading their own RSA/EC key into a session keyring; no real root or init-namespace capabilities are needed.\nUI:N - Exploitation requires only attacker-initiated keyctl calls and does not depend on any victim user action such as opening a file or mounting a filesystem.\nS:U - Impact is confined to kernel heap memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - When out_len is smaller than the cryptographic output (including out_len=0 where kmalloc(0) yields ZERO_SIZE_PTR), asym_eds_op returns the full primitive output size and copy_to_user reads far beyond the allocated buffer, leaking adjacent kernel heap contents to userspace.\nI:H - The undersized kmalloc buffer is passed directly as the crypto output target; asymmetric operations can write up to the primitive maximum (hundreds of bytes for RSA-4096) past the allocation, enabling heap corruption and potential control-flow hijacking.\nA:H - Heap out-of-bounds read/write against kmalloc objects or writes through ZERO_SIZE_PTR can cause kernel oops, panic, or KASAN-detected corruption, satisfying high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63824","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63829","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires sending RTM_NEWLINK changelink requests over rtnetlink (netlink socket), matching the kernel guidance that tc/netlink configuration paths are Local.\nAC:L - Once a cross-namespace GRE/ERSPAN device is present in the caller's netns, triggering the bug is a single deterministic netlink changelink with no races or attacker-uncontrollable timing.\nPR:L - The rtnl entry path requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user can obtain inside a user namespace via unshare --user --map-root-user --net without real init-namespace root.\nUI:N - Exploitation is fully programmatic through netlink; no victim user action such as opening a file or mounting a filesystem is required.\nS:C - The changelink mutates tunnel state in t->net while authorization is checked only against dev_net(dev), crossing from the attacker's net/user namespace into another tenant's or the host's network namespace tunnel tables.\nC:H - An attacker can rewrite IFLA_GRE_REMOTE/LOCAL, keys, and related tunnel parameters to redirect GRE/ERSPAN traffic through attacker-controlled endpoints and read tunneled payloads.\nI:H - Unauthorized changelink updates live tunnel fields (including collect_md and encap parameters parsed before the missing check), enabling arbitrary redirection or injection of traffic in the victim link netns.\nA:H - Rewriting tunnel endpoints, keys, or metadata handling can break production GRE/ERSPAN overlays and VPN paths, causing sustained loss of connectivity for dependent services."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63829","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63884","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local DRM ioctls on the Intel GPU render node (notably I915_GEM_EXECBUFFER2 and I915_GEM_MADVISE); there is no network, adjacent-radio, or physical-access entry path.\nAC:L - An attacker controls the triggering workload (concurrent execbuffers, madvise DONTNEED, and GPU memory pressure to force eviction), and the UAF is a deterministic stale-pointer bug rather than a race against uncontrollable system state.\nPR:L - Exploitation requires only access to the DRM render node and standard unprivileged GEM ioctls (DRM_RENDER_ALLOW); no CAP_SYS_ADMIN, DRM master, or init-namespace root is needed.\nUI:N - No victim interaction is required beyond the attacker (or a compromised local GPU client) issuing its own ioctl submissions to the render node.\nS:U - Successful exploitation yields kernel memory corruption and local privilege escalation within the same kernel security authority; it does not constitute a VM escape or IOMMU/DMA boundary bypass.\nC:H - This is a kernel heap use-after-free on a freed i915_ttm_tt structure; attacker-controlled reuse of the freed object can provide arbitrary kernel memory read primitives.\nI:H - UAF on the i915_ttm_tt/filp path enables heap grooming and corrupting kernel objects, providing a standard path to arbitrary kernel write and code execution.\nA:H - The vulnerability was observed causing a kernel general protection fault/oops under real workloads, and UAF in this path can reliably crash or hang the system even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63884","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63893","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:A - A malicious Thunderbolt XDomain peer (adjacent host, dock, or in-line device on a direct Thunderbolt/USB4 link) delivers crafted PROPERTIES_RESPONSE data that the victim kernel parses during automatic XDomain discovery.\nAC:L - The peer fully controls property entry value/length fields and can reliably craft the u32 wrap (e.g. value=0xffffff00, length=0x100) without races or special memory layout.\nPR:N - Exploitation requires no privileges on the victim system; the attacker only needs to be the connected XDomain peer responding to the kernel-initiated property exchange, with no authentication on that control-plane path.\nUI:N - Once a Thunderbolt XDomain link exists, property fetching and parsing run automatically in the kernel handshake state machine without any additional victim user action at exploitation time.\nS:U - Impact is confined to the victim kernel/userspace boundary (kernel heap disclosure to local sysfs and possible kernel crash); it does not cross VM, IOMMU, or sandbox security boundaries.\nC:H - Integer-wrap bypass enables an out-of-bounds kernel memory read of up to entry->length dwords, which for deviceid/vendorid TEXT properties is copied into world-readable sysfs attributes, disclosing kernel heap contents.\nI:N - The bug is an out-of-bounds read via parse_dwdata(); destination buffers are properly sized kcalloc allocations, so there is no out-of-bounds write or integrity modification of victim kernel structures.\nA:H - Reading from block+0xffffff00 dwords (~4 GB past the allocation) will access unmapped kernel addresses, causing a kernel fault/oops/panic in addition to any information disclosure."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63893","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63912","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the ESP outbound encryption path reached when IPsec-protected traffic is sent through xfrm (e.g., from an internet-facing VPN/tunnel gateway encrypting responses or forwarded flows to a remote peer). A network peer can influence outbound skb fragment sizes to hit the vulnerable fast path without local shell access.\nAC:L - An attacker can reliably craft payload sizes so ALIGN(skb->data_len) and ALIGN(tailen) each pass the broken per-field PAGE_SIZE gate while their combined aligned length exceeds PAGE_SIZE, repeatedly probing until the out-of-place page-frag path is taken.\nPR:N - Exploitation does not require configuring xfrm or host admin rights; it only needs the target to already run ESP and the attacker to send traffic that is encrypted on output (e.g., as a remote VPN/site-to-site peer), which is network-layer access rather than local OS privilege.\nUI:N - Triggering the vulnerable ESP output path requires only attacker-controlled network traffic and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - The flaw is a heap out-of-bounds write during AEAD encryption over an undersized page frag; such memory corruption can expose adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - Writing past the allocated page-frag buffer corrupts adjacent heap memory and can be developed into arbitrary write or control-flow hijack primitives, matching kernel guidance for out-of-bounds writes.\nA:H - Corrupting kernel heap memory during crypto output can cause immediate kernel oops/panic or persistent instability, and repeated triggering can deny service on VPN gateways and other IPsec endpoints."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63912","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63917","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through rtnetlink configuration (RTM_NEWLINK changelink and RTM_SETLINK netns move via `ip link`), not through remote packet handling on the vti6 tunnel itself.\nAC:L - Exploitation is a deterministic, attacker-controlled sequence (create vti6, move netns, changelink, delete netns) with no races or external victim state required.\nPR:L - The fix commit and rtnetlink path confirm reachability with CAP_NET_ADMIN inside an unprivileged user+network namespace (`unshare --user --map-root-user --net`), not init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug entirely through their own netlink operations.\nS:C - On container hosts, an unprivileged tenant can corrupt namespace teardown and panic the host kernel, impacting resources outside the attacker's security scope (other tenants and the host).\nC:H - The stale per-netns hash leaves `cleanup_net()`/`vti6_exit_rtnl_net()` walking freed `ip6_tnl` list nodes, constituting a use-after-free with arbitrary kernel memory read potential.\nI:H - Cross-netns hash corruption can leave dangling pointers and drive `unregister_netdevice_queue()` on already-freed devices (kernel BUG at net/core/dev.c:12376), enabling memory corruption exploitable for control-flow hijacking.\nA:H - The published reproducer reliably triggers a kernel BUG during namespace cleanup, causing host-wide denial of service via kernel panic/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63917","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63919","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable path is reached when IPsec ESP/AH packets are received and processed through xfrm_input transport-mode reinjection, which is a network packet receive path in net/xfrm. Remote peers can send ESP traffic to trigger deferred queueing on systems with IPsec configured.\nAC:L - The attacker controls both sides of the race by flooding IPsec packets to queue deferred reinjection work while concurrently destroying the network namespace, making the UAF reliably triggerable without conditions outside attacker control.\nPR:L - Exploitation requires configuring xfrm/IPsec and managing network namespace lifecycle, both reachable with CAP_NET_ADMIN obtainable by an unprivileged user via user namespaces (unshare -Urn), not requiring real root in the init namespace.\nUI:N - No victim user interaction is required; exploitation is achieved through automated packet transmission and namespace teardown scripted by the attacker.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The deferred callback dereferences a freed struct net (e.g., ip6_rcv_finish_core reads sysctl fields from the UAF pointer), providing an information disclosure primitive from attacker-influenced freed slab memory.\nI:H - Use-after-free on the large struct net slab object enables heap grooming and memory corruption exploitable for arbitrary kernel writes and control-flow hijacking, not merely a bounded modification.\nA:H - Dereferencing a freed network namespace structure causes kernel oops/panic from the workqueue callback path, and UAF reliably threatens system availability even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63919","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63921","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl(SIOCCHGTUNNEL) on a migrated vti6 netdev via socket/dev_ioctl; the bug is in vti6_siocdevprivate(), not in remote packet reception.\nAC:L - The attacker fully controls namespace creation, tunnel migration (IFLA_NET_NS_FD), and ioctl parameters to collide with a victim tunnel; the commit documents a deterministic, reproducible sequence with no uncontrollable race.\nPR:L - Only CAP_NET_ADMIN in the migrated (attacker) network namespace is required, obtainable via unprivileged user namespaces (unshare --user --map-root-user --net); the missing check against the creation namespace's user_ns is the core flaw.\nUI:N - No victim interaction is needed; the attacker performs all setup steps (create/migrate tunnel, issue SIOCCHGTUNNEL) autonomously.\nS:C - The attack hijacks IPsec/XFRM traffic destined for tunnels in a different tenant's network namespace on container hosts, crossing container/tenant security boundaries rather than staying within the attacker's own scope.\nC:H - After hash poisoning, xfrm receive delivers matched/decapsulated packets to the attacker-controlled netdev, enabling interception of victim VPN/IPsec traffic including potentially sensitive plaintext after decryption.\nI:H - The attacker gains control over which netdev receives victim tunnel traffic and can read, drop, or forward/modify decapsulated packets, constituting unauthorized manipulation of another tenant's network data path.\nA:H - Hijacking the creation-namespace hash bucket causes the legitimate victim tunnel to stop receiving matched traffic, producing denial of service to the victim's IPsec connectivity."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63921","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63922","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached on the standard IPv6 input path (ipv6_rcv → ip6_input → ip6_protocol_deliver_rcu → ipv6_destopt_rcv) when a remotely sent IPv6 packet carries a Destination Options header processed by ip6_parse_tlv().\nAC:L - The attacker fully controls the crafted IPv6 Destination Options layout (HAO TLV followed by trailing TLVs/padding); once CONFIG_IPV6_MIP6 and matching XFRM state exist on the target, triggering the stale-pointer condition is a reliable single-packet attack without races or victim-specific timing.\nPR:N - No local privileges or authentication are required; any remote host that can deliver IPv6 traffic to a listening interface can reach this pre-authentication receive-path parser (destopt_protocol uses INET6_PROTO_NOPOLICY).\nUI:N - Exploitation requires only sending a malicious IPv6 packet; no victim interaction such as opening files, clicking links, or mounting filesystems is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the kernel’s security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - After pskb_expand_head() frees the old skb head, ip6_parse_tlv() continues parsing trailing TLVs through the stale nh pointer, causing out-of-bounds/use-after-free reads of kernel heap memory that can disclose sensitive kernel data.\nI:H - Use-after-free of the skb head buffer during TLV parsing is heap memory corruption that can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a bounded parse error.\nA:H - Reading through the stale network-header pointer into freed or invalid memory can cause kernel oops/panic or unrecoverable instability, satisfying high availability impact even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63922","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63924","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPv6 input path (ipv6_rcv → ip6_rcv_core → ipv6_parse_hopopts) triggered by a crafted IPv6 packet with hop-by-hop options containing a Jumbo Payload TLV, reachable from any remote peer that can deliver IPv6 to the host.\nAC:L - An attacker fully controls the crafted IPv6 packet (HBH layout, jumbo length, trailing TLVs) and can send it repeatedly; once the skb is cloned/shared during receive and pskb_trim_rcsum reallocates the head, the stale-pointer UAF is deterministically triggered without races or victim-specific state.\nPR:N - No authentication or local privileges are required; any unauthenticated remote host that can send IPv6 traffic to a listening interface reaches the vulnerable receive handler with no capability or namespace checks along the path.\nUI:N - Exploitation requires only delivery of a malicious IPv6 packet and does not depend on any victim user action such as opening files, clicking links, or mounting filesystems.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary by itself.\nC:H - Continued HBH TLV parsing through the stale nh pointer is a use-after-free read of freed skb head memory, which per kernel guidance enables arbitrary kernel memory disclosure when the freed slab is reused.\nI:H - Stale-pointer UAF during TLV length/type parsing can yield unbounded out-of-bounds reads and corrupt subsequent parsing state, providing memory corruption primitives that can be developed into arbitrary kernel writes or code execution.\nA:H - Dereferencing the freed network-header pointer during TLV parsing can cause immediate kernel oops/panic from invalid memory access, and UAF-triggered parsing errors reliably drop or crash the receive path."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63924","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63946","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when the kernel processes inbound Bluetooth LE ISO data (HCI_ISODATA_PKT) from a remote peer over the radio; per kernel guidance Bluetooth is Adjacent, not Network.\nAC:L - An attacker can reliably win the race by flooding ISO frames while concurrently closing the ISO socket (or inducing disconnect that triggers stack teardown), controlling both the receive path and the iso_sock_kill() teardown path.\nPR:N - Exploitation requires only an established ISO connection with a malicious adjacent Bluetooth device; the vulnerable receive path needs no local privileges, and socket teardown can occur automatically when the remote peer disconnects.\nUI:N - No victim interaction is required during exploitation; ISO socket closure on disconnect is handled automatically by the Bluetooth stack and userspace daemons without user action.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The use-after-free dereferences freed struct sock memory (sk->sk_state) after iso_sock_kill() can sock_put() the socket, enabling arbitrary kernel memory read primitives via heap reuse.\nI:H - The UAF continues into sock_queue_rcv_skb() on the freed socket, corrupting socket receive-queue state and enabling heap-based write/control-flow hijack primitives typical of kernel UAF bugs.\nA:H - Use-after-free on struct sock during receive processing can cause kernel oops/panic from invalid memory access, and UAF bugs in the kernel are rated High availability impact even when not fully weaponized."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63946","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63952","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (memfd_create, mmap, fcntl) with no network-facing code path; the vulnerable logic is reached only through the local fcntl(F_ADD_SEALS) interface on a memfd file descriptor.\nAC:L - The attack is a reliable, deterministic syscall sequence (create executable memfd, establish a writable MAP_SHARED mapping, then apply F_SEAL_EXEC) with no race or attacker-uncontrollable conditions.\nPR:L - Any unprivileged local user can invoke memfd_create, mmap, and fcntl without capabilities; these interfaces are available inside unprivileged user namespaces with no real-root requirement.\nUI:N - Exploitation does not require a human victim action; in the highest-impact scenario a sandboxed process programmatically passes the sealed-appearing memfd to a trusting peer via IPC (e.g., SCM_RIGHTS) without user interaction.