{"schema_version":"2","view":"grouped","data":[{"id":70970,"cve_ids":["CVE-2024-44981","CVE-2024-57841","CVE-2025-38469","CVE-2025-40022","CVE-2025-68179","CVE-2025-68214","CVE-2025-71104","CVE-2026-23210","CVE-2026-23230","CVE-2026-23451","CVE-2026-23454","CVE-2026-31502","CVE-2026-43147","CVE-2026-43456","CVE-2026-45968","CVE-2026-52910","CVE-2026-52912","CVE-2026-52929","CVE-2026-52977","CVE-2026-52994","CVE-2026-53059","CVE-2026-53110","CVE-2026-53163","CVE-2026-53260","CVE-2026-53264","CVE-2026-53365","CVE-2026-53366","CVE-2026-53381","CVE-2026-63801","CVE-2026-63823","CVE-2026-63827","CVE-2026-63879","CVE-2026-63881","CVE-2026-63886","CVE-2026-63887","CVE-2026-63888","CVE-2026-63920","CVE-2026-63944","CVE-2026-63970","CVE-2026-63972","CVE-2026-63973","CVE-2026-63992","CVE-2026-64000","CVE-2026-64002","CVE-2026-64007","CVE-2026-64010","CVE-2026-64011","CVE-2026-64015","CVE-2026-64018","CVE-2026-64029","CVE-2026-64034","CVE-2026-64048","CVE-2026-64098","CVE-2026-64109","CVE-2026-64114","CVE-2026-64115","CVE-2026-64121","CVE-2026-64217","CVE-2026-64247","CVE-2026-64266","CVE-2026-64268","CVE-2026-64304","CVE-2026-64312","CVE-2026-64355","CVE-2026-64383","CVE-2026-64384","CVE-2026-64385","CVE-2026-64386","CVE-2026-64387","CVE-2026-64423","CVE-2026-64450","CVE-2026-64481","CVE-2026-64524","CVE-2026-64527","CVE-2026-64541","CVE-2026-64543","CVE-2026-64562","CVE-2026-64563","CVE-2026-64572","CVE-2026-64577","CVE-2026-64581","CVE-2026-64593","CVE-2026-68121","CVE-2026-68133","CVE-2026-68136","CVE-2026-68138","CVE-2026-68155","CVE-2026-68158","CVE-2026-68159","CVE-2026-68160","CVE-2026-68202","CVE-2026-68397","CVE-2026-68398","CVE-2026-68417","CVE-2026-68426","CVE-2026-68428","CVE-2026-68480","CVE-2026-72020","CVE-2026-72069","CVE-2026-72072","CVE-2026-72083","CVE-2026-72084","CVE-2026-72123","CVE-2026-72135","CVE-2026-72221","CVE-2026-72222","CVE-2026-72251","CVE-2026-72262","CVE-2026-72288","CVE-2026-72289","CVE-2026-72317","CVE-2026-72339","CVE-2026-72389","CVE-2026-74345","CVE-2026-74377","CVE-2026-74378","CVE-2026-74390","CVE-2026-74394","CVE-2026-74454","CVE-2026-74488","CVE-2026-74496","CVE-2026-74516","CVE-2026-74518","CVE-2026-74537","CVE-2026-74556","CVE-2026-74581","CVE-2026-74582","CVE-2026-74612","CVE-2026-74669","CVE-2026-74695","CVE-2026-80722"],"payload":{"kind":"advisory","title":"Security update for the Linux Kernel","summary":"The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731). - CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225). - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604). - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072). - CVE-2026-43147: Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (bsc#1264642). - CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734). - CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023). - CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659). - CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000). - CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004). - CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242). - CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126). - CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655). - CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985). - CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqu","evidence":"osv:SUSE-SU-2026:4369-1","products":[{"name":{"value":"kernel-default","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-livepatch-SLE15-SP6_Update_31","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1-150600.13.3.4","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-64kb","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1.150600.12.62.4","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-zfcpdump","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1.150600.12.62.4","evidence":"/affected/12/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/13/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/13/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/14/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/14/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/15/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/15/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/16/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/16/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4369-1","aliases":["SUSE-SU-2026:4369-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.135.1","kernel-default-livepatch-devel":"6.4.0-150600.23.135.1","kernel-livepatch-6_4_0-150600_23_135-default":"1-150600.13.3.4"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.3.4"}]}],"package":{"name":"kernel-livepatch-SLE15-SP6_Update_31","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_31&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.135.1","kernel-default-livepatch-devel":"6.4.0-150600.23.135.1","kernel-livepatch-6_4_0-150600_23_135-default":"1-150600.13.3.4"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-64kb","purl":"pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-zfcpdump","purl":"pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}}],"modified":"2026-10-02T18:42:50.599983491Z","provider":"osv","upstream":["CVE-2024-44981","CVE-2024-57841","CVE-2025-38469","CVE-2025-40022","CVE-2025-68179","CVE-2025-68214","CVE-2025-71104","CVE-2026-23210","CVE-2026-23230","CVE-2026-23451","CVE-2026-23454","CVE-2026-31502","CVE-2026-43147","CVE-2026-43456","CVE-2026-45968","CVE-2026-52910","CVE-2026-52912","CVE-2026-52929","CVE-2026-52977","CVE-2026-52994","CVE-2026-53059","CVE-2026-53110","CVE-2026-53163","CVE-2026-53260","CVE-2026-53264","CVE-2026-53365","CVE-2026-53366","CVE-2026-53381","CVE-2026-63801","CVE-2026-63823","CVE-2026-63827","CVE-2026-63879","CVE-2026-63881","CVE-2026-63886","CVE-2026-63887","CVE-2026-63888","CVE-2026-63920","CVE-2026-63944","CVE-2026-63970","CVE-2026-63972","CVE-2026-63973","CVE-2026-63992","CVE-2026-64000","CVE-2026-64002","CVE-2026-64007","CVE-2026-64010","CVE-2026-64011","CVE-2026-64015","CVE-2026-64018","CVE-2026-64029","CVE-2026-64034","CVE-2026-64048","CVE-2026-64098","CVE-2026-64109","CVE-2026-64114","CVE-2026-64115","CVE-2026-64121","CVE-2026-64217","CVE-2026-64247","CVE-2026-64266","CVE-2026-64268","CVE-2026-64304","CVE-2