\nS:C - The bug breaks the memfd seal security contract designed for mutually untrusted parties, allowing a malicious local peer to deceive a separate process that relies on F_SEAL_WRITE immutability, crossing the inter-process trust boundary (sandbox/W^X enforcement).\nC:H - Bypassing write-seal/W^X guarantees enables arbitrary modification of executable memfd contents presented as immutable, which can be leveraged for arbitrary code execution in a trusting victim process and thereby full read of that process's memory.\nI:H - The vulnerability allows arbitrary modification of memory that is advertised as write-sealed (F_SEAL_WRITE), defeating the kernel's immutability guarantee and enabling W^X bypass and code injection into trusted execution contexts.\nA:N - The flaw is a logic error in seal enforcement that does not cause kernel crashes, panics, hangs, or denial of service; exploitation maintains availability while subverting integrity guarantees."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63952","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63968","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable function is reached from the IPv6 packet receive path (ipv6_rcv → ip6_route_input → ip6_pol_route → fib6_select_path) in softirq context, and production lockups were observed during processing of incoming IPv6 traffic on internet-facing edge routers.\nAC:L - The race is reliably triggerable when an attacker influences both packet flow and route churn (e.g., user-namespace ECMP setup plus traffic, or remote traffic coinciding with BGP nexthop updates); a dedicated selftest reproduces soft lockups in under a minute under controlled conditions.\nPR:N - Triggering fib6_select_path() during packet processing requires only the ability to send IPv6 traffic to destinations using multipath routes; concurrent route-table updates can occur from infrastructure (BGP/dynamic routing) without the attacker holding any local privileges.\nUI:N - Exploitation requires no victim interaction beyond normal network traffic delivery to a host or router processing IPv6 packets.\nS:U - The impact is kernel CPU soft lockup and watchdog panic within the same kernel security boundary; there is no sandbox, VM, or IOMMU boundary crossing.\nC:N - The bug is an infinite loop over stale sibling-list pointers during RCU read-side traversal; it does not read or disclose attacker-controlled memory or kernel secrets.\nI:N - No data modification or memory corruption occurs; the failure mode is CPU hang from unbounded list iteration, not arbitrary write or code execution.\nA:H - The infinite loop in softirq context causes CPU soft lockup, and documented production and test cases show this leads to watchdog-triggered kernel panic, a complete loss of system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63968","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63971","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls on an SCTP socket (`sendmsg`/`sendto` to trigger `sctp_wait_for_connect`, and `getsockopt(SCTP_SOCKOPT_PEELOFF)` to peel off the association). A remote peer can only help complete the SCTP handshake; it cannot invoke peeloff or the racing send path.\nAC:L - The attacker controls both sides of the race by running concurrent threads on the same SCTP one-to-many socket, timing peeloff during the window where `sctp_wait_for_connect()` has released the socket lock. Required options (`SCTP_FRAGMENT_INTERLEAVE`, `SCTP_INTERLEAVING_SUPPORTED`, and `net.sctp.intl_enable`) are attacker-settable in a user/net namespace.\nPR:L - No real-root capability is required; an unprivileged user can create SCTP sockets and drive the full race from a user namespace (`unshare -Urn`), including enabling `net.sctp.intl_enable` and the interleaving socket options needed to reach the vulnerable `sctp_sendmsg_to_asoc()` path.\nUI:N - Exploitation is fully attacker-driven through coordinated local threads and does not require any action from a victim user or administrator beyond normal SCTP socket use.\nS:U - Impact is confined to kernel memory integrity/availability within the same security authority; successful exploitation would be local privilege escalation, not a cross-boundary escape such as VM or container breakout by itself.\nC:H - After peeloff migrates `asoc->base.sk`, the caller continues in `sctp_datamsg_from_user()` while holding the wrong socket lock, creating unsynchronized concurrent access to association/stream state that can corrupt kernel heap metadata and be leveraged for arbitrary kernel memory disclosure.\nI:H - The post-race path builds and queues DATA/I-DATA chunks via `sctp_datamsg_from_user()` and `sctp_primitive_SEND()` without the correct socket lock, enabling concurrent modification of association output queues and stream structures that can be turned into arbitrary kernel writes or control-flow hijacking.\nA:H - Concurrent unsynchronized access to a live SCTP association after peeloff can cause kernel oops/panic or wedged associations, and the underlying race is a classic kernel concurrency defect with high availability impact even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63971","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63975","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when a remote Bluetooth LE peer sends a crafted L2CAP_ECRED_CONN_RSP on the LE signaling channel, processed via hci_recv_frame → l2cap_recv_acldata → l2cap_le_sig_channel → l2cap_ecred_conn_rsp. Bluetooth is Adjacent per kernel CVSS guidance.\nAC:L - An adjacent attacker who establishes a BLE ACL link can reliably trigger this by first creating an L2CAP channel with a chosen DCID (via ECRED_CONN_REQ SCIDs) and then sending a connection response reusing that DCID for a pending outgoing ECRED connection; no race or rare layout is required.\nPR:N - Exploitation requires only the ability to act as a remote Bluetooth peer on an established ACL connection; no local shell access, capabilities, or root on the victim system is needed.\nUI:N - The malicious signaling traffic is delivered entirely by the remote attacker once a BLE link exists; no additional victim-side file open, mount, or application action beyond normal Bluetooth connectivity is required to reach the vulnerable handler.\nS:U - The failure is a kernel L2CAP channel-list use-after-free and crash within the Bluetooth stack on the victim host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Calling l2cap_chan_del() on the original channel during list_for_each_entry_safe can free the saved tmp list node, causing a use-after-free on struct l2cap_chan when iteration continues; UAF is scored as High confidentiality impact.\nI:H - The same iterator invalidation frees and later dereferences l2cap_chan objects under attacker-influenced connection state, providing a heap UAF primitive that can be groomed toward arbitrary memory corruption and code execution.\nA:H - The bug reliably produces kernel list corruption and use-after-free in softirq/context Bluetooth receive path, leading to kernel oops or panic and denial of service on phones, laptops, and embedded devices with Bluetooth enabled."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63975","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63984","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code runs in the IPv6 routing-header receive handler on incoming packets; a remote attacker can deliver a crafted RFC 6554 type-3 RPL SRH to an RPL-enabled router or gateway over the network.\nAC:L - Triggering requires only a deterministically crafted SRH (e.g., n=127, CmprI=15, CmprE=15, pad=0, hdrlen=16, segments_left>0); all of these fields are fully attacker-controlled once the target has rpl_seg_enabled.\nPR:N - No authentication or local privileges are needed to send the malicious IPv6 packet; rpl_seg_enabled is a victim-side deployment setting on RPL routers/gateways (IoT/industrial mesh), not an attacker privilege requirement.\nUI:N - Exploitation is achieved solely by sending a malformed network packet and does not require any action from a victim user.\nS:U - Impact is confined to kernel memory corruption and packet forwarding within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The hdrlen truncation causes overlapping read/write of the same kmalloc buffer during decompress/recompress, constituting kernel heap memory corruption that can be leveraged for information disclosure primitives.\nI:H - ipv6_rpl_srh_compress() performs out-of-bounds writes into the overlapping decompressed region, corrupting routing-header data that is then memcpy'd into the forwarded skb, enabling memory corruption exploitable for control-flow or data modification.\nA:H - Kernel heap corruption during SRH processing can cause kernel oops, panics, or repeated crashes when processing or forwarding the corrupted packet, consistent with high availability impact for memory-corruption bugs."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63984","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63994","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when remotely injected VXLAN/GENEVE UDP packets traverse a bridged/OVS overlay and fail PMTU checks during encapsulation transmit, the same network path previously demonstrated in CVE-2023-53600 via vxlan_xmit through bridge forwarding.\nAC:L - An attacker can reliably send oversized DF-marked inner IP packets over the overlay to force PMTU ICMP generation, and can influence skb_cow() reallocation through bridge flooding/multicast cloning or headroom pressure; no uncontrollable victim state is required.\nPR:N - Exploitation requires no privileges on the victim host; any remote entity that can send VXLAN/GENEVE traffic to a VTEP with a bridged tunnel interface (standard cloud/SDN deployment) can reach the vulnerable code without authentication.\nUI:N - Triggering is fully automatic during kernel packet forwarding and tunnel encapsulation; no victim user action is needed beyond normal network operation of an overlay endpoint.\nS:U - Impact is confined to kernel memory on the affected host (UAF read/crash/potential escalation); it does not inherently cross VM, container, or IOMMU security boundaries.\nC:H - Stale ip_hdr/ipv6_hdr pointers cause reads from freed slab memory; leaked values are incorporated into ICMP error IP headers that are sent back to the attacker, constituting arbitrary kernel heap content disclosure.\nI:H - Use-after-free on skb header memory is a heap corruption primitive that can be developed into controlled writes or code execution via heap grooming, consistent with kernel UAF severity guidance.\nA:H - Dereferencing freed skb head memory during ICMP construction can cause kernel oops/panic and denial of service, as with other confirmed bugs in this same code path."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63994","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64106","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through the KVM device ioctl path (KVM_SET_DEVICE_ATTR with KVM_DEV_ARM_ITS_RESTORE_TABLES), which requires a local process with access to a VM file descriptor; it is not triggered by network packets or guest MMIO/ITS commands.\nAC:L - An attacker can reliably plant a crafted Device Table Entry in guest RAM (Size field encoding 17–32 EventID bits) and have it processed during migration/snapshot restore; no race or attacker-uncontrollable memory layout is required, and the live MAPD path already proves the invalid state is straightforward to supply.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant who needs no host privileges: they write a malformed DTE directly into guest physical memory (bypassing MAPD validation) and trigger host-side restore during automated live migration or snapshot resume, without requiring /dev/kvm or root on the host.\nUI:N - Exploitation does not require victim interaction beyond normal hypervisor operations such as automated live migration or snapshot restore that the attacker can initiate as a VM tenant; no end-user action like opening a file is needed.\nS:C - The vulnerability crosses the VM security boundary because guest-controlled saved state causes the host kernel to perform an oversized ITS table scan and mass kernel allocations, impacting host availability outside the guest's security scope.\nC:H - The unchecked num_eventid_bits value inflates scan_its_table()'s range up to BIT_ULL(32)*8 bytes (and can wrap the int size parameter for values 28–31), causing the host kernel to read far beyond the valid ITT bounds through kvm_read_guest_lock across a large guest GPA span.\nI:N - The flaw causes excessive guest-memory reads and kernel object allocation but does not corrupt or write host kernel memory; there is no demonstrated arbitrary host write, use-after-free, or code-execution primitive from this bug alone.\nA:H - The oversized scan can loop for an enormous number of kvm_read_guest_lock iterations (worse when the truncated int size wraps to a huge unsigned length), and valid-looking restored ITEs can drive unbounded vgic_add_lpi/kzalloc allocations, exhausting host CPU and memory and causing severe denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64106","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64189","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable dump and resize paths are reached through local NETLINK_NETFILTER send and receive syscalls, not through remotely received packets.\nAC:L - The attacker controls both sides by issuing an ipset dump and concurrent CREATE requests that grow ip_set_list, and can repeat the race without any victim-controlled condition.\nPR:L - NFNETLINK requires CAP_NET_ADMIN in the network namespace's owning user namespace, which an unprivileged user can obtain through user and network namespaces on deployments permitting unprivileged user namespaces.\nUI:N - After obtaining local execution, the attacker can trigger both racing operations without any action by another user.\nS:U - Exploitation compromises the kernel of the same host and constitutes standard local privilege escalation rather than crossing a VM, hypervisor, or IOMMU boundary.\nC:H - Reclaiming the freed array can make the loaded struct ip_set pointer attacker-influenced, after which variant-pointer dereferences can enable kernel code execution and arbitrary memory disclosure.\nI:H - The release path performs an indirect uref callback and decrements ref_netlink through the stale pointer, providing control-flow and kernel-memory-write opportunities after heap reclamation.\nA:H - The reported use-after-free produced a general-protection fault and kernel panic, and an attacker can trigger the race repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64189","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64530","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On a transparent bridge or traffic-shaping gateway configured with the RED qevent and act_ct, unauthenticated remote IP fragments reach red_enqueue() through normal receive, bridge-forwarding, and egress-qdisc processing. No local netlink access is required to trigger the deployed configuration.\nAC:L - The attacker controls fragment contents and ordering and can drive RED into deterministic hard-mark or drop conditions with sustained traffic. No race or condition outside the attacker's control must be won.\nPR:N - CAP_NET_ADMIN is required to create the vulnerable configuration, but a remote attacker sending fragments through an already configured appliance needs no privileges or authentication. Local triggering is also possible with namespaced CAP_NET_ADMIN.\nUI:N - Triggering requires only attacker-generated fragmented traffic and does not depend on a victim performing any action.\nS:U - The corruption occurs within the host kernel and compromises resources governed by that same security authority. This remains unchanged scope even when used for namespace escape or kernel privilege escalation.\nC:H - The reclaimable sk_buff use-after-free and corrupted defragmentation-tree links can be leveraged through attacker-controlled network heap spraying to disclose arbitrary kernel memory.\nI:H - RED overwrites linkage fields that overlap the defragmentation RB node and may free the object while it remains referenced, enabling subsequent writes through freed or attacker-reclaimed kernel objects and potential code execution.\nA:H - The dangling fragment-tree entry can cause immediate or deferred use-after-free, double-free, invalid tree operations, and kernel panic when another fragment arrives or the queue expires. The attacker can trigger this repeatedly with fragmented traffic."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64530","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64560","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached purely through local syscalls (`timer_create`/`timer_settime`/`timer_delete`/`clock_nanosleep`) raced against `execve()` from a non-leader thread in the attacker's own process. No network or remote data path reaches posix-cpu-timers.\nAC:L - The attacker controls both sides of the race — one thread arms and deletes a process-wide CPU timer while a non-leader thread in the same process calls `execve()` — and can loop indefinitely with CPU pinning/thread spraying to widen the window between `pid_task()` and `lock_task_sighand()`. No condition depends on anything outside attacker control.\nPR:L - Any ordinary unprivileged local user can create and delete `CLOCK_PROCESS_CPUTIME_ID` timers; `pid_for_clock()` performs no capability check when the encoded PID is 0, and `CONFIG_POSIX_TIMERS` is `default y` on essentially all deployments.\nUI:N - The attacker performs every step — timer creation, arming, deletion, and the concurrent non-leader exec — entirely within its own multithreaded process. No victim action is involved.\nS:U - The corruption stays within the kernel's own security authority; it is a standard local kernel memory-corruption/privilege-escalation primitive with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The stale timerqueue node yields UAF reads of the freed `k_itimer` and causes `current` (a live `task_struct` pointer) plus rbtree pointers to be written into the freed/reallocated slot, and the freed object can be reclaimed by another attacker-created `k_itimer`, enabling kernel pointer disclosure and broad memory read.\nI:H - `collect_timerqueue()` writes into freed memory (`ctmr->firing`, `ctmr->handling`, rbtree rebalancing, list insertion) and the `do_cpu_nanosleep()` variant does so into a live, attacker-groomed kernel stack frame, followed by `cpu_timer_fire()` dereferencing attacker-controlled `it_process`/`it_signal` — a control-flow-hijack-capable write primitive.\nA:H - Even without exploitation the dangling timerqueue node produces rbtree/list corruption and a kernel oops, and the pre-fix `WARN_ON_ONCE(timerqueue_node_queued(...))` is an immediate panic under `panic_on_warn`; the race can be triggered repeatedly by any local user."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64560","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64561","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable shadow-MMU page-fault path is reached via local KVM_RUN handling of guest EPT/shadow faults (and nested EPT via paging_tmpl), not by network or adjacent-radio packets.