026-64312","CVE-2026-64355","CVE-2026-64383","CVE-2026-64384","CVE-2026-64385","CVE-2026-64386","CVE-2026-64387","CVE-2026-64423","CVE-2026-64450","CVE-2026-64481","CVE-2026-64524","CVE-2026-64527","CVE-2026-64541","CVE-2026-64543","CVE-2026-64562","CVE-2026-64563","CVE-2026-64572","CVE-2026-64577","CVE-2026-64581","CVE-2026-64593","CVE-2026-68121","CVE-2026-68133","CVE-2026-68136","CVE-2026-68138","CVE-2026-68155","CVE-2026-68158","CVE-2026-68159","CVE-2026-68160","CVE-2026-68202","CVE-2026-68397","CVE-2026-68398","CVE-2026-68417","CVE-2026-68426","CVE-2026-68428","CVE-2026-68480","CVE-2026-72020","CVE-2026-72069","CVE-2026-72072","CVE-2026-72083","CVE-2026-72084","CVE-2026-72123","CVE-2026-72135","CVE-2026-72221","CVE-2026-72222","CVE-2026-72251","CVE-2026-72262","CVE-2026-72288","CVE-2026-72289","CVE-2026-72317","CVE-2026-72339","CVE-2026-72389","CVE-2026-74345","CVE-2026-74377","CVE-2026-74378","CVE-2026-74390","CVE-2026-74394","CVE-2026-74454","CVE-2026-74488","CVE-2026-74496","CVE-2026-74516","CVE-2026-74518","CVE-2026-74537","CVE-2026-74556","CVE-2026-74581","CVE-2026-74582","CVE-2026-74612","CVE-2026-74669","CVE-2026-74695","CVE-2026-80722"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264369-1/","https://bugzilla.suse.com/1230238","https://bugzilla.suse.com/1235944","https://bugzilla.suse.com/1247455","https://bugzilla.suse.com/1250748","https://bugzilla.suse.com/1252682","https://bugzilla.suse.com/1254306","https://bugzilla.suse.com/1255225","https://bugzilla.suse.com/1255250","https://bugzilla.suse.com/1256708","https://bugzilla.suse.com/1257154","https://bugzilla.suse.com/1258430","https://bugzilla.suse.com/1258517","https://bugzilla.suse.com/1260522","https://bugzilla.suse.com/1261604","https://bugzilla.suse.com/1261780","https://bugzilla.suse.com/1263072","https://bugzilla.suse.com/1264642","https://bugzilla.suse.com/1264734","https://bugzilla.suse.com/1265449","https://bugzilla.suse.com/1265928","https://bugzilla.suse.com/1266402","https://bugzilla.suse.com/1267023","https://bugzilla.suse.com/1268659","https://bugzilla.suse.com/1269000","https://bugzilla.suse.com/1269004","https://bugzilla.suse.com/1269126","https://bugzilla.suse.com/1269238","https://bugzilla.suse.com/1269242","https://bugzilla.suse.com/1269306","https://bugzilla.suse.com/1269655","https://bugzilla.suse.com/1269731","https://bugzilla.suse.com/1269792","https://bugzilla.suse.com/1269981","https://bugzilla.suse.com/1269985","https://bugzilla.suse.com/1271365","https://bugzilla.suse.com/1271366","https://bugzilla.suse.com/1271830","https://bugzilla.suse.com/1272179","https://bugzilla.suse.com/1272182","https://bugzilla.suse.com/1272230","https://bugzilla.suse.com/1272381","https://bugzilla.suse.com/1272385","https://bugzilla.suse.com/1272390","https://bugzilla.suse.com/1272569","https://bugzilla.suse.com/1272571","https://bugzilla.suse.com/1272662","https://bugzilla.suse.com/1272673","https://bugzilla.suse.com/1272680","https://bugzilla.suse.com/1272682","https://bugzilla.suse.com/1272756","https://bugzilla.suse.com/1272798","https://bugzilla.suse.com/1272868","https://bugzilla.suse.com/1272877","https://bugzilla.suse.com/1273030","https://bugzilla.suse.com/1273053","https://bugzilla.suse.com/1273054","https://bugzilla.suse.com/1273105","https://bugzilla.suse.com/1273276","https://bugzilla.suse.com/1273303","https://bugzilla.suse.com/1273311","https://bugzilla.suse.com/1273422","https://bugzilla.suse.com/1273426","https://bugzilla.suse.com/1273484","https://bugzilla.suse.com/1273488","https://bugzilla.suse.com/1273523","https://bugzilla.suse.com/1273555","https://bugzilla.suse.com/1273578","https://bugzilla.suse.com/1273742","https://bugzilla.suse.com/1273743","https://bugzilla.suse.com/1273745","https://bugzilla.suse.com/1273748","https://bugzilla.suse.com/1273762","https://bugzilla.suse.com/1273766","https://bugzilla.suse.com/1273774","https://bugzilla.suse.com/1273869","https://bugzilla.suse.com/1273882","https://bugzilla.suse.com/1273891","https://bugzilla.suse.com/1273903","https://bugzilla.suse.com/1273930","https://bugzilla.suse.com/1273944","https://bugzilla.suse.com/1273968","https://bugzilla.suse.com/1273995","https://bugzilla.suse.com/1274014","https://bugzilla.suse.com/1274031","https://bugzilla.suse.com/1274041","https://bugzilla.suse.com/1274208","https://bugzilla.suse.com/1274226","https://bugzilla.suse.com/1274274","https://bugzilla.suse.com/1274497","https://bugzilla.suse.com/1274539","https://bugzilla.suse.com/1274541","https://bugzilla.suse.com/1274543","https://bugzilla.suse.com/1274545","https://bugzilla.suse.com/1274547","https://bugzilla.suse.com/1274550","https://bugzilla.suse.com/1274620","https://bugzilla.suse.com/1274696","https://bugzilla.suse.com/1274699","https://bugzilla.suse.com/1274705","https://bugzilla.suse.com/1274752","https://bugzilla.suse.com/1274753","https://bugzilla.suse.com/1274754","https://bugzilla.suse.com/1274888","https://bugzilla.suse.com/1274898","https://bugzilla.suse.com/1274902","https://bugzilla.suse.com/1274908","https://bugzilla.suse.com/1274941","https://bugzilla.suse.com/1275161","https://bugzilla.suse.com/1275304","https://bugzilla.suse.com/1275307","https://bugzilla.suse.com/1275470","https://bugzilla.suse.com/1275472","https://bugzilla.suse.com/1275474","https://bugzilla.suse.com/1275506","https://bugzilla.suse.com/1275528","https://bugzilla.suse.com/1275535","https://bugzilla.suse.com/1275540","https://bugzilla.suse.com/1275555","https://bugzilla.suse.com/1275665","https://bugzilla.suse.com/1275669","https://bugzilla.suse.com/1275687","https://bugzilla.suse.com/1275696","https://bugzilla.suse.com/1275782","https://bugzilla.suse.com/1275784","https://bugzilla.suse.com/1275797","https://bugzilla.suse.com/1275798","https://bugzilla.suse.com/1275827","https://bugzilla.suse.com/1275867","https://bugzilla.suse.com/1275886","https://bugzilla.suse.com/1275905","https://bugzilla.suse.com/1275925","https://bugzilla.suse.com/1276006","https://bugzilla.suse.com/1276350","https://bugzilla.suse.com/1276665","https://bugzilla.suse.com/1276931","https://bugzilla.suse.com/1277073","https://bugzilla.suse.com/1277155","https://bugzilla.suse.com/1277254","https://bugzilla.suse.com/1277285","https://bugzilla.suse.com/1277391","https://bugzilla.