\nAC:L - An attacker who can run nested or shadow-MMU guests controls MMU pressure (heavy nested mappings and/or KVM_SET_NR_MMU_PAGES) and concurrent faults so reclaim zaps an in-use root during make_mmu_pages_available; no attacker-uncontrollable condition is required.\nPR:L - Exploitation needs /dev/kvm access or a nested-capable guest on the host, privileges commonly available to kvm-group users or cloud tenants, not real init-namespace root or CAP_SYS_ADMIN on the create/run path.\nUI:N - Once the attacker can run the guest, they trigger reclaim and page faults entirely through their own vCPU activity with no action by another user.\nS:C - Guest-controlled faults corrupt host KVM MMU state (invalid shadow pages on active_mmu_pages and subsequent list handling), crossing the guest-to-host virtualization boundary into the host kernel authority.\nC:H - Invalid children on active_mmu_pages break zap accounting assumptions so later prepare_zap list_add on still-linked entries corrupts kernel lists, a memory-corruption primitive that can be leveraged for arbitrary host reads.\nI:H - The same active-list invariant break and linked-list corruption in host MMU teardown/reclaim paths yield writable host corruption suitable for control-flow or structure hijacking, not merely a benign accounting glitch.\nA:H - WARN_ON_ONCE skips, infinite zap loops, list corruption, and host oops/hangs are reachable when invalid shadow pages remain on active_mmu_pages, causing host and co-located VM denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64561","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64564","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in SCTP ASCONF receive processing (sctp_rcv → sctp_sf_do_asconf → sctp_process_asconf → sctp_process_asconf_param); a remote peer triggers it by sending a crafted ASCONF over IP/IPv6 on an established association, matching kernel guidance that net/ stack bugs reachable via received packets are Network.\nAC:L - A single attacker-controlled ASCONF with [Address Parameter L][DEL-IP L][DEL-IP 0.0.0.0] reliably frees asconf->transport then reuses it in the same softirq; the peer fully controls multi-homing, serial, and parameter order, with no race or other condition outside attacker influence.\nPR:N - Any remote SCTP peer that completes a normal association with ADD-IP negotiated can send the ASCONF; SCTP-AUTH keys come from the handshake the peer itself performs (or addip_noauth), and no local credentials or capabilities on the target are required.\nUI:N - Exploitation requires only attacker-sent SCTP packets processed automatically in the receive/state-machine path; no victim user action such as opening a file or mounting a device is needed.\nS:U - Impact is confined to the vulnerable host kernel (sctp_transport UAF / crash or privilege escalation) and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - This is a heap use-after-free of an sctp_transport planted into primary_path/active_path after RCU-deferred free; freed-object reuse yields arbitrary kernel read primitives, scored High per UAF guidance.\nI:H - The same transport UAF enables heap spraying and write/control-flow hijacking via later dereferences of the dangling primary_path/active_path, so integrity impact is High.\nA:H - set_primary() immediately dereferences the freed transport and leaves the association with transport_count 0 and dangling path pointers, causing a reproducible kernel oops/panic on subsequent use, which is High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64564","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64600","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation uses local FICLONE and concurrent O_DIRECT write syscalls against an XFS filesystem.\nAC:L - The attacker controls both racing writers, can amplify the transaction-allocation window, and demonstrated exploitation typically succeeds within seconds.\nPR:L - A basic unprivileged local user needs only read access to the protected source and write access to a scratch file; no capabilities are required.\nUI:N - The attacker creates the reflink and triggers both sides of the race without any victim action.\nS:U - This is a standard local kernel-mediated privilege escalation affecting resources within the host operating system's existing security authority.\nC:H - Overwriting /etc/passwd or a readable SUID-root binary yields full root access and consequently unrestricted access to system-confidential data.\nI:H - The stale physical mapping provides attacker-controlled persistent writes into protected readable files while preserving their ownership and SUID metadata, enabling full root compromise.\nA:H - The attacker can persistently corrupt boot-critical binaries or configuration files and, after obtaining root, cause complete system unavailability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64600","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A3602-1","advisory_id":"130b8b86-0b9f-4b76-b8c0-96bf6997a30c","event_types":["advisory"],"published_at":"2026-10-25T22:45:52.959384+00:00","technologies":["core-osv","kernel-64kb","kernel-default","kernel-default-base","kernel-docs","kernel-livepatch-sle15-sp6-update-30","kernel-obs-build","kernel-source","kernel-syms","kernel-zfcpdump"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T15:40:54+00:00","detail_url":"/events/71340"},"members":[{"id":71340,"cve_ids":["CVE-2026-31482","CVE-2026-31483","CVE-2026-31542","CVE-2026-31598","CVE-2026-31628","CVE-2026-43033","CVE-2026-43046","CVE-2026-43056","CVE-2026-43276","CVE-2026-43440","CVE-2026-43475","CVE-2026-45904","CVE-2026-46056","CVE-2026-46080","CVE-2026-46084","CVE-2026-46109","CVE-2026-46117","CVE-2026-46126","CVE-2026-46144","CVE-2026-46145","CVE-2026-46174","CVE-2026-46193","CVE-2026-46243","CVE-2026-46323","CVE-2026-46324","CVE-2026-46333","CVE-2026-52967","CVE-2026-52986","CVE-2026-53050","CVE-2026-53129","CVE-2026-53131","CVE-2026-53177","CVE-2026-53224","CVE-2026-53246","CVE-2026-53250","CVE-2026-53262","CVE-2026-53267","CVE-2026-53297","CVE-2026-53324","CVE-2026-53354","CVE-2026-53375","CVE-2026-53388","CVE-2026-53391","CVE-2026-53402","CVE-2026-63794","CVE-2026-63802","CVE-2026-63806","CVE-2026-63807","CVE-2026-63824","CVE-2026-63826","CVE-2026-63829","CVE-2026-63884","CVE-2026-63893","CVE-2026-63912","CVE-2026-63917","CVE-2026-63919","CVE-2026-63921","CVE-2026-63922","CVE-2026-63924","CVE-2026-63946","CVE-2026-63952","CVE-2026-63968","CVE-2026-63971","CVE-2026-63975","CVE-2026-63984","CVE-2026-63994","CVE-2026-64106","CVE-2026-64189","CVE-2026-64530","CVE-2026-64560","CVE-2026-64561","CVE-2026-64564","CVE-2026-64600"],"payload":{"kind":"advisory","title":"Security update for the Linux Kernel","summary":"The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435). - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656). - CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995). - CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181). - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289). - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188). - CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633). - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773). - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997). - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988). - CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808). - CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000). - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577). - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230). - CVE-2026-53375: drm/amdgpu/vce: ","evidence":"osv:SUSE-SU-2026:3602-1","products":[{"name":{"value":"kernel-default","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-livepatch-SLE15-SP6_Update_30","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1-150600.13.5.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-64kb","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1.150600.12.60.3","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-zfcpdump","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1.150600.12.60.3","evidence":"/affected/12/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/13/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/13/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/14/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/14/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/15/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/15/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/16/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/16/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:3602-1","aliases":["SUSE-SU-2026:3602-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.130.1","kernel-default-livepatch-devel":"6.4.0-150600.23.130.1","kernel-livepatch-6_4_0-150600_23_130-default":"1-150600.13.5.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.5.1"}]}],"package":{"name":"kernel-livepatch-SLE15-SP6_Update_30","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_30&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.130.1","kernel-default-livepatch-devel":"6.4.0-150600.23.130.1","kernel-livepatch-6_4_0-150600_23_130-default":"1-150600.13.5.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-64kb","purl":"pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1.150600.12.60.3"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-zfcpdump","purl":"pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1.150600.12.60.3"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}}],"modified":"2026-10-02T18:42:47.946147883Z","provider":"osv","upstream":["CVE-2026-31482","CVE-2026-31483","CVE-2026-31542","CVE-2026-31598","CVE-2026-31628","CVE-2026-43033","CVE-2026-43046","CVE-2026-43056","CVE-2026-43276","CVE-2026-43440","CVE-2026-43475","CVE-2026-45904","CVE-2026-46056","CVE-2026-46080","CVE-2026-46084","CVE-2026-46109","CVE-2026-46117","CVE-2026-46126","CVE-2026-46144","CVE-2026-46145","CVE-2026-46174","CVE-2026-46193","CVE-2026-46243","CVE-2026-46323","CVE-2026-46324","CVE-2026-46333","CVE-2026-52967","CVE-2026-52986","CVE-2026-53050","CVE-2026-53129","CVE-2026-53131","CVE-2026-53177","CVE-2026-53224","CVE-2026-53246","CVE-2026-53250","CVE-2026-53262","CVE-2026-53267","CVE-2026-53297","CVE-2026-53324","CVE-2026-53354","CVE-2026-53375","CVE-2026-53388","CVE-2026-53391","CVE-2026-53402","CVE-2026-63794","CVE-2026-63802","CVE-2026-63806","CVE-2026-63807","CVE-2026-63824","CVE-2026-63826","CVE-2026-63829","CVE-2026-63884","CVE-2026-63893","CVE-2026-63912","CVE-2026-63917","CVE-2026-63919","CVE-2026-63921","CVE-2026-63922","CVE-2026-63924","CVE-2026-63946","CVE-2026-63952","CVE-2026-63968","CVE-2026-63971","CVE-2026-63975","CVE-2026-63984","CVE-2026-63994","CVE-2026-64106","CVE-2026-64189","CVE-2026-64530","CVE-2026-64560","CVE-2026-64561","CVE-2026-64564","CVE-2026-64600"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20263602-1/","https://bugzilla.suse.com/1185845","https://bugzilla.suse.com/1253262","https://bugzilla.suse.com/1258718","https://bugzilla.suse.com/1260347","https://bugzilla.suse.com/1262745","https://bugzilla.suse.com/1262771","https://bugzilla.suse.com/1263010","https://bugzilla.suse.com/1263068","https://bugzilla.suse.com/1263718","https://bugzilla.suse.com/1263788","https://bugzilla.suse.com/1264053","https://bugzilla.suse.com/1264089","https://bugzilla.suse.com/1264090","https://bugzilla.suse.com/1264558","https://bugzilla.suse.com/1264779","https://bugzilla.suse.com/1264795","https://bugzilla.suse.com/1265308","https://bugzilla.suse.com/1266238","https://bugzilla.suse.com/1266758","https://bugzilla.suse.com/1266850","https://bugzilla.suse.com/1266890","https://bugzilla.suse.com/1266913","https://bugzilla.suse.com/1267375","https://bugzilla.suse.com/1267384","https://bugzilla.suse.com/1267435","https://bugzilla.suse.com/1267584","https://bugzilla.suse.com/1267596","https://bugzilla.suse.com/1267656","https://bugzilla.suse.com/1267682","https://bugzilla.suse.com/1267715","https://bugzilla.suse.com/1267995","https://bugzilla.suse.com/1268029","https://bugzilla.suse.com/1268307","https://bugzilla.suse.com/1269181","https://bugzilla.suse.com/1269188","https://bugzilla.suse.com/1269289","https://bugzilla.suse.com/1269383","https://bugzilla.suse.com/1269512","https://bugzilla.suse.com/1269513","https://bugzilla.suse.com/1269577","https://bugzilla.suse.com/1269633","https://bugzilla.suse.com/1269773","https://bugzilla.suse.com/1269808","https://bugzilla.suse.com/1269981","https://bugzilla.suse.com/1269988","https://bugzilla.suse.com/1269997","https://bugzilla.suse.com/1270000","https://bugzilla.suse.com/1270230","https://bugzilla.suse.com/1271349","https://bugzilla.suse.com/1271368","https://bugzilla.suse.com/1271526","https://bugzilla.suse.com/1271825","https://bugzilla.suse.com/1271866","https://bugzilla.suse.com/1271899","https://bugzilla.suse.com/1271904","https://bugzilla.suse.com/1271908","https://bugzilla.suse.com/1271912","https://bugzilla.suse.com/1271964","https://bugzilla.suse.com/1272176","https://bugzilla.suse.com/1272180","https://bugzilla.suse.com/1272183","https://bugzilla.suse.com/1272207","https://bugzilla.suse.com/1272242","https://bugzilla.suse.com/1272263","https://bugzilla.suse.com/1272268","https://bugzilla.suse.com/1272282","https://bugzilla.suse.com/1272466","https://bugzilla.suse.com/1272468","https://bugzilla.suse.com/1272573","https://bugzilla.suse.com/1272607","https://bugzilla.suse.com/1272665","https://bugzilla.suse.com/1272678","https://bugzilla.suse.com/1272693","https://bugzilla.suse.com/1272694","https://bugzilla.suse.com/1272836","https://bugzilla.suse.com/1272855","https://bugzilla.suse.com/1272865","https://bugzilla.suse.com/1272904","https://bugzilla.suse.com/1272907","https://bugzilla.suse.com/1272918","https://bugzilla.suse.com/1273004","https://bugzilla.suse.com/1273035","https://bugzilla.suse.com/1273231","https://bugzilla.suse.com/1274072","https://www.suse.com/security/cve/CVE-2026-31482","https://www.suse.com/security/cve/CVE-2026-31483","https://www.suse.com/security/cve/CVE-2026-31542","https://www.suse.com/security/cve/CVE-2026-31598","https://www.suse.com/security/cve/CVE-2026-31628","https://www.suse.com/security/cve/CVE-2026-43033","https://www.suse.com/security/cve/CVE-2026-43046","https://www.suse.com/security/cve/CVE-2026-43056","https://www.suse.com/security/cve/CVE-2026-43276","https://www.suse.com/security/cve/CVE-2026-43440","https://www.suse.com/security/cve/CVE-2026-43475","https://www.suse.com/security/cve/CVE-2026-45904","https://www.suse.com/security/cve/CVE-2026-46056","https://www.suse.com/security/cve/CVE-2026-46080","https://www.suse.com/security/cve/CVE-2026-46084","https://www.suse.com/security/cve/CVE-2026-46109","https://www.suse.com/security/cve/CVE-2026-46117","https://www.suse.com/security/cve/CVE-2026-46126","https://www.suse.com/security/cve/CVE-2026-46144","https://www.suse.com/security/cve/CVE-2026-46145","https://www.suse.com/security/cve/CVE-2026-46174","https://www.suse.com/security/cve/CVE-2026-46193","https://www.suse.com/security/cve/CVE-2026-46243","https://www.suse.com/security/cve/CVE-2026-46323","https://www.suse.com/security/cve/CVE-2026-46324","https://www.suse.com/security/cve/CVE-2026-46333","https://www.suse.com/security/cve/CVE-2026-52967","https://www.suse.com/security/cve/CVE-2026-52986","https://www.suse.com/security/cve/CVE-2026-53050","https://www.suse.com/security/cve/CVE-2026-53129","https://www.suse.com/security/cve/CVE-2026-53131","https://www.suse.com/security/cve/CVE-2026-53177","https://www.suse.com/security/cve/CVE-2026-53224","https://www.suse.com/security/cve/CVE-2026-53246","https://www.suse.com/security/cve/CVE-2026-53250","https://www.suse.com/security/cve/CVE-2026-53262","https://www.suse.com/security/cve/CVE-2026-53267","https://www.suse.com/security/cve/CVE-2026-53297","https://www.suse.com/security/cve/CVE-2026-53324","https://www.suse.com/security/cve/CVE-2026-53354","https://www.suse.com/security/cve/CVE-2026-53375","https://www.suse.com/security/cve/CVE-2026-53388","https://www.suse.com/security/cve/CVE-2026-53391","https://www.suse.com/security/cve/CVE-2026-53402","https://www.suse.com/security/cve/CVE-2026-63794","https://www.suse.com/security/cve/CVE-2026-63802","https://www.suse.com/security/cve/CVE-2026-63806","https://www.suse.com/security/cve/CVE-2026-63807","https://www.suse.com/security/cve/CVE-2026-63824","https://www.suse.com/security/cve/CVE-2026-63826","https://www.suse.com/security/cve/CVE-2026-63829","https://www.suse.com/security/cve/CVE-2026-63884","https://www.suse.com/security/cve/CVE-2026-63893","https://www.suse.com/security/cve/CVE-2026-63912","https://www.suse.com/security/cve/CVE-2026-63917","https://www.suse.com/security/cve/CVE-2026-63919","https://www.suse.com/security/cve/CVE-2026-63921","https://www.suse.com/security/cve/CVE-2026-63922","https://www.suse.com/security/cve/CVE-2026-63924","https://www.suse.com/security/cve/CVE-2026-63946","https://www.suse.com/security/cve/CVE-2026-63952","https://www.suse.com/security/cve/CVE-2026-63968","https://www.suse.com/security/cve/CVE-2026-63971","https://www.suse.com/security/cve/CVE-2026-63975","https://www.suse.com/security/cve/CVE-2026-63984","https://www.suse.com/security/cve/CVE-2026-63994","https://www.suse.com/security/cve/CVE-2026-64106","https://www.suse.com/security/cve/CVE-2026-64189","https://www.suse.com/security/cve/CVE-2026-64530","https://www.suse.com/security/cve/CVE-2026-64560","https://www.suse.com/security/cve/CVE-2026-64561","https://www.suse.com/security/cve/CVE-2026-64564","https://www.suse.com/security/cve/CVE-2026-64600"]},"related_cves":[{"value":"CVE-2026-31482","evidence":"/upstream"},{"value":"CVE-2026-31483","evidence":"/upstream"},{"value":"CVE-2026-31542","evidence":"/upstream"},{"value":"CVE-2026-31598","evidence":"/upstream"},{"value":"CVE-2026-31628","evidence":"/upstream"},{"value":"CVE-2026-43033","evidence":"/upstream"},{"value":"CVE-2026-43046","evidence":"/upstream"},{"value":"CVE-2026-43056","evidence":"/upstream"},{"value":"CVE-2026-43276","evidence":"/upstream"},{"value":"CVE-2026-43440","evidence":"/upstream"},{"value":"CVE-2026-43475","evidence":"/upstream"},{"value":"CVE-2026-45904","evidence":"/upstream"},{"value":"CVE-2026-46056","evidence":"/upstream"},{"value":"CVE-2026-46080","evidence":"/upstream"},{"value":"CVE-2026-46084","evidence":"/upstream"},{"value":"CVE-2026-46109","evidence":"/upstream"},{"value":"CVE-2026-46117","evidence":"/upstream"},{"value":"CVE-2026-46126","evidence":"/upstream"},{"value":"CVE-2026-46144","evidence":"/upstream"},{"value":"CVE-2026-46145","evidence":"/upstream"},{"value":"CVE-2026-46174","evidence":"/upstream"},{"value":"CVE-2026-46193","evidence":"/upstream"},{"value":"CVE-2026-46243","evidence":"/upstream"},{"value":"CVE-2026-46323","evidence":"/upstream"},{"value":"CVE-2026-46324","evidence":"/upstream"},{"value":"CVE-2026-46333","evidence":"/upstream"},{"value":"CVE-2026-52967","evidence":"/upstream"},{"value":"CVE-2026-52986","evidence":"/upstream"},{"value":"CVE-2026-53050","evidence":"/upstream"},{"value":"CVE-2026-53129","evidence":"/upstream"},{"value":"CVE-2026-53131","evidence":"/upstream"},{"value":"CVE-2026-53177","evidence":"/upstream"},{"value":"CVE-2026-53224","evidence":"/upstream"},{"value":"CVE-2026-53246","evidence":"/upstream"},{"value":"CVE-2026-53250","evidence":"/upstream"},{"value":"CVE-2026-53262","evidence":"/upstream"},{"value":"CVE-2026-53267","evidence":"/upstream"},{"value":"CVE-2026-53297","evidence":"/upstream"},{"value":"CVE-2026-53324","evidence":"/upstream"},{"value":"CVE-2026-53354","evidence":"/upstream"},{"value":"CVE-2026-53375","evidence":"/upstream"},{"value":"CVE-2026-53388","evidence":"/upstream"},{"value":"CVE-2026-53391","evidence":"/upstream"},{"value":"CVE-2026-53402","evidence":"/upstream"},{"value":"CVE-2026-63794","evidence":"/upstream"},{"value":"CVE-2026-63802","evidence":"/upstream"},{"value":"CVE-2026-63806","evidence":"/upstream"},{"value":"CVE-2026-63807","evidence":"/upstream"},{"value":"CVE-2026-63824","evidence":"/upstream"},{"value":"CVE-2026-63826","evidence":"/upstream"},{"value":"CVE-2026-63829","evidence":"/upstream"},{"value":"CVE-2026-63884","evidence":"/upstream"},{"value":"CVE-2026-63893","evidence":"/upstream"},{"value":"CVE-2026-63912","evidence":"/upstream"},{"value":"CVE-2026-63917","evidence":"/upstream"},{"value":"CVE-2026-63919","evidence":"/upstream"},{"value":"CVE-2026-63921","evidence":"/upstream"},{"value":"CVE-2026-63922","evidence":"/upstream"},{"value":"CVE-2026-63924","evidence":"/upstream"},{"value":"CVE-2026-63946","evidence":"/upstream"},{"value":"CVE-2026-63952","evidence":"/upstream"},{"value":"CVE-2026-63968","evidence":"/upstream"},{"value":"CVE-2026-63971","evidence":"/upstream"},{"value":"CVE-2026-63975","evidence":"/upstream"},{"value":"CVE-2026-63984","evidence":"/upstream"},{"value":"CVE-2026-63994","evidence":"/upstream"},{"value":"CVE-2026-64106","evidence":"/upstream"},{"value":"CVE-2026-64189","evidence":"/upstream"},{"value":"CVE-2026-64530","evidence":"/upstream"},{"value":"CVE-2026-64560","evidence":"/upstream"},{"value":"CVE-2026-64561","evidence":"/upstream"},{"value":"CVE-2026-64564","evidence":"/upstream"},{"value":"CVE-2026-64600","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:130b8b86-0b9f-4b76-b8c0-96bf6997a30c","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-31598","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Although the core bug is in ocfs2 filesystem code, ocfs2 is exportable and nfsd can issue direct writes with IOCB_DIRECT while remote REMOVE operations reach vfs_unlink, making the vulnerable lock chains reachable over the network on a writable exported ocfs2 volume.