suse.com/1277408","https://bugzilla.suse.com/1277505","https://bugzilla.suse.com/1277523","https://bugzilla.suse.com/1277571","https://bugzilla.suse.com/1277678","https://bugzilla.suse.com/1277860","https://bugzilla.suse.com/1278088","https://bugzilla.suse.com/1278233","https://bugzilla.suse.com/1278236","https://bugzilla.suse.com/1279813","https://www.suse.com/security/cve/CVE-2024-44981","https://www.suse.com/security/cve/CVE-2024-57841","https://www.suse.com/security/cve/CVE-2025-38469","https://www.suse.com/security/cve/CVE-2025-40022","https://www.suse.com/security/cve/CVE-2025-68179","https://www.suse.com/security/cve/CVE-2025-68214","https://www.suse.com/security/cve/CVE-2025-71104","https://www.suse.com/security/cve/CVE-2026-23210","https://www.suse.com/security/cve/CVE-2026-23230","https://www.suse.com/security/cve/CVE-2026-23451","https://www.suse.com/security/cve/CVE-2026-23454","https://www.suse.com/security/cve/CVE-2026-31502","https://www.suse.com/security/cve/CVE-2026-43147","https://www.suse.com/security/cve/CVE-2026-43456","https://www.suse.com/security/cve/CVE-2026-45968","https://www.suse.com/security/cve/CVE-2026-52910","https://www.suse.com/security/cve/CVE-2026-52912","https://www.suse.com/security/cve/CVE-2026-52929","https://www.suse.com/security/cve/CVE-2026-52977","https://www.suse.com/security/cve/CVE-2026-52994","https://www.suse.com/security/cve/CVE-2026-53059","https://www.suse.com/security/cve/CVE-2026-53110","https://www.suse.com/security/cve/CVE-2026-53163","https://www.suse.com/security/cve/CVE-2026-53260","https://www.suse.com/security/cve/CVE-2026-53264","https://www.suse.com/security/cve/CVE-2026-53365","https://www.suse.com/security/cve/CVE-2026-53366","https://www.suse.com/security/cve/CVE-2026-53381","https://www.suse.com/security/cve/CVE-2026-63801","https://www.suse.com/security/cve/CVE-2026-63823","https://www.suse.com/security/cve/CVE-2026-63827","https://www.suse.com/security/cve/CVE-2026-63879","https://www.suse.com/security/cve/CVE-2026-63881","https://www.suse.com/security/cve/CVE-2026-63886","https://www.suse.com/security/cve/CVE-2026-63887","https://www.suse.com/security/cve/CVE-2026-63888","https://www.suse.com/security/cve/CVE-2026-63920","https://www.suse.com/security/cve/CVE-2026-63944","https://www.suse.com/security/cve/CVE-2026-63970","https://www.suse.com/security/cve/CVE-2026-63972","https://www.suse.com/security/cve/CVE-2026-63973","https://www.suse.com/security/cve/CVE-2026-63992","https://www.suse.com/security/cve/CVE-2026-64000","https://www.suse.com/security/cve/CVE-2026-64002","https://www.suse.com/security/cve/CVE-2026-64007","https://www.suse.com/security/cve/CVE-2026-64010","https://www.suse.com/security/cve/CVE-2026-64011","https://www.suse.com/security/cve/CVE-2026-64015","https://www.suse.com/security/cve/CVE-2026-64018","https://www.suse.com/security/cve/CVE-2026-64029","https://www.suse.com/security/cve/CVE-2026-64034","https://www.suse.com/security/cve/CVE-2026-64048","https://www.suse.com/security/cve/CVE-2026-64098","https://www.suse.com/security/cve/CVE-2026-64109","https://www.suse.com/security/cve/CVE-2026-64114","https://www.suse.com/security/cve/CVE-2026-64115","https://www.suse.com/security/cve/CVE-2026-64121","https://www.suse.com/security/cve/CVE-2026-64217","https://www.suse.com/security/cve/CVE-2026-64247","https://www.suse.com/security/cve/CVE-2026-64266","https://www.suse.com/security/cve/CVE-2026-64268","https://www.suse.com/security/cve/CVE-2026-64304","https://www.suse.com/security/cve/CVE-2026-64312","https://www.suse.com/security/cve/CVE-2026-64355","https://www.suse.com/security/cve/CVE-2026-64383","https://www.suse.com/security/cve/CVE-2026-64384","https://www.suse.com/security/cve/CVE-2026-64385","https://www.suse.com/security/cve/CVE-2026-64386","https://www.suse.com/security/cve/CVE-2026-64387","https://www.suse.com/security/cve/CVE-2026-64423","https://www.suse.com/security/cve/CVE-2026-64450","https://www.suse.com/security/cve/CVE-2026-64481","https://www.suse.com/security/cve/CVE-2026-64524","https://www.suse.com/security/cve/CVE-2026-64527","https://www.suse.com/security/cve/CVE-2026-64541","https://www.suse.com/security/cve/CVE-2026-64543","https://www.suse.com/security/cve/CVE-2026-64562","https://www.suse.com/security/cve/CVE-2026-64563","https://www.suse.com/security/cve/CVE-2026-64572","https://www.suse.com/security/cve/CVE-2026-64577","https://www.suse.com/security/cve/CVE-2026-64581","https://www.suse.com/security/cve/CVE-2026-64593","https://www.suse.com/security/cve/CVE-2026-68121","https://www.suse.com/security/cve/CVE-2026-68133","https://www.suse.com/security/cve/CVE-2026-68136","https://www.suse.com/security/cve/CVE-2026-68138","https://www.suse.com/security/cve/CVE-2026-68155","https://www.suse.com/security/cve/CVE-2026-68158","https://www.suse.com/security/cve/CVE-2026-68159","https://www.suse.com/security/cve/CVE-2026-68160","https://www.suse.com/security/cve/CVE-2026-68202","https://www.suse.com/security/cve/CVE-2026-68397","https://www.suse.com/security/cve/CVE-2026-68398","https://www.suse.com/security/cve/CVE-2026-68417","https://www.suse.com/security/cve/CVE-2026-68426","https://www.suse.com/security/cve/CVE-2026-68428","https://www.suse.com/security/cve/CVE-2026-68480","https://www.suse.com/security/cve/CVE-2026-72020","https://www.suse.com/security/cve/CVE-2026-72069","https://www.suse.com/security/cve/CVE-2026-72072","https://www.suse.com/security/cve/CVE-2026-72083","https://www.suse.com/security/cve/CVE-2026-72084","https://www.suse.com/security/cve/CVE-2026-72123","https://www.suse.com/security/cve/CVE-2026-72135","https://www.suse.com/security/cve/CVE-2026-72221","https://www.suse.com/security/cve/CVE-2026-72222","https://www.suse.com/security/cve/CVE-2026-72251","https://www.suse.com/security/cve/CVE-2026-72262","https://www.suse.com/security/cve/CVE-2026-72288","https://www.suse.com/security/cve/CVE-2026-72289","https://www.suse.com/security/cve/CVE-2026-72317","https://www.suse.com/security/cve/CVE-2026-72339","https://www.suse.com/security/cve/CVE-2026-72389","https://www.suse.com/security/cve/CVE-2026-74345","https://www.suse.com/security/cve/CVE-2026-74377","https://www.suse.com/security/cve/CVE-2026-74378","https://www.suse.com/security/cve/CVE-2026-74390","https://www.suse.com/security/cve/CVE-2026-74394","https://www.suse.com/security/cve/CVE-2026-74454","https://www.suse.com/security/cve/CVE-2026-74488","https://www.suse.com/security/cve/CVE-2026-74496","https://www.suse.com/security/cve/CVE-2026-74516","https://www.suse.com/security/cve/CVE-2026-74518","https://www.suse.com/security/cve/CVE-2026-74537","https://www.suse.com/security/cve/CVE-2026-74556","https://www.suse.com/security/cve/CVE-2026-74581","https://www.suse.com/security/cve/CVE-2026-74582","https://www.suse.com/security/cve/CVE-2026-74612","https://www.suse.com/security/cve/CVE-2026-74669","https://www.suse.com/security/cve/CVE-2026-74695","https://www.suse.com/security/cve/CVE-2026-80722"]},"related_cves":[{"value":"CVE-2024-44981","evidence":"/upstream"},{"value":"CVE-2024-57841","evidence":"/upstream"},{"value":"CVE-2025-38469","evidence":"/upstream"},{"value":"CVE-2025-40022","evidence":"/upstream"},{"value":"CVE-2025-68179","evidence":"/upstream"},{"value":"CVE-2025-68214","evidence":"/upstream"},{"value":"CVE-2025-71104","evidence":"/upstream"},{"value":"CVE-2026-23210","evidence":"/upstream"},{"value":"CVE-2026-23230","evidence":"/upstream"},{"value":"CVE-2026-23451","evidence":"/upstream"},{"value":"CVE-2026-23454","evidence":"/upstream"},{"value":"CVE-2026-31502","evidence":"/upstream"},{"value":"CVE-2026-43147","evidence":"/upstream"},{"value":"CVE-2026-43456","evidence":"/upstream"},{"value":"CVE-2026-45968","evidence":"/upstream"},{"value":"CVE-2026-52910","evidence":"/upstream"},{"value":"CVE-2026-52912","evidence":"/upstream"},{"value":"CVE-2026-52929","evidence":"/upstream"},{"value":"CVE-2026-52977","evidence":"/upstream"},{"value":"CVE-2026-52994","evidence":"/upstream"},{"value":"CVE-2026-53059","evidence":"/upstream"},{"value":"CVE-2026-53110","evidence":"/upstream"},{"value":"CVE-2026-53163","evidence":"/upstream"},{"value":"CVE-2026-53260","evidence":"/upstream"},{"value":"CVE-2026-53264","evidence":"/upstream"},{"value":"CVE-2026-53365","evidence":"/upstream"},{"value":"CVE-2026-53366","evidence":"/upstream"},{"value":"CVE-2026-53381","evidence":"/upstream"},{"value":"CVE-2026-63801","evidence":"/upstream"},{"value":"CVE-2026-63823","evidence":"/upstream"},{"value":"CVE-2026-63827","evidence":"/upstream"},{"value":"CVE-2026-63879","evidence":"/upstream"},{"value":"CVE-2026-63881","evidence":"/upstream"},{"value":"CVE-2026-63886","evidence":"/upstream"},{"value":"CVE-2026-63887","evidence":"/upstream"},{"value":"CVE-2026-63888","evidence":"/upstream"},{"value":"CVE-2026-63920","evidence":"/upstream"},{"value":"CVE-2026-63944","evidence":"/upstream"},{"value":"CVE-2026-63970","evidence":"/upstream"},{"value":"CVE-2026-63972","evidence":"/upstream"},{"value":"CVE-2026-63973","evidence":"/upstream"},{"value":"CVE-2026-63992","evidence":"/upstream"},{"value":"CVE-2026-64000","evidence":"/upstream"},{"value":"CVE-2026-64002","evidence":"/upstream"},{"value":"CVE-2026-64007","evidence":"/upstream"},{"value":"CVE-2026-64010","evidence":"/upstream"},{"value":"CVE-2026-64011","evidence":"/upstream"},{"value":"CVE-2026-64015","evidence":"/upstream"},{"value":"CVE-2026-64018","evidence":"/upstream"},{"value":"CVE-2026-64029","evidence":"/upstream"},{"value":"CVE-2026-64034","evidence":"/upstream"},{"value":"CVE-2026-64048","evidence":"/upstream"},{"value":"CVE-2026-64098","evidence":"/upstream"},{"value":"CVE-2026-64109","evidence":"/upstream"},{"value":"CVE-2026-64114","evidence":"/upstream"},{"value":"CVE-2026-64115","evidence":"/upstream"},{"value":"CVE-2026-64121","evidence":"/upstream"},{"value":"CVE-2026-64217","evidence":"/upstream"},{"value":"CVE-2026-64247","evidence":"/upstream"},{"value":"CVE-2026-64266","evidence":"/upstream"},{"value":"CVE-2026-64268","evidence":"/upstream"},{"value":"CVE-2026-64304","evidence":"/upstream"},{"value":"CVE-2026-64312","evidence":"/upstream"},{"value":"CVE-2026-64355","evidence":"/upstream"},{"value":"CVE-2026-64383","evidence":"/upstream"},{"value":"CVE-2026-64384","evidence":"/upstream"},{"value":"CVE-2026-64385","evidence":"/upstream"},{"value":"CVE-2026-64386","evidence":"/upstream"},{"value":"CVE-2026-64387","evidence":"/upstream"},{"value":"CVE-2026-64423","evidence":"/upstream"},{"value":"CVE-2026-64450","evidence":"/upstream"},{"value":"CVE-2026-64481","evidence":"/upstream"},{"value":"CVE-2026-64524","evidence":"/upstream"},{"value":"CVE-2026-64527","evidence":"/upstream"},{"value":"CVE-2026-64541","evidence":"/upstream"},{"value":"CVE-2026-64543","evidence":"/upstream"},{"value":"CVE-2026-64562","evidence":"/upstream"},{"value":"CVE-2026-64563","evidence":"/upstream"},{"value":"CVE-2026-64572","evidence":"/upstream"},{"value":"CVE-2026-64577","evidence":"/upstream"},{"value":"CVE-2026-64581","evidence":"/upstream"},{"value":"CVE-2026-64593","evidence":"/upstream"},{"value":"CVE-2026-68121","evidence":"/upstream"},{"value":"CVE-2026-68133","evidence":"/upstream"},{"value":"CVE-2026-68136","evidence":"/upstream"},{"value":"CVE-2026-68138","evidence":"/upstream"},{"value":"CVE-2026-68155","evidence":"/upstream"},{"value":"CVE-2026-68158","evidence":"/upstream"},{"value":"CVE-2026-68159","evidence":"/upstream"},{"value":"CVE-2026-68160","evidence":"/upstream"},{"value":"CVE-2026-68202","evidence":"/upstream"},{"value":"CVE-2026-68397","evidence":"/upstream"},{"value":"CVE-2026-68398","evidence":"/upstream"},{"value":"CVE-2026-68417","evidence":"/upstream"},{"value":"CVE-2026-68426","evidence":"/upstream"},{"value":"CVE-2026-68428","evidence":"/upstream"},{"value":"CVE-2026-68480","evidence":"/upstream"},{"value":"CVE-2026-72020","evidence":"/upstream"},{"value":"CVE-2026-72069","evidence":"/upstream"},{"value":"CVE-2026-72072","evidence":"/upstream"},{"value":"CVE-2026-72083","evidence":"/upstream"},{"value":"CVE-2026-72084","evidence":"/upstream"},{"value":"CVE-2026-72123","evidence":"/upstream"},{"value":"CVE-2026-72135","evidence":"/upstream"},{"value":"CVE-2026-72221","evidence":"/upstream"},{"value":"CVE-2026-72222","evidence":"/upstream"},{"value":"CVE-2026-72251","evidence":"/upstream"},{"value":"CVE-2026-72262","evidence":"/upstream"},{"value":"CVE-2026-72288","evidence":"/upstream"},{"value":"CVE-2026-72289","evidence":"/upstream"},{"value":"CVE-2026-72317","evidence