\nAC:L - The bug is an ABBA deadlock where the attacker can drive both sides with concurrent extending direct writes and unlink/remove operations. Once the target deployment exposes those operations, winning the race is attacker-controlled.\nPR:N - A remote NFS client can trigger the operations through an exported writable share without kernel capabilities on the target. In permissive or anonymous export scenarios, no prior authenticated privileges are required.\nUI:N - No victim user action is required after the vulnerable service/filesystem is available. The attacker can send the write and remove operations directly.\nS:U - The impact remains within the same kernel/filesystem security authority. There is no VM escape, sandbox boundary crossing, or separate security scope.\nC:N - The issue is a lock-ordering deadlock, not memory corruption or information disclosure. It does not provide a read primitive or leak data.\nI:N - The vulnerable behavior does not corrupt memory or allow unauthorized data modification. It only causes threads to block on locks.\nA:H - The deadlock can permanently hang ocfs2 operations and affected kernel worker/syscall contexts. A kernel/filesystem hang is a high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31598","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43033","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable out-of-place AEAD decrypt path is reachable by a local process through AF_ALG sockets using authencesn, while normal inbound ESP uses in-place src==dst. This requires local syscall access rather than remote packets directly reaching the bad branch.\nAC:L - The attacker controls the AF_ALG request buffers, associated-data length, operation type, key, and authsize, and no race or hard-to-influence state is required. The fault occurs before ICV verification, so a valid packet/tag is not needed.\nPR:L - AF_ALG socket creation, bind, key setup, and AEAD decrypt do not require CAP_NET_ADMIN or CAP_SYS_ADMIN, but the attacker needs local unprivileged code execution. XFRM state management is privileged, but the lower-privilege AF_ALG path reaches the bug.\nUI:N - No victim action is required once the local attacker runs the AF_ALG syscall sequence. The attacker supplies both input and output buffers directly.\nS:U - The vulnerability is in kernel crypto processing and impacts the same kernel security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:H - The bug is a kernel memory-corruption condition from writing ESN high sequence bytes past the intended out-of-place destination; successful exploitation of such corruption could expose arbitrary kernel memory. Under the required uncertainty rule, this is scored as high confidentiality impact.\nI:H - The vulnerable code performs an attacker-influenced out-of-bounds write of four bytes before authentication succeeds. Kernel out-of-bounds writes are scored as high integrity impact because they can plausibly be shaped into control-flow or data corruption.\nA:H - At minimum, the AF_ALG path can drive scatterwalk past the end of the destination scatterlist and crash the kernel. A local attacker can repeat the trigger without authentication, causing high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43033","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43056","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable `add_adev()` error path is reached during MANA PCI driver probe/resume/recovery or auxiliary RDMA service handling, not by processing received network packets. The highest defensible attacker path is local influence over driver/device lifecycle or resource-failure conditions.\nAC:L - Once `auxiliary_device_add()` fails, the UAF is deterministic because `auxiliary_device_uninit()` releases the embedded object and the cleanup path immediately reads `adev->id`. No attacker-uncontrolled race is required beyond reaching that failure path.\nPR:L - The path is not exposed to unauthenticated remote peers, but a local attacker can plausibly influence resource exhaustion/failure conditions around driver lifecycle events. Direct sysfs/module lifecycle control is privileged, but Low is the higher-severity defensible choice under the conservative scoring rule.\nUI:N - No separate victim action is required once the attacker can exercise or influence the local driver lifecycle/failure path. Probe, resume, and service-event handling run in kernel context.\nS:U - The affected component and impacts are within the Linux kernel security scope. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel use-after-free of an auxiliary-device container object after its release callback frees it. Under conservative kernel UAF scoring, freed slab reuse can support information disclosure, so confidentiality is High.\nI:H - The UAF lets stale object contents influence cleanup through `mana_adev_idx_free()`, and kernel UAFs are conservatively treated as potentially exploitable memory corruption. Integrity is therefore High.\nA:H - At minimum, the stale access can trigger a kernel UAF report, invalid IDA cleanup, oops, or panic during probe/resume error unwinding. Availability impact is High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43056","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46056","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handlers process HCI Secure Simple Pairing events (User Passkey Notify / Keypress Notify) driven by a remote Bluetooth peer during SSP pairing, so the attacker must be within Bluetooth radio range (adjacent), matching kernel guidance that Bluetooth = Adjacent.\nAC:L - This is a use-after-free where a remote peer drives the passkey/keypress events while connection teardown frees the conn from a concurrent context; the attacker influences both sides of the race and can retry, and UAF bugs are scored AC:L unless the race is uncontrollable.\nPR:N - The code path is reached by a remote Bluetooth device participating in the SSP pairing handshake, requiring no credentials or privileges on the target system.\nUI:N - The handlers execute automatically when the controller forwards the SSP passkey/keypress HCI events during the pairing protocol exchange; no local user action is required to reach the vulnerable code.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The use-after-free reads fields (dst, type, dst_type, passkey) from a freed and potentially reallocated hci_conn object, which can disclose attacker-controlled or sensitive kernel heap contents.\nI:H - The handlers write to the freed object (passkey_notify and passkey_entered fields), giving a UAF write into reallocated heap memory that can be leveraged for heap grooming and control-flow corruption.\nA:H - A use-after-free on the hci_conn structure readily causes kernel oops/panic, yielding high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46056","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46117","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through the RDMA userspace verbs interface (/dev/infiniband/uverbs<N>) by issuing a create-QP command locally; it is not exposed to network peers.\nAC:L - The condition is created entirely by the attacker (building an RWQ indirection table whose WQs share one CQ) and is deterministically triggered on the second loop iteration; there is no race or uncontrolled state.\nPR:L - Triggering only requires an unprivileged local process with access to the RDMA verbs device — the normal configuration on RDMA-enabled hosts — and no CAP_* check exists on the create-QP path.\nUI:N - The attacker performs all steps via its own verbs calls; no action by another user is required.\nS:U - The corruption stays within the kernel's own memory/security authority and does not cross a VM/IOMMU/sandbox boundary.\nC:H - The overwrite leaks/dangles objects in cq_table[], and a use-after-free on these IRQ-dispatched structures can be leveraged to read kernel memory contents.\nI:H - The driver \"goes on to corrupt the kernel,\" leaving dangling function-pointer/context entries in a table called from interrupt context, providing a write/control-flow corruption primitive.\nA:H - The user-triggerable WARN_ON panics the system when panic_on_warn is set, and the subsequent kernel state corruption causes oopses/crashes regardless."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46117","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46145","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only by issuing RDMA verbs to the local /dev/infiniband/uverbs* character device; `rx_hash_key_len` arrives via `ib_copy_from_udata` from a local process, with no remote network path.\nAC:L - The attacker directly controls `rx_hash_key_len` in the uAPI struct and can set it arbitrarily large to trigger the overflow on every call; there is no race or condition outside the attacker's control.\nPR:L - Reaching the raw-packet QP path requires CAP_NET_RAW, but that is a narrow, non-root capability (not the \"real root/admin\" bar for High) and is routinely granted to unprivileged networking/RDMA applications such as DPDK workloads.\nUI:N - The overflow is triggered entirely by the attacker's own QP-creation request; no action by any other user is required.\nS:U - The corruption is of the kernel's own heap allocation within the same kernel security authority; no crossing into a separate scope (VM/IOMMU) occurs.\nC:H - The memcpy over-reads the 40-byte stack source by an unbounded amount and the heap overflow can be leveraged to disclose adjacent kernel memory, so confidentiality impact is High.\nI:H - An attacker-controlled-length memcpy writes past a 40-byte heap field, giving a heap out-of-bounds write that corrupts adjacent kernel objects and is exploitable toward arbitrary write/control-flow hijack.\nA:H - A large `rx_hash_key_len` corrupts the kernel heap and/or faults reading unmapped stack/heap pages, reliably causing a kernel panic/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46145","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46174","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in the CPU's op cache and requires executing instructions on the affected core to drive improper resource sharing; it is not reachable over a network. Triggering it needs local code execution on the machine.\nAC:L - An attacker who can co-schedule code on SMT siblings of an affected Zen2 core controls both sides of the shared op-cache contention and can reliably drive the improper-isolation condition. Following the higher-severity rule, this is Low.\nPR:L - Triggering the op-cache resource sharing only requires the ability to run code (an unprivileged local user or a guest VM tenant); no root or admin capability is needed. It does, however, require at least some local execution access, so not None.\nUI:N - The attacker's own executing code populates and contends for the op cache; no victim action is required.\nS:C - The bug is an isolation failure of a microarchitectural resource shared across SMT threads, so instruction corruption can cross from the attacker's context into a different security authority (another VM/tenant or the host kernel), impacting resources beyond the attacking component's scope.\nC:H - Improper isolation of a shared op-cache resource is an information-disclosure vector across contexts, and the resulting instruction corruption can be leveraged to read memory belonging to another security domain.\nI:H - The defining impact is \"instruction corruption\" — the CPU executes corrupted/wrong instructions in a victim context, which is a direct, severe integrity violation enabling control-flow and data corruption across the isolation boundary.\nA:H - Instruction corruption causes incorrect execution, crashes, and hangs in the affected (potentially cross-context) code, resulting in high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46174","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46243","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local `request_key(2)` or `add_key(2)` from an unprivileged process; the flaw is missing origin validation in the keyring path, not remote SMB/CIFS protocol input.\nAC:L - On typical affected systems (CIFS module with upcall, cifs-utils request-key rule, unprivileged user/mount namespaces), the attacker fully controls the forged description, target pid, and namespace layout for a reliable root upcall chain.\nPR:L - Any local unprivileged user account can invoke the key syscalls; user/mount namespaces are part of the standard exploit setup and map to basic local user capability, not root-only access.\nUI:N - No victim action such as mounting a Kerberos CIFS share is required; the attacker forges the key request directly without depending on another user’s mount or session.\nS:U - Successful exploitation elevates privileges within the same host/kernel security domain (local root) and does not cross a VM/hypervisor or hardware isolation boundary by itself.\nC:H - The attack chain yields root-equivalent access in the root upcall helper, enabling arbitrary read of host data (full confidentiality compromise of the system).\nI:H - Malicious NSS modules run as root inside `cifs.upcall`, giving arbitrary code execution and full integrity compromise of the host, not merely limited data modification.\nA:N - The kernel bug is a trust-boundary failure without memory corruption or guaranteed kernel panic; primary impact is privilege escalation rather than kernel crash or sustained denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46243","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46323","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local attacker to inject zerocopy/managed-frags skbs via io_uring SEND_ZC, TUN/TAP, or similar local APIs; ordinary remote wire packets processed by GRO do not carry SKBFL_MANAGED_FRAG_REFS, so a network-only attacker cannot reach the buggy merge path.\nAC:L - The attacker fully controls both sides of the GRO merge (seed and zerocopy TCP segments over a veth pair), timing (netem delay, RST race), and buffer setup; a public working LPE exploit exists, so success does not depend on conditions outside attacker control.\nPR:L - Triggering requires only a basic unprivileged local account with io_uring and user-namespace access (unshare -Urn), which is the default on many distributions; no init-namespace root or CAP_NET_ADMIN is needed.\nUI:N - No victim user action is required; the attacker drives the entire exploit autonomously through syscalls and local network namespace setup.\nS:U - Impact is standard host-kernel privilege escalation (root on the same kernel); it does not cross a distinct hypervisor/IOMMU security boundary such as VM-guest-to-host escape.\nC:H - The flaw is a use-after-free on page structures; the known exploit leverages the refcount underflow to obtain stale read access to freed physical pages and extract kernel PTE contents, enabling arbitrary memory disclosure primitives.\nI:H - UAF page refcount corruption enables crafting writable PTE entries against read-only page-cache pages; the public exploit demonstrates integrity compromise by rewriting /etc/passwd and obtaining root via su.\nA:H - Use-after-free of page structures can cause kernel oops/panic during skb teardown; even failed exploitation attempts can crash the system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46323","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46324","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in nf_tables netdev hook teardown reached only via Netfilter netlink (nft) syscalls—chain/flowtable updates, dumps, netns teardown, and netlink socket release—not from remote packet handling alone. Per kernel guidance, nftables/netfilter is Local (L).\nAC:L - Exploitation is a race between hook-list removal (`list_del()` + RCU free) and concurrent RCU walkers (`nft_dump_basechain_hook_list`, flowtable dump, or packet-path `list_for_each_entry_rcu`). An attacker with CAP_NET_ADMIN can drive both sides concurrently (e.g., one thread dumping chains/flowtables while another deletes hooks or tears down the netns).\nPR:L - All nf_tables netlink operations are gated by `netlink_net_capable(skb, CAP_NET_ADMIN)` in `nfnetlink_rcv()`. CAP_NET_ADMIN is obtainable by an unprivileged user via user+network namespaces (`unshare -Urn`), not real init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers hook teardown and concurrent dumps or traffic entirely through their own netlink sockets and namespace lifecycle.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries.\nC:H - Using `list_del()` instead of `list_del_rcu()` on lists walked under `rcu_read_lock()` is a use-after-free/list-corruption bug; concurrent dumpers dereference `nft_hook` fields (e.g., `ifname`) after unlink/free, enabling arbitrary kernel memory read via heap grooming.\nI:H - The freed `nft_hook` kmalloc object can be reallocated and corrupted through the dangling RCU list pointers, providing a standard kernel UAF primitive exploitable for arbitrary write and control-flow hijacking.\nA:H - The race reliably causes kernel list corruption and use-after-free, leading to oops/panic during hook dumps, flowtable lookups, or netns cleanup; UAF in this path has inherent high availability impact even when not fully weaponized."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46324","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46333","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable authorization check is reached through local interfaces such as ptrace-style checks, procfs, and pidfd_getfd; it is not reachable from network packets or adjacent/physical input.\nAC:L - A local attacker can repeatedly trigger the relevant check and, for exiting tasks, can race pidfd_getfd/procfs access against a target's exit path after exit_mm() but before exit_files(). The race is attacker-driven and does not require unusual kernel configuration or conditions outside the attacker's influence.\nPR:L - An unprivileged local user can target same-UID nondumpable tasks because the vulnerable code skips the dumpability requirement once task->mm is NULL. User-namespace root does not help against init-namespace root kernel threads, but low local privileges are enough for the same-UID exiting-task case.\nUI:N - Exploitation does not require a victim user to open a file or perform an interactive action; the attacker can use local syscalls/procfs against an existing or attacker-terminated target task.\nS:U - The bug bypasses Linux kernel task-access authorization within the same OS security authority. It does not cross a VM, IOMMU, or hypervisor boundary.\nC:H - The bypass can allow access to sensitive task details and, most importantly, pidfd_getfd can duplicate file descriptors from a nondumpable task during the exit window. In a plausible helper/sandbox scenario, those descriptors can expose highly sensitive files or privileged resources.\nI:H - If the duplicated descriptor is writable, the attacker can modify the protected resource reachable through the victim's file descriptor despite the dumpability restriction. This is a high-impact integrity bypass even though the bug is not memory corruption.\nA:N - The issue is an access-control bypass around ptrace/dumpability checks and does not by itself provide a kernel crash, hang, deadlock, or sustained denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46333","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52967","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable SMB client parser consumes an SMB2 CREATE error response supplied by a remote SMB server over the network. A malicious or compromised SMB share can send the crafted `STATUS_STOPPED_ON_SYMLINK` response.\nAC:L - The server directly controls `ErrorContextCount`, `ByteCount`, `ErrorId`, and `ErrorDataLength`, and no race or hard-to-hit state is required. Although the wraparound behavior is 32-bit specific, that is a deployment property rather than an attacker-uncontrolled exploitation condition.\nPR:N - The attacker needs no privileges on the victim system; they only need to operate or control the SMB server endpoint that the client connects to. The path can also be reached through guest or null-auth SMB sessions.\nUI:R - The victim client must mount/connect to the SMB share and perform a path operation such as lookup, stat, open, or create that causes an SMB2 CREATE response to be parsed. The remote server cannot trigger this parser without client-side filesystem activity.\nS:U - The affected component is the Linux kernel SMB client, and the impact is to the same kernel/client security authority. This is not a VM escape, IOMMU bypass, or cross-scope sandbox escape.\nC:H - The bug is an out-of-bounds kernel read in a server-controlled response parser, and the read is not strictly bounded to only a few harmless bytes. Following the required conservative rule, this is scored as high confidentiality impact.\nI:N - The defect advances a parser pointer incorrectly and reads from the wrong location, but it does not write out of bounds or provide a kernel memory write primitive. No direct integrity impact beyond normal malicious-server control of SMB content was identified.\nA:H - The crafted length can make the parser loop indefinitely on 32-bit systems, causing a reliable denial of service. Other malformed pointer positions can also lead to invalid kernel reads and possible oops conditions."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52967","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52986","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable SIP conntrack helper parses SIP payload carried in TCP/UDP network packets once the SIP helper is enabled, which is a reasonable deployment for NAT/firewall SIP gateways. A remote SIP peer can send crafted packets to that packet-processing path.\nAC:L - The trigger is a malformed numeric SIP field or URI port at the parser buffer boundary; no race or victim-controlled timing is required. Helper/NAT configuration is an environmental prerequisite, not an attacker-controlled complexity condition.\nPR:N - In the network gateway scenario, the attacker only needs to send unauthenticated SIP traffic through a system using the SIP conntrack helper. No local account or kernel privilege is required.\nUI:N - Exploitation is driven by packet processing in netfilter/conntrack. No user action is needed after the affected helper is configured.\nS:U - The impact is within the kernel/network stack security authority of the vulnerable system. It does not cross a separate scope such as guest-to-host or IOMMU isolation.\nC:H - The bug is an unbounded out-of-bounds read from non-NUL-terminated skb data via simple_strtoul and missing limit checks. Following the required guidance, an unbounded OOB read is high confidentiality impact.\nI:H - In NATed SIP paths, an out-of-bounds parser end pointer can feed attacker-influenced match lengths into NAT packet mangling, whose memmove/memcpy path lacks a bounds check against the skb payload. That creates a defensible kernel memory-corruption/code-execution risk.\nA:H - The same OOB read and possible invalid NAT mangle lengths can cause kernel faults, skb corruption, or panic. Crafted packets can be sent repeatedly, so availability impact is high."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52986","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53050","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local filesystem quota activity on a mounted OCFS2 filesystem, via ordinary dquot lifetime changes racing with the OCFS2 quota sync worker. It is not reachable by remote packets or adjacent/physical input.\nAC:L - This is a race, but a local attacker can repeatedly churn dquot references with filesystem operations while the periodic scanner runs. When uncertain, the higher-severity AC:L is appropriate.\nPR:L - After OCFS2 quotas are enabled, an unprivileged local user with write access to the filesystem can trigger dquot allocation and release paths. Mounting/configuring quotas is an environmental prerequisite, not a privilege needed for each exploit attempt.\nUI:N - No victim interaction is required once the affected filesystem is mounted and quotas are active. The attacker can trigger the relevant filesystem operations directly.\nS:U - The impact remains within the kernel and the same host security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The bug can lead to use-after-free of a dquot object under memory pressure. Kernel UAF conditions can be leveraged for memory disclosure, so confidentiality impact is High.\nI:H - The stale dquot/list state creates kernel heap use-after-free/list corruption, which can plausibly be shaped into write primitives or code execution. Integrity impact is therefore High.\nA:H - The race already produces kernel WARN/oops-style failure conditions and can dereference freed kernel objects. This can crash or destabilize the kernel, so availability impact is High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53050","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53131","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.4,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable netfilter match, ipset, and logging paths run while processing packets in receive/netdev hooks. In a reasonable firewall, router, VPN, or tunnel deployment with these rules installed, unauthenticated remote packets can reach the vulnerable code.\nAC:L - No race or difficult timing is required; a packet reaching a vulnerable rule with an invalid, unset, non-Ethernet, or too-short MAC header deterministically drives the bad eth_hdr(skb) access. The needed rule/interface setup is a plausible deployment condition, not an exploit race.\nPR:N - The remote packet sender does not need credentials or local privileges once the affected rule or logger is configured. Although rule installation requires CAP_NET_ADMIN, that is not required for the runtime remote-trigger scenario.\nUI:N - Exploitation is triggered by packet processing and does not require a victim user to open a file, mount anything, or perform another action.\nS:U - The impact remains within the kernel/network stack security authority. There is no VM, IOMMU, or separate sandbox boundary crossing.\nC:H - The flaw causes invalid or out-of-bounds reads from the skb MAC header, and those bytes can be copied into logs/ipset state or influence observable match behavior. Per the required guidance, out-of-bounds reads are scored High when not proven strictly harmless.\nI:L - The primitive is a read rather than an arbitrary write or control-flow hijack. However, the wrongly read MAC bytes can influence firewall matches and ipset add/delete/test behavior, giving limited integrity impact.\nA:H - Invalid eth_hdr(skb) access can produce slab out-of-bounds/KASAN reports or kernel oops/panic conditions, and packets can be sent repeatedly. Kernel crashes are High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53224","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - An unauthenticated remote SCTP peer can reach the vulnerable COOKIE_ECHO processing path by sending SCTP packets to a listening SCTP endpoint. In deployments with cookie HMAC disabled, the attacker can obtain and modify the state cookie over the network.\nAC:L - The bug is triggered with a malformed COOKIE_ECHO and attacker-controlled embedded INIT/address-list lengths; no race or hard-to-control timing condition is required. The no-cookie-auth deployment condition is a reasonable supported SCTP configuration.\nPR:N - No credentials or local privileges are needed to send SCTP INIT/COOKIE_ECHO traffic to a listening service. The vulnerable parsing occurs before any application authentication.\nUI:N - Exploitation only requires sending network packets to the target SCTP endpoint. No victim user action is required.\nS:U - The impact is within the kernel/network stack security authority of the target system. It does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The malformed lengths can drive out-of-bounds kernel reads beyond the COOKIE_ECHO payload, including attacker-controlled oversized address-list parsing. Because the read is not strictly bounded to a few bytes and related SCTP COOKIE_ECHO bugs demonstrate kernel memory leakage potential, confidentiality impact is High.\nI:N - The investigated fix addresses out-of-bounds reads and missing length validation, not an out-of-bounds write or direct arbitrary memory modification primitive. I did not find a defensible direct integrity impact from this bug alone.\nA:H - The attacker-controlled out-of-bounds reads can walk beyond the skb/cookie buffer and fault or trigger KASAN/oops conditions. A remotely triggerable kernel crash is High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53224","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53246","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable COOKIE_ECHO processing is reached by remote SCTP packets delivered through the IPv4/IPv6 SCTP protocol handlers to a listening SCTP endpoint.\nAC:L - In a deployment with SCTP cookie HMAC disabled, the attacker can obtain a cookie through the normal INIT/INIT_ACK exchange, modify the cached INIT length, and send the forged COOKIE_ECHO without races or conditions outside attacker control.\nPR:N - The path is pre-authentication network protocol handling for a listening SCTP server; no local account or SCTP authentication is required when cookie HMAC is disabled.\nUI:N - Exploitation only requires sending SCTP handshake packets to the target listener and does not require victim user action.\nS:U - The impact is within the Linux kernel/network stack security authority and does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The inflated cached INIT length drives out-of-bounds parameter walking and attacker-sized kmemdup() reads beyond the received skb, which can expose kernel memory.\nI:H - The bug is kernel memory-safety corruption during nested parameter handling, and the higher-severity choice is appropriate because attacker-controlled parsing and copies beyond the valid buffer can corrupt kernel association state and plausibly support stronger primitives.\nA:H - The out-of-bounds reads and large attacker-controlled copies can trigger kernel faults, KASAN splats, allocation failure paths, or repeated remote crashes of SCTP processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53246","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53250","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached by a local process using AF_XDP socket setup, UMEM registration, TX ring submission, and send/poll-driven transmit; it is not reachable directly from remote network packets.\nAC:L - The attacker controls the UMEM metadata and can trigger TX from the same process, so the TOCTOU race can be created with attacker-controlled concurrent writes.\nPR:L - AF_XDP socket creation requires CAP_NET_RAW in the relevant network namespace, which is attainable by a low-privileged local user in user/network namespace deployments.\nUI:N - No victim action is needed after the attacker has local execution; the attacker sets up the socket, UMEM, metadata, and transmit operation directly.\nS:U - The vulnerability corrupts or reads kernel networking memory within the same kernel security authority; this is standard local kernel attack surface, not a VM or hardware boundary crossing.\nC:H - Racing csum_start/csum_offset can bypass validation and drive out-of-bounds checksum reads in kernel transmit checksum handling, so potential kernel memory disclosure is high.\nI:H - The same unvalidated checksum offsets can cause checksum writes to an attacker-influenced out-of-bounds location relative to skb data, making kernel memory corruption plausible.\nA:H - The out-of-bounds memory access in the kernel transmit path can trigger warnings, faults, or kernel crashes and can be repeatedly exercised by the local attacker."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53250","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53262","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through a local `ioctl()` on a connected PPPoL2TP `AF_PPPOX` socket. Remote L2TP packets do not invoke `pppol2tp_ioctl()`.\nAC:L - The attacker controls both sides of the race by blocking `copy_from_user()` in the ioctl thread and closing the same socket concurrently. No external victim state is required.\nPR:L - A local unprivileged user can reach the PPPoL2TP socket/ioctl path; L2TP management also uses user-namespace admin permissions rather than requiring real init-namespace root. This is not remotely reachable without local code execution.\nUI:N - No victim action is required after the attacker runs local code. The attacker creates/connects the socket, issues the ioctl, and closes the socket.\nS:U - The impact is within the kernel security authority on the same system. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel heap use-after-free of `struct l2tp_session`, and the resumed ioctl can read from reclaimed/faked session and tunnel data before copying results to userspace. Per conservative kernel UAF scoring, this supports high confidentiality impact.\nI:H - Kernel UAFs with attacker-controlled timing and heap reuse can be leveraged beyond a simple stale read, including corruption or control-flow primitives. When uncertain, the higher severity option is appropriate.\nA:H - At minimum, dereferencing the stale session or tunnel pointer can trigger a kernel oops or panic. The attacker can repeatedly trigger the race locally."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53262","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53267","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached by installing crafted nftables/netfilter rules through NETLINK_NETFILTER and then triggering packet evaluation locally. Remote packets alone cannot install the rule, so this is a local attack vector.\nAC:L - A single crafted rule sequence such as `ct zone set` followed by `ct original saddr` can deterministically trigger the bug on matching packets. No race or external condition beyond the attacker's control is required.\nPR:L - Rule creation requires CAP_NET_ADMIN for the relevant network namespace via nfnetlink. Because nftables is reachable with CAP_NET_ADMIN in a user-created network namespace on systems permitting unprivileged user namespaces, this is low privileges rather than high.\nUI:N - After the attacker installs the crafted rule, triggering occurs through packet processing without any victim user action. No user needs to open a file, mount anything, or interact with attacker-controlled content.\nS:U - The bug corrupts kernel memory during kernel packet-filter evaluation and impacts the same kernel security authority. This is standard kernel privilege escalation/DoS behavior, not a VM, IOMMU, or distinct security-scope escape.\nC:H - The bug is a kernel stack out-of-bounds write past `struct nft_regs`, a memory corruption primitive. Under the required higher-severity rule, such memory corruption is defensibly treated as capable of enabling high confidentiality impact.\nI:H - The vulnerable 16-byte memcpy can overwrite beyond the validated destination register on the kernel stack. Out-of-bounds kernel writes are high integrity impact because they can plausibly be developed into control-flow or privilege-modification primitives.\nA:H - The stack overwrite can corrupt adjacent stack state or registers during packet evaluation and can crash or oops the kernel. Kernel crash or panic is high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53267","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53354","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable TLBI completion path is reachable by locally executing code that drives memory permission/unmap activity through syscalls or guest/KVM memory-management activity. It is not directly exposed by network packets.\nAC:L - Although the erratum depends on timing, the attacker can repeatedly arrange concurrent stores and translation invalidations on affected multicore Arm systems. The triggering race is therefore attacker-influenced rather than dependent on a one-off external condition.\nPR:L - A basic unprivileged local user or guest workload can reach the relevant Stage-1/Stage-2 TLBI paths without host administrative privileges. No real root capability in the init namespace is required.