":"/upstream"},{"value":"CVE-2026-72339","evidence":"/upstream"},{"value":"CVE-2026-72389","evidence":"/upstream"},{"value":"CVE-2026-74345","evidence":"/upstream"},{"value":"CVE-2026-74377","evidence":"/upstream"},{"value":"CVE-2026-74378","evidence":"/upstream"},{"value":"CVE-2026-74390","evidence":"/upstream"},{"value":"CVE-2026-74394","evidence":"/upstream"},{"value":"CVE-2026-74454","evidence":"/upstream"},{"value":"CVE-2026-74488","evidence":"/upstream"},{"value":"CVE-2026-74496","evidence":"/upstream"},{"value":"CVE-2026-74516","evidence":"/upstream"},{"value":"CVE-2026-74518","evidence":"/upstream"},{"value":"CVE-2026-74537","evidence":"/upstream"},{"value":"CVE-2026-74556","evidence":"/upstream"},{"value":"CVE-2026-74581","evidence":"/upstream"},{"value":"CVE-2026-74582","evidence":"/upstream"},{"value":"CVE-2026-74612","evidence":"/upstream"},{"value":"CVE-2026-74669","evidence":"/upstream"},{"value":"CVE-2026-74695","evidence":"/upstream"},{"value":"CVE-2026-80722","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ddb2c304-0ccc-4573-96b3-606b178f0dff","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-23230","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerability is in the SMB client code (fs/smb/client/). The race is triggered between processing a server's create response (setting is_open) and the server sending a lease break notification. A malicious SMB server can trigger this remotely over the network.\nAC:L - The attacker (malicious SMB server) controls when lease breaks are sent and can time them immediately after the create response. The attacker can retry many times across many directory opens, and the RMW race window is inherent to every bitfield write, making it reliably triggerable.\nPR:N - The attacker is the SMB server, requiring no privileges on the victim system. The lease break is processed as part of normal SMB protocol handling with no additional authentication check beyond the existing session.\nUI:R - The victim must mount an SMB share from the attacker's server (or a compromised server), which requires explicit user or administrator action.\nS:U - The vulnerability impacts the kernel where the SMB client runs; it does not cross a security boundary such as a VM or sandbox.\nC:H - The race can restore has_lease after the lease reference was dropped, leading to reference count corruption and use-after-free. UAF on heap objects gives the attacker read primitives over arbitrary kernel memory through heap spraying.\nI:H - The use-after-free from reference count corruption allows the attacker to reclaim the freed cached_fid object with controlled data, enabling arbitrary kernel write primitives and potential code execution.\nA:H - The reference count corruption and list corruption caused by the restored stale flags will lead to double-free, use-after-free, or list corruption, all of which reliably cause kernel panics/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-23230","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-31502","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the vulnerable team header_ops path by locally creating/enslaving network devices through rtnetlink and then triggering dev_hard_header()/dev_parse_header() via local packet/socket or network-stack activity on the malformed team device. The required setup is a local kernel networking configuration path rather than an unauthenticated packet-processing path.\nAC:L - The vulnerable topology, such as GRE -> bond -> team, is fully attacker-controlled once the required namespace capabilities are available, and triggering the bad callback is deterministic. There is no race or external timing condition required.\nPR:L - Creating team/bond/GRE devices and enslaving them requires CAP_NET_ADMIN, and packet sockets require CAP_NET_RAW, but both are available to an unprivileged user inside a user and network namespace on systems permitting unprivileged user namespaces. This is therefore low privileges, not real init-namespace root.\nUI:N - No victim interaction is required after the attacker has local access and namespace capabilities. The attacker can configure the devices and trigger the callback directly.\nS:U - The impact is within the same kernel security authority. This is a kernel crash/type-confusion or privilege-impact issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a header_ops type confusion where callbacks interpret team private data as another subsystem's private structure, causing attacker-influenced kernel pointer dereferences and potential kernel memory exposure. Following the higher-severity rule for type confusion, confidentiality impact is high.\nI:H - Type confusion in kernel callback dispatch can lead to misinterpreted object pointers and potentially control-flow or write-primitive exploitation beyond the observed crash. Kernel type confusion is scored as high integrity impact.\nA:H - The reported and expected failure mode is a kernel oops/BUG/crash when the inherited callback uses the wrong net_device private layout. This gives high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31502","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43456","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local rtnetlink/AF_PACKET operations: creating/enslaving a non-Ethernet slave to a bond and then causing `dev_hard_header()` on the bond device. Remote packets are not sufficient without the vulnerable local device configuration.\nAC:L - No race or special external timing is required; the attacker can deterministically create the bond/GRE setup and trigger the confused header callback. Required modules/configuration are common and autoloadable through rtnetlink in normal deployments.\nPR:L - The setup requires `CAP_NET_ADMIN` and the AF_PACKET trigger requires `CAP_NET_RAW`, but both are obtainable by an unprivileged local user inside a user/network namespace. Therefore this is low privilege rather than real init-namespace root only.\nUI:N - Exploitation does not require a victim user to perform an action. The attacker can perform the setup and trigger locally.\nS:U - The impact is within the kernel security authority on the same system. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug is kernel type confusion where bonding private data is interpreted as another device's private structure, and the confused callback can read kernel data using the wrong layout. Following the required higher-severity rule for type confusion, confidentiality impact is High.\nI:H - The confused header callback uses bogus private-data fields to construct and push protocol headers into an skb, making this a kernel memory/type confusion condition rather than a pure NULL dereference. Type confusion is scored as High integrity impact.\nA:H - The reported failure is a kernel BUG/oops in `pskb_expand_head()` reachable through the confused `ipgre_header()` call. This provides a reliable local kernel crash/DoS."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43456","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52910","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable attach/detach operation is reached through local `setsockopt()` on an `SO_REUSEPORT` socket with `SO_ATTACH_REUSEPORT_CBPF` or `SO_DETACH_REUSEPORT_BPF`. Although packet receive executes the stale program, the attacker-controlled trigger for freeing/replacing it is a local socket API path.\nAC:L - The race is attacker-controlled: a local attacker can create the UDP reuseport group, replace/detach the cBPF program, and concurrently send packets to drive `reuseport_select_sock()`. No rare external condition is required.\nPR:L - A basic unprivileged local user can create UDP sockets on an unprivileged port, set `SO_REUSEPORT`, and attach a classic reuseport BPF filter; this path does not require `CAP_NET_ADMIN`. User namespaces are not needed to make the path reachable.\nUI:N - No victim user action is required once the attacker runs the local reproducer. The attacker controls the sockets, the filter replacement, and the packet generation.\nS:U - The bug is a kernel memory lifetime error used for local kernel compromise or crash within the same host security authority. It does not cross a VM, IOMMU, or similar security boundary.\nC:H - This is a use-after-free of a `bpf_prog` object that is dereferenced after reclamation while selecting a reuseport socket. Per kernel CVSS guidance, UAFs are treated as enabling high confidentiality impact through potential kernel memory disclosure.\nI:H - The stale freed `bpf_prog` can be reused while the receive path reads and runs through the program object, making control-flow or data corruption plausible. Per kernel CVSS guidance, UAF memory corruption warrants high integrity impact.\nA:H - The reported reproducer triggers a KASAN vmalloc out-of-bounds/use-after-free splat in the packet receive path. Such kernel memory corruption can reliably crash or destabilize the kernel."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52912","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local control of netfilter/NFQUEUE, bridge device lifecycle, and verdict reinjection through netlink/rtnetlink paths. Remote packets alone cannot force the needed bridge teardown and userspace verdict sequence.\nAC:L - A local attacker can deterministically create a namespace, bridge/veth setup, NFQUEUE rule, queued packet, bridge teardown, and reinjection. There is no race dependent on conditions outside attacker control.\nPR:L - The setup requires CAP_NET_ADMIN, but netfilter and bridge configuration are reachable with CAP_NET_ADMIN inside a user-created network namespace on systems allowing unprivileged user namespaces. This is Low, not High.\nUI:N - No victim action is required once the local attacker runs the exploit sequence. The attacker controls packet injection, queueing, device teardown, and verdict delivery.\nS:U - The impact is kernel memory corruption within the same host security authority. This is a standard local kernel privilege escalation/DoS scenario, not a VM or hardware boundary escape.\nC:H - The bug is a use-after-free of the bridge master net_device retained in skb->dev across NFQUEUE. Kernel UAFs can be leveraged for kernel memory disclosure, so confidentiality impact is High.\nI:H - The stale net_device pointer is dereferenced after free in the receive path and can plausibly be combined with heap reclaim/spraying for memory corruption or control-flow impact. As a kernel UAF, integrity impact is High.\nA:H - At minimum, reinjection can dereference freed net_device memory in netif_receive_skb and crash/oops the kernel. Repeated local triggering makes availability impact High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52912","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52929","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached while processing an SCTP RE-CONFIG response chunk received from a remote SCTP peer on an established association. A malicious peer can send a denied ADD_OUT_STREAMS response over the network once stream reconfiguration is negotiated.\nAC:L - The packet/state sequence is protocol-controlled and reproducible: negotiate SCTP RE-CONFIG, trigger an ADD_OUT_STREAMS request, deny it, then cause later reuse of the stale stream state. Although RE-CONFIG must be enabled by the application, there is no race or condition outside the attacker's reasonable influence in a deployment using this feature.\nPR:N - A remote SCTP peer does not need local kernel privileges or authenticated OS privileges to send the denial response. The path is gated by SCTP association state, verification tag, and matching outstanding request sequence, not by credentials.\nUI:N - No human user interaction is required once the SCTP service/association is operating with stream reconfiguration. The triggering input is network protocol traffic from the peer.\nS:U - The vulnerability affects kernel SCTP state within the same host security authority. It does not cross a VM, IOMMU, or other separate authorization boundary.\nC:N - The investigated failure mode is stale SCTP stream scheduler metadata leading to a NULL pointer dereference in scheduler value retrieval. I did not find evidence of an attacker-controlled memory read or information disclosure primitive.\nI:N - The bug leaves scheduler-private stream state inconsistent but the demonstrated impact is a NULL dereference/crash, not controlled data modification or code execution. No arbitrary write primitive was evident from the rollback path.