\nUI:N - After the attacker has local code execution, exploitation only requires attacker-driven memory operations/syscalls or guest activity. No separate victim action is needed.\nS:C - In a severe reasonable deployment such as Arm KVM/cloud virtualization, bypassing Stage-2 or higher-level translation protections can let guest-controlled writes affect hypervisor/host resources. That crosses a security authority boundary.\nC:H - The primitive can enable privilege escalation to kernel or hypervisor context, making protected memory and secrets accessible. Even though the erratum affects stores, successful control of privileged context supports high confidentiality impact.\nI:H - The core issue permits writes to memory after translation permissions or ownership should have been revoked. This is a high-integrity memory corruption primitive with plausible kernel or hypervisor privilege escalation.\nA:H - Incorrect late writes into protected or reused memory can corrupt kernel/hypervisor state. Failed exploitation or corruption can plausibly cause kernel panic, guest/host crash, or system instability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53354","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53375","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through the AMDGPU_CS DRM ioctl on a render node (/dev/dri/renderD*), requiring local access to submit crafted VCE indirect buffers to the GPU driver.\nAC:L - An attacker fully controls the VCE command stream and per-command length fields, and can reliably craft commands where exactly one relocation index is out of bounds (e.g., 0x0500000d with len=32) to trigger partial address patching.\nPR:L - Exploitation requires only unprivileged local access to the amdgpu DRM render node; AMDGPU_CS is gated by DRM_AUTH|DRM_RENDER_ALLOW, not root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the entire malicious command submission through the render node.\nS:C - Partial address patching causes VCE firmware to DMA using attacker-influenced GPU addresses outside the intended buffer object boundaries, crossing the GPU memory/DMA isolation boundary that the relocation logic is meant to enforce.\nC:H - VCE firmware performs DMA reads using the malformed 64-bit address, enabling arbitrary reads from GPU-accessible memory regions (including GTT-mapped system memory) beyond the validated buffer scope.\nI:H - VCE firmware performs DMA writes (encoded bitstreams, feedback, and context buffers) to attacker-influenced addresses, enabling arbitrary GPU-mapped memory corruption and potential privilege escalation primitives.\nA:H - Submitting commands with malformed firmware addresses can cause GPU page faults, driver hangs, GPU resets, or kernel oops/panic when the VCE engine accesses invalid memory regions."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53375","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53388","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local syscalls: mounting a FUSE filesystem, reading files to trigger readpages, and the FUSE daemon writing replies to /dev/fuse via splice_write with SPLICE_F_MOVE.\nAC:L - The race is between the attacker's own splice reply and a concurrent abort they trigger (e.g., via sysfs abort or unmount); the attacker controls both threads and can retry until the window is hit.\nPR:L - Exploitation requires mounting and operating a FUSE filesystem via /dev/fuse, which needs local user privileges; on typical systems this is reachable by unprivileged users via user namespaces (CAP_SYS_ADMIN in a user namespace) without init-namespace root.\nUI:N - No victim interaction is required; the attacker mounts the filesystem, runs the FUSE daemon, and triggers the concurrent abort themselves.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as guest-to-host or sandbox breakout.\nC:H - The vulnerability is a use-after-free of fuse_io_args and associated folio pointers in kernel heap memory, which can be leveraged for arbitrary kernel memory read via heap reuse.\nI:H - Use-after-free of fuse_io_args enables heap spraying and controlled reuse of freed kernel objects, providing a path to arbitrary kernel memory write or code execution.\nA:H - The UAF and the race with folio replacement can cause kernel oops/panic, including NULL pointer dereference when fuse_readpages_end accesses a folio with a NULL mapping."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53388","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53391","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The crash is triggered by processing a malicious GETDEVICEINFO RPC response from an NFS metadata server over the network, on the standard NFSv4 client path used by pNFS file and flexfile layouts.\nAC:L - Once a victim is a pNFS client, the attacker reliably triggers the bug by sending a GETDEVICEINFO body with a zero-length r_netid or r_addr opaque; no race or special memory layout is required.\nPR:N - The attacker acts as (or compromises) the remote NFS metadata server and needs no local privileges on the victim client; exploitation is delivered entirely through NFS protocol responses to an already-established mount.\nUI:N - In the highest-impact scenario—a compromised enterprise/HPC metadata server or autofs-managed pNFS mount—no further victim action is needed beyond normal file I/O that provokes GETDEVICEINFO.\nS:U - The vulnerability causes a kernel panic on the NFS client itself and does not cross a security boundary such as a VM escape or sandbox breakout.\nC:N - This is a NULL pointer dereference in strrchr() with no out-of-bounds read or use-after-free; it does not disclose kernel memory or attacker-controlled data.\nI:N - There is no memory corruption, arbitrary write, or control-flow hijack primitive—only an immediate NULL dereference that terminates kernel execution.\nA:H - The NULL pointer dereference in kernel context causes an oops or panic, fully denying availability of the affected client (and any co-hosted workloads until reboot)."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53391","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53402","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the KDFONTOP ioctl on a framebuffer-console virtual terminal (/dev/ttyN), which is a local syscall path with no network or physical-access vector.\nAC:L - An attacker who controls a session on an fbcon-backed VT can reliably trigger the bug by issuing a font-change ioctl with different dimensions and a 256↔512 glyph transition, then inducing vc_resize() failure through self-controlled memory pressure; no race or victim-dependent timing is required.\nPR:L - KDFONTOP font-set operations require only that the caller owns the controlling TTY (current->signal->tty == tty), which any unprivileged local user with a console or VT session has; CAP_SYS_TTY_CONFIG is not required on that path.\nUI:N - Exploitation requires only the attacker's own ioctl and memory-pressure actions on their TTY; no action by another user or administrator is needed.\nS:U - Impact is confined to kernel memory disclosure and potential kernel crash within the same kernel security authority; there is no VM escape, sandbox escape, or cross-security-boundary effect.\nC:H - The desynchronized hi_font_mask causes deterministic out-of-bounds reads from the kernel font glyph buffer during fbcon rendering (e.g., bit_cursor and rotated putcs paths), enabling disclosure of adjacent kernel memory.\nI:N - The flaw is an out-of-bounds read with console state desynchronization; it does not provide an arbitrary kernel write, code execution, or other data-modification primitive.\nA:H - Out-of-bounds reads from kernel font data can cause kernel page faults and oopses, consistent with the prior syzkaller-reported fbcon font/resize failure class that produced unhandled page faults."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53402","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63802","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local cgroup management (rmdir on cgroupfs) and concurrent block I/O to populate per-blkcg rstat lists; the vulnerable code is in the block cgroup teardown path, not in any network protocol handler.\nAC:L - The attacker controls both sides of the race by issuing I/O on multiple block devices to create multiple blkgs with pending stats, then concurrently destroying the cgroup to trigger parallel blkg_release() calls on multiple CPUs.\nPR:L - Triggering cgroup deletion and block I/O requires only delegated cgroup write access or namespace/container root (CAP_SYS_ADMIN in a user namespace), not init-namespace root; this is routinely available in containers, Kubernetes pods, and systemd user cgroup hierarchies.\nUI:N - No victim interaction is required; the attacker programmatically performs I/O and cgroup teardown from their own process or container.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it does not inherently cross a VM, container, or IOMMU boundary without a separate privilege-escalation step.\nC:H - The use-after-free dereferences freed blkg structures and associated iostat data during list iteration, enabling arbitrary kernel memory read primitives typical of slab UAF bugs.\nI:H - UAF on kmalloc-allocated blkg objects allows heap grooming and write through dangling pointers, which can be leveraged for arbitrary kernel memory modification or code execution.\nA:H - Concurrent use-after-free during blkg teardown can cause immediate kernel oops/panic from accessing freed memory, and repeated triggering enables reliable denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63802","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63806","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - A malicious KVM guest triggers this via guest-executed MMIO stores handled by the x86 instruction emulator (KVM_RUN → vmx_handle_exit → kvm_mmu_page_fault → x86_emulate_instruction → emulator_read_write → vcpu_mmio_write → ioeventfd_write), not via remote network input to the host.\nAC:L - The guest fully controls the spanning store address, size, and timing; with standard QEMU/virtio datamatch ioeventfd MMIO layouts, a page-boundary write reliably reaches ioeventfd_in_range() with a misaligned val pointer and fires the BUG_ON().\nPR:N - Exploitation requires only unprivileged code execution inside an already-running guest VM (reproducer ran as UID 1000); no host capabilities, KVM ioctls, or guest root are needed beyond what any cloud VM tenant or compromised guest process already has.\nUI:N - No victim interaction is required once the attacker can run code in a KVM guest with a datamatch ioeventfd configured, which is the default virtio/QEMU setup.\nS:C - The vulnerable component is the host kernel KVM subsystem, but exploitation is initiated from a guest VM and causes a host kernel BUG/oops, crossing the hypervisor security boundary.\nC:N - The failure mode is an explicit BUG_ON() alignment check before any datamatch comparison; there is no out-of-bounds read, use-after-free, or other memory corruption that could disclose host data.\nI:N - The bug triggers a deliberate kernel BUG and does not corrupt or modify host memory; it is a crash-only denial-of-service with no integrity impact.\nA:H - A guest-triggered BUG_ON() in ioeventfd_write() causes a host kernel oops/panic, denying availability of the entire physical host and all co-resident VMs on multi-tenant KVM hypervisors."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63807","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the KVM VM file descriptor ioctl path (KVM_SET_USER_MEMORY_REGION), which requires local syscall access to /dev/kvm rather than any network-facing protocol.\nAC:L - An attacker with KVM access can deterministically set up the required state (partial hugepage memslot, dirty logging enabled then disabled, guest hugepage mapping extending below slot bounds) and trigger the bug without depending on conditions outside their control.\nPR:L - Exploitation requires only local access to /dev/kvm and control of a VM (e.g., membership in the kvm group), as demonstrated by the reproducer running as UID 1000; it does not require host root in the init namespace.\nUI:N - No victim user interaction is required beyond the attacker issuing the KVM ioctl to disable dirty logging on a memslot they control.\nS:C - The vulnerable KVM x86 MMU code runs in the host kernel and a VM operator can corrupt or crash host kernel memory from their guest/VM management context, crossing the guest-to-host virtualization security boundary.\nC:H - The bug is an out-of-bounds kernel read of memslot lpage_info metadata via an invalid gfn index in kvm_mmu_max_mapping_level(), which per kernel guidance qualifies as high confidentiality impact even though it typically manifests as a page fault.\nI:H - Out-of-bounds access to kernel heap metadata in the KVM MMU subsystem can potentially be steered for memory corruption and control-flow influence; similar KVM shadow MMU memory safety bugs are scored at high integrity impact.\nA:H - The vulnerability reliably causes a host kernel oops/page fault (supervisor read to non-present vmalloc address) when triggered, constituting high availability impact via host kernel crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63807","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63824","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reachable only through the keyctl(2) syscall (KEYCTL_PKEY_ENCRYPT, KEYCTL_PKEY_DECRYPT, or KEYCTL_PKEY_SIGN); there is no network, adjacent, or physical attack path to the affected code.\nAC:L - An attacker fully controls the undersized out_len parameter and can reliably trigger the bug on demand with no races or victim-dependent state; CONFIG_ASYMMETRIC_KEY_TYPE is commonly enabled on server and desktop kernels.\nPR:L - Exploitation requires KEY_NEED_SEARCH on an asymmetric key, which any unprivileged local user can satisfy by loading their own RSA/EC key into a session keyring; no real root or init-namespace capabilities are needed.\nUI:N - Exploitation requires only attacker-initiated keyctl calls and does not depend on any victim user action such as opening a file or mounting a filesystem.\nS:U - Impact is confined to kernel heap memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - When out_len is smaller than the cryptographic output (including out_len=0 where kmalloc(0) yields ZERO_SIZE_PTR), asym_eds_op returns the full primitive output size and copy_to_user reads far beyond the allocated buffer, leaking adjacent kernel heap contents to userspace.\nI:H - The undersized kmalloc buffer is passed directly as the crypto output target; asymmetric operations can write up to the primitive maximum (hundreds of bytes for RSA-4096) past the allocation, enabling heap corruption and potential control-flow hijacking.\nA:H - Heap out-of-bounds read/write against kmalloc objects or writes through ZERO_SIZE_PTR can cause kernel oops, panic, or KASAN-detected corruption, satisfying high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63824","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63829","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires sending RTM_NEWLINK changelink requests over rtnetlink (netlink socket), matching the kernel guidance that tc/netlink configuration paths are Local.\nAC:L - Once a cross-namespace GRE/ERSPAN device is present in the caller's netns, triggering the bug is a single deterministic netlink changelink with no races or attacker-uncontrollable timing.\nPR:L - The rtnl entry path requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user can obtain inside a user namespace via unshare --user --map-root-user --net without real init-namespace root.\nUI:N - Exploitation is fully programmatic through netlink; no victim user action such as opening a file or mounting a filesystem is required.\nS:C - The changelink mutates tunnel state in t->net while authorization is checked only against dev_net(dev), crossing from the attacker's net/user namespace into another tenant's or the host's network namespace tunnel tables.\nC:H - An attacker can rewrite IFLA_GRE_REMOTE/LOCAL, keys, and related tunnel parameters to redirect GRE/ERSPAN traffic through attacker-controlled endpoints and read tunneled payloads.\nI:H - Unauthorized changelink updates live tunnel fields (including collect_md and encap parameters parsed before the missing check), enabling arbitrary redirection or injection of traffic in the victim link netns.\nA:H - Rewriting tunnel endpoints, keys, or metadata handling can break production GRE/ERSPAN overlays and VPN paths, causing sustained loss of connectivity for dependent services."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63829","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63884","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local DRM ioctls on the Intel GPU render node (notably I915_GEM_EXECBUFFER2 and I915_GEM_MADVISE); there is no network, adjacent-radio, or physical-access entry path.\nAC:L - An attacker controls the triggering workload (concurrent execbuffers, madvise DONTNEED, and GPU memory pressure to force eviction), and the UAF is a deterministic stale-pointer bug rather than a race against uncontrollable system state.\nPR:L - Exploitation requires only access to the DRM render node and standard unprivileged GEM ioctls (DRM_RENDER_ALLOW); no CAP_SYS_ADMIN, DRM master, or init-namespace root is needed.\nUI:N - No victim interaction is required beyond the attacker (or a compromised local GPU client) issuing its own ioctl submissions to the render node.\nS:U - Successful exploitation yields kernel memory corruption and local privilege escalation within the same kernel security authority; it does not constitute a VM escape or IOMMU/DMA boundary bypass.\nC:H - This is a kernel heap use-after-free on a freed i915_ttm_tt structure; attacker-controlled reuse of the freed object can provide arbitrary kernel memory read primitives.\nI:H - UAF on the i915_ttm_tt/filp path enables heap grooming and corrupting kernel objects, providing a standard path to arbitrary kernel write and code execution.\nA:H - The vulnerability was observed causing a kernel general protection fault/oops under real workloads, and UAF in this path can reliably crash or hang the system even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63884","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63893","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:A - A malicious Thunderbolt XDomain peer (adjacent host, dock, or in-line device on a direct Thunderbolt/USB4 link) delivers crafted PROPERTIES_RESPONSE data that the victim kernel parses during automatic XDomain discovery.\nAC:L - The peer fully controls property entry value/length fields and can reliably craft the u32 wrap (e.g. value=0xffffff00, length=0x100) without races or special memory layout.\nPR:N - Exploitation requires no privileges on the victim system; the attacker only needs to be the connected XDomain peer responding to the kernel-initiated property exchange, with no authentication on that control-plane path.\nUI:N - Once a Thunderbolt XDomain link exists, property fetching and parsing run automatically in the kernel handshake state machine without any additional victim user action at exploitation time.\nS:U - Impact is confined to the victim kernel/userspace boundary (kernel heap disclosure to local sysfs and possible kernel crash); it does not cross VM, IOMMU, or sandbox security boundaries.\nC:H - Integer-wrap bypass enables an out-of-bounds kernel memory read of up to entry->length dwords, which for deviceid/vendorid TEXT properties is copied into world-readable sysfs attributes, disclosing kernel heap contents.\nI:N - The bug is an out-of-bounds read via parse_dwdata(); destination buffers are properly sized kcalloc allocations, so there is no out-of-bounds write or integrity modification of victim kernel structures.\nA:H - Reading from block+0xffffff00 dwords (~4 GB past the allocation) will access unmapped kernel addresses, causing a kernel fault/oops/panic in addition to any information disclosure."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63893","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63912","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the ESP outbound encryption path reached when IPsec-protected traffic is sent through xfrm (e.g., from an internet-facing VPN/tunnel gateway encrypting responses or forwarded flows to a remote peer). A network peer can influence outbound skb fragment sizes to hit the vulnerable fast path without local shell access.\nAC:L - An attacker can reliably craft payload sizes so ALIGN(skb->data_len) and ALIGN(tailen) each pass the broken per-field PAGE_SIZE gate while their combined aligned length exceeds PAGE_SIZE, repeatedly probing until the out-of-place page-frag path is taken.\nPR:N - Exploitation does not require configuring xfrm or host admin rights; it only needs the target to already run ESP and the attacker to send traffic that is encrypted on output (e.g., as a remote VPN/site-to-site peer), which is network-layer access rather than local OS privilege.\nUI:N - Triggering the vulnerable ESP output path requires only attacker-controlled network traffic and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - The flaw is a heap out-of-bounds write during AEAD encryption over an undersized page frag; such memory corruption can expose adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - Writing past the allocated page-frag buffer corrupts adjacent heap memory and can be developed into arbitrary write or control-flow hijack primitives, matching kernel guidance for out-of-bounds writes.\nA:H - Corrupting kernel heap memory during crypto output can cause immediate kernel oops/panic or persistent instability, and repeated triggering can deny service on VPN gateways and other IPsec endpoints."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63912","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63917","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through rtnetlink configuration (RTM_NEWLINK changelink and RTM_SETLINK netns move via `ip link`), not through remote packet handling on the vti6 tunnel itself.\nAC:L - Exploitation is a deterministic, attacker-controlled sequence (create vti6, move netns, changelink, delete netns) with no races or external victim state required.\nPR:L - The fix commit and rtnetlink path confirm reachability with CAP_NET_ADMIN inside an unprivileged user+network namespace (`unshare --user --map-root-user --net`), not init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug entirely through their own netlink operations.\nS:C - On container hosts, an unprivileged tenant can corrupt namespace teardown and panic the host kernel, impacting resources outside the attacker's security scope (other tenants and the host).\nC:H - The stale per-netns hash leaves `cleanup_net()`/`vti6_exit_rtnl_net()` walking freed `ip6_tnl` list nodes, constituting a use-after-free with arbitrary kernel memory read potential.\nI:H - Cross-netns hash corruption can leave dangling pointers and drive `unregister_netdevice_queue()` on already-freed devices (kernel BUG at net/core/dev.c:12376), enabling memory corruption exploitable for control-flow hijacking.\nA:H - The published reproducer reliably triggers a kernel BUG during namespace cleanup, causing host-wide denial of service via kernel panic/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63917","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63919","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable path is reached when IPsec ESP/AH packets are received and processed through xfrm_input transport-mode reinjection, which is a network packet receive path in net/xfrm. Remote peers can send ESP traffic to trigger deferred queueing on systems with IPsec configured.\nAC:L - The attacker controls both sides of the race by flooding IPsec packets to queue deferred reinjection work while concurrently destroying the network namespace, making the UAF reliably triggerable without conditions outside attacker control.\nPR:L - Exploitation requires configuring xfrm/IPsec and managing network namespace lifecycle, both reachable with CAP_NET_ADMIN obtainable by an unprivileged user via user namespaces (unshare -Urn), not requiring real root in the init namespace.\nUI:N - No victim user interaction is required; exploitation is achieved through automated packet transmission and namespace teardown scripted by the attacker.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The deferred callback dereferences a freed struct net (e.g., ip6_rcv_finish_core reads sysctl fields from the UAF pointer), providing an information disclosure primitive from attacker-influenced freed slab memory.\nI:H - Use-after-free on the large struct net slab object enables heap grooming and memory corruption exploitable for arbitrary kernel writes and control-flow hijacking, not merely a bounded modification.\nA:H - Dereferencing a freed network namespace structure causes kernel oops/panic from the workqueue callback path, and UAF reliably threatens system availability even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63919","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63921","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl(SIOCCHGTUNNEL) on a migrated vti6 netdev via socket/dev_ioctl; the bug is in vti6_siocdevprivate(), not in remote packet reception.\nAC:L - The attacker fully controls namespace creation, tunnel migration (IFLA_NET_NS_FD), and ioctl parameters to collide with a victim tunnel; the commit documents a deterministic, reproducible sequence with no uncontrollable race.\nPR:L - Only CAP_NET_ADMIN in the migrated (attacker) network namespace is required, obtainable via unprivileged user namespaces (unshare --user --map-root-user --net); the missing check against the creation namespace's user_ns is the core flaw.\nUI:N - No victim interaction is needed; the attacker performs all setup steps (create/migrate tunnel, issue SIOCCHGTUNNEL) autonomously.\nS:C - The attack hijacks IPsec/XFRM traffic destined for tunnels in a different tenant's network namespace on container hosts, crossing container/tenant security boundaries rather than staying within the attacker's own scope.\nC:H - After hash poisoning, xfrm receive delivers matched/decapsulated packets to the attacker-controlled netdev, enabling interception of victim VPN/IPsec traffic including potentially sensitive plaintext after decryption.\nI:H - The attacker gains control over which netdev receives victim tunnel traffic and can read, drop, or forward/modify decapsulated packets, constituting unauthorized manipulation of another tenant's network data path.\nA:H - Hijacking the creation-namespace hash bucket causes the legitimate victim tunnel to stop receiving matched traffic, producing denial of service to the victim's IPsec connectivity."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63921","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63922","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached on the standard IPv6 input path (ipv6_rcv → ip6_input → ip6_protocol_deliver_rcu → ipv6_destopt_rcv) when a remotely sent IPv6 packet carries a Destination Options header processed by ip6_parse_tlv().\nAC:L - The attacker fully controls the crafted IPv6 Destination Options layout (HAO TLV followed by trailing TLVs/padding); once CONFIG_IPV6_MIP6 and matching XFRM state exist on the target, triggering the stale-pointer condition is a reliable single-packet attack without races or victim-specific timing.\nPR:N - No local privileges or authentication are required; any remote host that can deliver IPv6 traffic to a listening interface can reach this pre-authentication receive-path parser (destopt_protocol uses INET6_PROTO_NOPOLICY).\nUI:N - Exploitation requires only sending a malicious IPv6 packet; no victim interaction such as opening files, clicking links, or mounting filesystems is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the kernel’s security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - After pskb_expand_head() frees the old skb head, ip6_parse_tlv() continues parsing trailing TLVs through the stale nh pointer, causing out-of-bounds/use-after-free reads of kernel heap memory that can disclose sensitive kernel data.\nI:H - Use-after-free of the skb head buffer during TLV parsing is heap memory corruption that can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a bounded parse error.\nA:H - Reading through the stale network-header pointer into freed or invalid memory can cause kernel oops/panic or unrecoverable instability, satisfying high availability impact even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63922","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63924","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPv6 input path (ipv6_rcv → ip6_rcv_core → ipv6_parse_hopopts) triggered by a crafted IPv6 packet with hop-by-hop options containing a Jumbo Payload TLV, reachable from any remote peer that can deliver IPv6 to the host.\nAC:L - An attacker fully controls the crafted IPv6 packet (HBH layout, jumbo length, trailing TLVs) and can send it repeatedly; once the skb is cloned/shared during receive and pskb_trim_rcsum reallocates the head, the stale-pointer UAF is deterministically triggered without races or victim-specific state.\nPR:N - No authentication or local privileges are required; any unauthenticated remote host that can send IPv6 traffic to a listening interface reaches the vulnerable receive handler with no capability or namespace checks along the path.\nUI:N - Exploitation requires only delivery of a malicious IPv6 packet and does not depend on any victim user action such as opening files, clicking links, or mounting filesystems.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary by itself.\nC:H - Continued HBH TLV parsing through the stale nh pointer is a use-after-free read of freed skb head memory, which per kernel guidance enables arbitrary kernel memory disclosure when the freed slab is reused.\nI:H - Stale-pointer UAF during TLV length/type parsing can yield unbounded out-of-bounds reads and corrupt subsequent parsing state, providing memory corruption primitives that can be developed into arbitrary kernel writes or code execution.\nA:H - Dereferencing the freed network-header pointer during TLV parsing can cause immediate kernel oops/panic from invalid memory access, and UAF-triggered parsing errors reliably drop or crash the receive path."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63924","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63946","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when the kernel processes inbound Bluetooth LE ISO data (HCI_ISODATA_PKT) from a remote peer over the radio; per kernel guidance Bluetooth is Adjacent, not Network.\nAC:L - An attacker can reliably win the race by flooding ISO frames while concurrently closing the ISO socket (or inducing disconnect that triggers stack teardown), controlling both the receive path and the iso_sock_kill() teardown path.\nPR:N - Exploitation requires only an established ISO connection with a malicious adjacent Bluetooth device; the vulnerable receive path needs no local privileges, and socket teardown can occur automatically when the remote peer disconnects.\nUI:N - No victim interaction is required during exploitation; ISO socket closure on disconnect is handled automatically by the Bluetooth stack and userspace daemons without user action.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The use-after-free dereferences freed struct sock memory (sk->sk_state) after iso_sock_kill() can sock_put() the socket, enabling arbitrary kernel memory read primitives via heap reuse.\nI:H - The UAF continues into sock_queue_rcv_skb() on the freed socket, corrupting socket receive-queue state and enabling heap-based write/control-flow hijack primitives typical of kernel UAF bugs.\nA:H - Use-after-free on struct sock during receive processing can cause kernel oops/panic from invalid memory access, and UAF bugs in the kernel are rated High availability impact even when not fully weaponized."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63946","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63952","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (memfd_create, mmap, fcntl) with no network-facing code path; the vulnerable logic is reached only through the local fcntl(F_ADD_SEALS) interface on a memfd file descriptor.\nAC:L - The attack is a reliable, deterministic syscall sequence (create executable memfd, establish a writable MAP_SHARED mapping, then apply F_SEAL_EXEC) with no race or attacker-uncontrollable conditions.\nPR:L - Any unprivileged local user can invoke memfd_create, mmap, and fcntl without capabilities; these interfaces are available inside unprivileged user namespaces with no real-root requirement.\nUI:N - Exploitation does not require a human victim action; in the highest-impact scenario a sandboxed process programmatically passes the sealed-appearing memfd to a trusting peer via IPC (e.g., SCM_RIGHTS) without user interaction.\nS:C - The bug breaks the memfd seal security contract designed for mutually untrusted parties, allowing a malicious local peer to deceive a separate process that relies on F_SEAL_WRITE immutability, crossing the inter-process trust boundary (sandbox/W^X enforcement).\nC:H - Bypassing write-seal/W^X guarantees enables arbitrary modification of executable memfd contents presented as immutable, which can be leveraged for arbitrary code execution in a trusting victim process and thereby full read of that process's memory.\nI:H - The vulnerability allows arbitrary modification of memory that is advertised as write-sealed (F_SEAL_WRITE), defeating the kernel's immutability guarantee and enabling W^X bypass and code injection into trusted execution contexts.\nA:N - The flaw is a logic error in seal enforcement that does not cause kernel crashes, panics, hangs, or denial of service; exploitation maintains availability while subverting integrity guarantees."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63952","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63968","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable function is reached from the IPv6 packet receive path (ipv6_rcv → ip6_route_input → ip6_pol_route → fib6_select_path) in softirq context, and production lockups were observed during processing of incoming IPv6 traffic on internet-facing edge routers.\nAC:L - The race is reliably triggerable when an attacker influences both packet flow and route churn (e.g., user-namespace ECMP setup plus traffic, or remote traffic coinciding with BGP nexthop updates); a dedicated selftest reproduces soft lockups in under a minute under controlled conditions.\nPR:N - Triggering fib6_select_path() during packet processing requires only the ability to send IPv6 traffic to destinations using multipath routes; concurrent route-table updates can occur from infrastructure (BGP/dynamic routing) without the attacker holding any local privileges.\nUI:N - Exploitation requires no victim interaction beyond normal network traffic delivery to a host or router processing IPv6 packets.\nS:U - The impact is kernel CPU soft lockup and watchdog panic within the same kernel security boundary; there is no sandbox, VM, or IOMMU boundary crossing.\nC:N - The bug is an infinite loop over stale sibling-list pointers during RCU read-side traversal; it does not read or disclose attacker-controlled memory or kernel secrets.\nI:N - No data modification or memory corruption occurs; the failure mode is CPU hang from unbounded list iteration, not arbitrary write or code execution.\nA:H - The infinite loop in softirq context causes CPU soft lockup, and documented production and test cases show this leads to watchdog-triggered kernel panic, a complete loss of system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63968","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63971","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls on an SCTP socket (`sendmsg`/`sendto` to trigger `sctp_wait_for_connect`, and `getsockopt(SCTP_SOCKOPT_PEELOFF)` to peel off the association). A remote peer can only help complete the SCTP handshake; it cannot invoke peeloff or the racing send path.\nAC:L - The attacker controls both sides of the race by running concurrent threads on the same SCTP one-to-many socket, timing peeloff during the window where `sctp_wait_for_connect()` has released the socket lock. Required options (`SCTP_FRAGMENT_INTERLEAVE`, `SCTP_INTERLEAVING_SUPPORTED`, and `net.sctp.intl_enable`) are attacker-settable in a user/net namespace.\nPR:L - No real-root capability is required; an unprivileged user can create SCTP sockets and drive the full race from a user namespace (`unshare -Urn`), including enabling `net.sctp.intl_enable` and the interleaving socket options needed to reach the vulnerable `sctp_sendmsg_to_asoc()` path.\nUI:N - Exploitation is fully attacker-driven through coordinated local threads and does not require any action from a victim user or administrator beyond normal SCTP socket use.\nS:U - Impact is confined to kernel memory integrity/availability within the same security authority; successful exploitation would be local privilege escalation, not a cross-boundary escape such as VM or container breakout by itself.\nC:H - After peeloff migrates `asoc->base.sk`, the caller continues in `sctp_datamsg_from_user()` while holding the wrong socket lock, creating unsynchronized concurrent access to association/stream state that can corrupt kernel heap metadata and be leveraged for arbitrary kernel memory disclosure.\nI:H - The post-race path builds and queues DATA/I-DATA chunks via `sctp_datamsg_from_user()` and `sctp_primitive_SEND()` without the correct socket lock, enabling concurrent modification of association output queues and stream structures that can be turned into arbitrary kernel writes or control-flow hijacking.\nA:H - Concurrent unsynchronized access to a live SCTP association after peeloff can cause kernel oops/panic or wedged associations, and the underlying race is a classic kernel concurrency defect with high availability impact even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63971","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63975","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when a remote Bluetooth LE peer sends a crafted L2CAP_ECRED_CONN_RSP on the LE signaling channel, processed via hci_recv_frame → l2cap_recv_acldata → l2cap_le_sig_channel → l2cap_ecred_conn_rsp. Bluetooth is Adjacent per kernel CVSS guidance.