\nA:H - The stale stream extension state can lead to a kernel NULL pointer dereference/oops in the SCTP scheduler path. A remotely reachable kernel crash is a high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52929","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53110","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached by locally loading or attaching BPF programs through the bpf() syscall and then executing the JITed program or generated trampoline. It is not directly reachable from remote network packets without prior local BPF program installation.\nAC:L - An attacker can craft BPF bytecode/attachments that exercise unsigned kfunc arguments or trampoline return values, and there is no race or external timing condition required. The bug is a deterministic ABI/JIT miscompilation on affected s390 systems.\nPR:L - Loading kfunc/tracing BPF normally requires BPF-related capabilities, but BPF token delegation can evaluate these in a non-init user namespace in delegated/containerized deployments. Following the higher-severity rule, this is scored as low privileges rather than requiring real init-namespace root.\nUI:N - No victim action is needed after the attacker can issue the relevant bpf() syscalls. The attacker loads/attaches and triggers the affected BPF program path directly.\nS:U - The vulnerability affects kernel execution in the same security authority as the vulnerable component. It is a local kernel compromise/DoS style issue, not a VM escape or separate security-scope boundary bypass.\nC:H - The missing zero-extension lets attacker-controlled high bits cross the verifier/native ABI boundary for kfunc calls and trampoline returns. This can plausibly turn verifier-assumed bounded values into unsafe kernel values, matching prior BPF JIT verifier-bypass classes with kernel memory disclosure potential.\nI:H - Incorrect unsigned argument or return extension can corrupt kernel control/data flow through kfuncs or BPF modify-return trampolines. Under the required higher-severity assumption, this is treated as exploitable for kernel memory modification or privilege escalation.\nA:H - At minimum, passing ABI-invalid kfunc arguments or malformed trampoline return values can trigger kernel oops/panic paths, as similar BPF JIT argument-extension bugs have done. The attacker can repeatedly load/trigger the crafted BPF program."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53110","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53260","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable TCP request-socket path is reached by unauthenticated IPv4 or IPv6 SYN packets delivered to a listening socket over the network. This occurs before any application-level authentication.\nAC:L - Although the bug is a PREEMPT_RT timing race, an attacker can repeatedly create request sockets and timer/drop races by driving TCP connection attempts; under the required higher-severity rule this is treated as attacker-controllable rather than an uncontrollable environmental condition.\nPR:N - No credentials, capabilities, or prior authentication are required to send SYN packets to an exposed TCP listener and reach `tcp_conn_request()` and `reqsk_queue_hash_req()`. The path is in the generic TCP receive stack.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform an interactive action. Network traffic alone can exercise the vulnerable path on an affected listening service.\nS:U - The impact is within the kernel/network stack security authority on the same host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The failure is explicitly reported as a refcount underflow/use-after-free in a kernel heap object. Per the required guidance, UAF-class lifetime corruption is scored as high confidentiality impact because it can potentially be shaped into memory disclosure.\nI:H - The corrupted request-socket lifetime can leave stale kernel objects reachable through ehash/timer paths. Per the required guidance, UAF-class kernel memory corruption is scored as high integrity impact because it may be exploitable for write or control-flow manipulation.\nA:H - The observed failure triggers a kernel refcount warning with use-after-free semantics in timer context and can destabilize networking or the kernel. Kernel warnings/oopses, hangs, or UAF-triggered crashes are high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53260","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53264","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local rtnetlink `RTM_NEWTFILTER`/`RTM_DELTFILTER` traffic-control netlink messages, not by remote packet input.\nAC:L - The race is attacker-controlled because the same local actor can issue concurrent filter creation and deletion operations against the same action index. No external victim timing or rare environmental condition is required.\nPR:L - The operations require `CAP_NET_ADMIN` for non-GET rtnetlink messages, but traffic control is reachable with `CAP_NET_ADMIN` inside a user-created network namespace. Under the provided kernel guidance, this is Low privileges rather than High.\nUI:N - No victim interaction is needed; exploitation consists of the attacker sending crafted concurrent rtnetlink requests.\nS:U - The impact is within the kernel security authority and is a standard local kernel memory-corruption/privilege-escalation class issue. It does not cross a VM, IOMMU, or separate authorization scope boundary.\nC:H - The bug is a use-after-free of a `tc_action` object during action lookup/refcounting. A kernel heap UAF can be shaped into disclosure primitives, so confidentiality impact is High.\nI:H - The stale freed action pointer can be reused after heap reallocation and then modified/dereferenced through refcount, bind count, ops, and action lifecycle fields. This is memory corruption that can plausibly support arbitrary write or code execution, so integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or mutate freed/reused kernel memory and can crash or oops the kernel. Availability impact is therefore High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53366","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached while a local process constructs outgoing IPv4 UDP/raw/ping datagrams through sendmsg/splice/sendfile-style socket paths. I did not find a defensible received-packet or unauthenticated remote path that supplies the required cork/MSG_MORE-style fraggap conditions.