\nAC:L - An adjacent attacker who establishes a BLE ACL link can reliably trigger this by first creating an L2CAP channel with a chosen DCID (via ECRED_CONN_REQ SCIDs) and then sending a connection response reusing that DCID for a pending outgoing ECRED connection; no race or rare layout is required.\nPR:N - Exploitation requires only the ability to act as a remote Bluetooth peer on an established ACL connection; no local shell access, capabilities, or root on the victim system is needed.\nUI:N - The malicious signaling traffic is delivered entirely by the remote attacker once a BLE link exists; no additional victim-side file open, mount, or application action beyond normal Bluetooth connectivity is required to reach the vulnerable handler.\nS:U - The failure is a kernel L2CAP channel-list use-after-free and crash within the Bluetooth stack on the victim host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Calling l2cap_chan_del() on the original channel during list_for_each_entry_safe can free the saved tmp list node, causing a use-after-free on struct l2cap_chan when iteration continues; UAF is scored as High confidentiality impact.\nI:H - The same iterator invalidation frees and later dereferences l2cap_chan objects under attacker-influenced connection state, providing a heap UAF primitive that can be groomed toward arbitrary memory corruption and code execution.\nA:H - The bug reliably produces kernel list corruption and use-after-free in softirq/context Bluetooth receive path, leading to kernel oops or panic and denial of service on phones, laptops, and embedded devices with Bluetooth enabled."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63975","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63984","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code runs in the IPv6 routing-header receive handler on incoming packets; a remote attacker can deliver a crafted RFC 6554 type-3 RPL SRH to an RPL-enabled router or gateway over the network.\nAC:L - Triggering requires only a deterministically crafted SRH (e.g., n=127, CmprI=15, CmprE=15, pad=0, hdrlen=16, segments_left>0); all of these fields are fully attacker-controlled once the target has rpl_seg_enabled.\nPR:N - No authentication or local privileges are needed to send the malicious IPv6 packet; rpl_seg_enabled is a victim-side deployment setting on RPL routers/gateways (IoT/industrial mesh), not an attacker privilege requirement.\nUI:N - Exploitation is achieved solely by sending a malformed network packet and does not require any action from a victim user.\nS:U - Impact is confined to kernel memory corruption and packet forwarding within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The hdrlen truncation causes overlapping read/write of the same kmalloc buffer during decompress/recompress, constituting kernel heap memory corruption that can be leveraged for information disclosure primitives.\nI:H - ipv6_rpl_srh_compress() performs out-of-bounds writes into the overlapping decompressed region, corrupting routing-header data that is then memcpy'd into the forwarded skb, enabling memory corruption exploitable for control-flow or data modification.\nA:H - Kernel heap corruption during SRH processing can cause kernel oops, panics, or repeated crashes when processing or forwarding the corrupted packet, consistent with high availability impact for memory-corruption bugs."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63984","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63994","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when remotely injected VXLAN/GENEVE UDP packets traverse a bridged/OVS overlay and fail PMTU checks during encapsulation transmit, the same network path previously demonstrated in CVE-2023-53600 via vxlan_xmit through bridge forwarding.\nAC:L - An attacker can reliably send oversized DF-marked inner IP packets over the overlay to force PMTU ICMP generation, and can influence skb_cow() reallocation through bridge flooding/multicast cloning or headroom pressure; no uncontrollable victim state is required.\nPR:N - Exploitation requires no privileges on the victim host; any remote entity that can send VXLAN/GENEVE traffic to a VTEP with a bridged tunnel interface (standard cloud/SDN deployment) can reach the vulnerable code without authentication.\nUI:N - Triggering is fully automatic during kernel packet forwarding and tunnel encapsulation; no victim user action is needed beyond normal network operation of an overlay endpoint.\nS:U - Impact is confined to kernel memory on the affected host (UAF read/crash/potential escalation); it does not inherently cross VM, container, or IOMMU security boundaries.\nC:H - Stale ip_hdr/ipv6_hdr pointers cause reads from freed slab memory; leaked values are incorporated into ICMP error IP headers that are sent back to the attacker, constituting arbitrary kernel heap content disclosure.\nI:H - Use-after-free on skb header memory is a heap corruption primitive that can be developed into controlled writes or code execution via heap grooming, consistent with kernel UAF severity guidance.\nA:H - Dereferencing freed skb head memory during ICMP construction can cause kernel oops/panic and denial of service, as with other confirmed bugs in this same code path."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63994","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64106","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through the KVM device ioctl path (KVM_SET_DEVICE_ATTR with KVM_DEV_ARM_ITS_RESTORE_TABLES), which requires a local process with access to a VM file descriptor; it is not triggered by network packets or guest MMIO/ITS commands.\nAC:L - An attacker can reliably plant a crafted Device Table Entry in guest RAM (Size field encoding 17–32 EventID bits) and have it processed during migration/snapshot restore; no race or attacker-uncontrollable memory layout is required, and the live MAPD path already proves the invalid state is straightforward to supply.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant who needs no host privileges: they write a malformed DTE directly into guest physical memory (bypassing MAPD validation) and trigger host-side restore during automated live migration or snapshot resume, without requiring /dev/kvm or root on the host.\nUI:N - Exploitation does not require victim interaction beyond normal hypervisor operations such as automated live migration or snapshot restore that the attacker can initiate as a VM tenant; no end-user action like opening a file is needed.\nS:C - The vulnerability crosses the VM security boundary because guest-controlled saved state causes the host kernel to perform an oversized ITS table scan and mass kernel allocations, impacting host availability outside the guest's security scope.\nC:H - The unchecked num_eventid_bits value inflates scan_its_table()'s range up to BIT_ULL(32)*8 bytes (and can wrap the int size parameter for values 28–31), causing the host kernel to read far beyond the valid ITT bounds through kvm_read_guest_lock across a large guest GPA span.\nI:N - The flaw causes excessive guest-memory reads and kernel object allocation but does not corrupt or write host kernel memory; there is no demonstrated arbitrary host write, use-after-free, or code-execution primitive from this bug alone.\nA:H - The oversized scan can loop for an enormous number of kvm_read_guest_lock iterations (worse when the truncated int size wraps to a huge unsigned length), and valid-looking restored ITEs can drive unbounded vgic_add_lpi/kzalloc allocations, exhausting host CPU and memory and causing severe denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64106","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64189","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable dump and resize paths are reached through local NETLINK_NETFILTER send and receive syscalls, not through remotely received packets.\nAC:L - The attacker controls both sides by issuing an ipset dump and concurrent CREATE requests that grow ip_set_list, and can repeat the race without any victim-controlled condition.\nPR:L - NFNETLINK requires CAP_NET_ADMIN in the network namespace's owning user namespace, which an unprivileged user can obtain through user and network namespaces on deployments permitting unprivileged user namespaces.\nUI:N - After obtaining local execution, the attacker can trigger both racing operations without any action by another user.\nS:U - Exploitation compromises the kernel of the same host and constitutes standard local privilege escalation rather than crossing a VM, hypervisor, or IOMMU boundary.\nC:H - Reclaiming the freed array can make the loaded struct ip_set pointer attacker-influenced, after which variant-pointer dereferences can enable kernel code execution and arbitrary memory disclosure.\nI:H - The release path performs an indirect uref callback and decrements ref_netlink through the stale pointer, providing control-flow and kernel-memory-write opportunities after heap reclamation.\nA:H - The reported use-after-free produced a general-protection fault and kernel panic, and an attacker can trigger the race repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64189","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64530","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On a transparent bridge or traffic-shaping gateway configured with the RED qevent and act_ct, unauthenticated remote IP fragments reach red_enqueue() through normal receive, bridge-forwarding, and egress-qdisc processing. No local netlink access is required to trigger the deployed configuration.\nAC:L - The attacker controls fragment contents and ordering and can drive RED into deterministic hard-mark or drop conditions with sustained traffic. No race or condition outside the attacker's control must be won.\nPR:N - CAP_NET_ADMIN is required to create the vulnerable configuration, but a remote attacker sending fragments through an already configured appliance needs no privileges or authentication. Local triggering is also possible with namespaced CAP_NET_ADMIN.\nUI:N - Triggering requires only attacker-generated fragmented traffic and does not depend on a victim performing any action.\nS:U - The corruption occurs within the host kernel and compromises resources governed by that same security authority. This remains unchanged scope even when used for namespace escape or kernel privilege escalation.\nC:H - The reclaimable sk_buff use-after-free and corrupted defragmentation-tree links can be leveraged through attacker-controlled network heap spraying to disclose arbitrary kernel memory.\nI:H - RED overwrites linkage fields that overlap the defragmentation RB node and may free the object while it remains referenced, enabling subsequent writes through freed or attacker-reclaimed kernel objects and potential code execution.\nA:H - The dangling fragment-tree entry can cause immediate or deferred use-after-free, double-free, invalid tree operations, and kernel panic when another fragment arrives or the queue expires. The attacker can trigger this repeatedly with fragmented traffic."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64530","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64560","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached purely through local syscalls (`timer_create`/`timer_settime`/`timer_delete`/`clock_nanosleep`) raced against `execve()` from a non-leader thread in the attacker's own process. No network or remote data path reaches posix-cpu-timers.\nAC:L - The attacker controls both sides of the race — one thread arms and deletes a process-wide CPU timer while a non-leader thread in the same process calls `execve()` — and can loop indefinitely with CPU pinning/thread spraying to widen the window between `pid_task()` and `lock_task_sighand()`. No condition depends on anything outside attacker control.\nPR:L - Any ordinary unprivileged local user can create and delete `CLOCK_PROCESS_CPUTIME_ID` timers; `pid_for_clock()` performs no capability check when the encoded PID is 0, and `CONFIG_POSIX_TIMERS` is `default y` on essentially all deployments.\nUI:N - The attacker performs every step — timer creation, arming, deletion, and the concurrent non-leader exec — entirely within its own multithreaded process. No victim action is involved.\nS:U - The corruption stays within the kernel's own security authority; it is a standard local kernel memory-corruption/privilege-escalation primitive with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The stale timerqueue node yields UAF reads of the freed `k_itimer` and causes `current` (a live `task_struct` pointer) plus rbtree pointers to be written into the freed/reallocated slot, and the freed object can be reclaimed by another attacker-created `k_itimer`, enabling kernel pointer disclosure and broad memory read.\nI:H - `collect_timerqueue()` writes into freed memory (`ctmr->firing`, `ctmr->handling`, rbtree rebalancing, list insertion) and the `do_cpu_nanosleep()` variant does so into a live, attacker-groomed kernel stack frame, followed by `cpu_timer_fire()` dereferencing attacker-controlled `it_process`/`it_signal` — a control-flow-hijack-capable write primitive.\nA:H - Even without exploitation the dangling timerqueue node produces rbtree/list corruption and a kernel oops, and the pre-fix `WARN_ON_ONCE(timerqueue_node_queued(...))` is an immediate panic under `panic_on_warn`; the race can be triggered repeatedly by any local user."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64560","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64561","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable shadow-MMU page-fault path is reached via local KVM_RUN handling of guest EPT/shadow faults (and nested EPT via paging_tmpl), not by network or adjacent-radio packets.\nAC:L - An attacker who can run nested or shadow-MMU guests controls MMU pressure (heavy nested mappings and/or KVM_SET_NR_MMU_PAGES) and concurrent faults so reclaim zaps an in-use root during make_mmu_pages_available; no attacker-uncontrollable condition is required.\nPR:L - Exploitation needs /dev/kvm access or a nested-capable guest on the host, privileges commonly available to kvm-group users or cloud tenants, not real init-namespace root or CAP_SYS_ADMIN on the create/run path.\nUI:N - Once the attacker can run the guest, they trigger reclaim and page faults entirely through their own vCPU activity with no action by another user.\nS:C - Guest-controlled faults corrupt host KVM MMU state (invalid shadow pages on active_mmu_pages and subsequent list handling), crossing the guest-to-host virtualization boundary into the host kernel authority.\nC:H - Invalid children on active_mmu_pages break zap accounting assumptions so later prepare_zap list_add on still-linked entries corrupts kernel lists, a memory-corruption primitive that can be leveraged for arbitrary host reads.\nI:H - The same active-list invariant break and linked-list corruption in host MMU teardown/reclaim paths yield writable host corruption suitable for control-flow or structure hijacking, not merely a benign accounting glitch.\nA:H - WARN_ON_ONCE skips, infinite zap loops, list corruption, and host oops/hangs are reachable when invalid shadow pages remain on active_mmu_pages, causing host and co-located VM denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64561","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64564","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in SCTP ASCONF receive processing (sctp_rcv → sctp_sf_do_asconf → sctp_process_asconf → sctp_process_asconf_param); a remote peer triggers it by sending a crafted ASCONF over IP/IPv6 on an established association, matching kernel guidance that net/ stack bugs reachable via received packets are Network.\nAC:L - A single attacker-controlled ASCONF with [Address Parameter L][DEL-IP L][DEL-IP 0.0.0.0] reliably frees asconf->transport then reuses it in the same softirq; the peer fully controls multi-homing, serial, and parameter order, with no race or other condition outside attacker influence.\nPR:N - Any remote SCTP peer that completes a normal association with ADD-IP negotiated can send the ASCONF; SCTP-AUTH keys come from the handshake the peer itself performs (or addip_noauth), and no local credentials or capabilities on the target are required.\nUI:N - Exploitation requires only attacker-sent SCTP packets processed automatically in the receive/state-machine path; no victim user action such as opening a file or mounting a device is needed.\nS:U - Impact is confined to the vulnerable host kernel (sctp_transport UAF / crash or privilege escalation) and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - This is a heap use-after-free of an sctp_transport planted into primary_path/active_path after RCU-deferred free; freed-object reuse yields arbitrary kernel read primitives, scored High per UAF guidance.\nI:H - The same transport UAF enables heap spraying and write/control-flow hijacking via later dereferences of the dangling primary_path/active_path, so integrity impact is High.\nA:H - set_primary() immediately dereferences the freed transport and leaves the association with transport_count 0 and dangling path pointers, causing a reproducible kernel oops/panic on subsequent use, which is High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64564","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64600","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation uses local FICLONE and concurrent O_DIRECT write syscalls against an XFS filesystem.\nAC:L - The attacker controls both racing writers, can amplify the transaction-allocation window, and demonstrated exploitation typically succeeds within seconds.\nPR:L - A basic unprivileged local user needs only read access to the protected source and write access to a scratch file; no capabilities are required.\nUI:N - The attacker creates the reflink and triggers both sides of the race without any victim action.\nS:U - This is a standard local kernel-mediated privilege escalation affecting resources within the host operating system's existing security authority.\nC:H - Overwriting /etc/passwd or a readable SUID-root binary yields full root access and consequently unrestricted access to system-confidential data.\nI:H - The stale physical mapping provides attacker-controlled persistent writes into protected readable files while preserving their ownership and SUID metadata, enabling full root compromise.\nA:H - The attacker can persistently corrupt boot-critical binaries or configuration files and, after obtaining root, cause complete system unavailability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64600","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A3602-1","advisory_id":"130b8b86-0b9f-4b76-b8c0-96bf6997a30c","event_types":["advisory"],"published_at":"2026-10-25T22:45:52.959384+00:00","technologies":["core-osv","kernel-64kb","kernel-default","kernel-default-base","kernel-docs","kernel-livepatch-sle15-sp6-update-30","kernel-obs-build","kernel-source","kernel-syms","kernel-zfcpdump"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T15:40:54+00:00","detail_url":"/events/71340"}]}}],"next_after":70967,"next_before":70967}