\nAC:L - The attacker can choose UDP socket options/flags, payload sizes, corking/MSG_MORE behavior, and splice/zerocopy-style paged sends to reach the fraggap paged-allocation path. There is no race or external timing condition required.\nPR:L - A normal unprivileged local user can create IPv4 UDP sockets and use UDP_CORK/MSG_MORE/splice or related paged send paths; raw sockets are CAP_NET_RAW-gated but are not needed for the strongest local trigger. This is therefore basic local user privilege, not real administrator privilege.\nUI:N - No victim interaction is required once the attacker can run the local send/splice sequence. The vulnerable skb construction happens synchronously in the attacker-driven socket send path.\nS:U - The impact is within the same kernel security authority as the vulnerable IPv4 networking code. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug under-allocates/accounting for the linear skb area and can copy attacker-controlled fraggap bytes past skb->end into trailing skb_shared_info metadata. Kernel memory corruption of this kind is reasonably capable of being developed into information disclosure, so the higher severity confidentiality value is appropriate.\nI:H - The copied fraggap bytes corrupt kernel skb metadata past the intended buffer boundary. This is an out-of-bounds write in kernel heap/networking structures and is scored as high integrity impact.\nA:H - The corrupted skb metadata can crash or destabilize the kernel networking stack, and related negative-copy accounting can also produce severe send-path failure behavior. Kernel crash or oops potential is high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53366","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53381","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local VFS operations (open/write/close) on a virtiofs mount with FUSE submounts; exploitation is in the guest FUSE client during file release and submount umount, not via remote network packets.\nAC:L - This is a use-after-free where the attacker controls file close (async FUSE RELEASE) and can drive or coincide with submount umount; Kata Containers reproduces it reliably with virtiofsd --announce-submounts (default).\nPR:L - An unprivileged local process with access to the virtiofs mount can trigger it; virtiofs defaults to allow_other and normal POSIX permissions, and no real root or init-namespace capabilities are required.\nUI:N - Exploitation needs no victim interaction beyond the attacker (or their container workload) performing normal filesystem I/O while submount teardown occurs during pod/container lifecycle.\nS:U - Impact stays within the guest kernel security boundary (crash or guest kernel compromise); it does not by itself cross a VM/host or IOMMU boundary.\nC:H - The flaw is a use-after-free in fuse_release_end() calling iput() on an inode after its superblock is destroyed, which can be turned into arbitrary kernel memory read via heap manipulation.\nI:H - Use-after-free on a struct inode in the kernel heap provides a standard path to controlled memory corruption, heap spraying, and arbitrary write or code execution in kernel context.\nA:H - Confirmed kernel general protection fault/oops in iput() from fuse_release_end during virtio_fs request completion, and UAF bugs inherently threaten kernel stability even without full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53381","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63801","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached from the TIPC packet receive path (UDP bearer on port 6118 or L2 bearer) when encrypted frames arrive from a remote peer; no local syscall is required to enter tipc_aead_decrypt().\nAC:L - The attacker can reliably win the race by flooding packets to queue async decrypt completions while repeatedly destroying the network namespace; the repro demonstrates full control of both sides of the timing window.\nPR:L - Reliable exploitation is demonstrated via unshare-created user/network namespaces where the attacker gains CAP_NET_ADMIN-equivalent control to configure TIPC crypto and cycle namespace teardown, which per kernel CNA guidance maps to Low rather than High.\nUI:N - Exploitation requires only sending network packets and namespace lifecycle manipulation; no victim user action such as opening a file or mounting a filesystem is needed.\nS:U - Impact is confined to kernel memory within the same security authority; this is a standard kernel UAF/privilege-escalation class bug, not a VM escape or cross-authority boundary bypass.\nC:H - The UAF reads freed slab memory including aead->crypto->stats, aead->crypto->net, and aead[] pointers in tipc_crypto_rcv_complete, enabling arbitrary kernel memory disclosure via controlled reuse of the freed tipc_crypto object.\nI:H - Use-after-free of tipc_crypto structures can be leveraged for heap spraying and arbitrary write primitives, and tipc_crypto_rcv_complete continues processing with freed pointers including key attachment and node table operations.\nA:H - KASAN confirmed slab-use-after-free in tipc_aead_decrypt_done on a workqueue thread; UAF on this path causes kernel oops/panic even when not fully exploited for code execution."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63801","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63823","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local `request_key()` and `keyctl()` syscalls (`KEYCTL_ASSUME_AUTHORITY`, `KEYCTL_INSTANTIATE`, `KEYCTL_INSTANTIATE_IOV`, `KEYCTL_REJECT`); there is no network, adjacent-radio, or physical-device entry path.\nAC:L - Exploitation is a race the attacker orchestrates by calling `request_key()` and concurrently driving `KEYCTL_INSTANTIATE_IOV` with a user buffer that page-faults during `copy_from_iter_full()`, while a second helper thread or completion path revokes/frees the auth payload.\nPR:L - Any unprivileged local user can invoke `request_key()` and the affected `keyctl` instantiate/reject operations in the spawned helper context; no real-root or non-userns capability is required.\nUI:N - Exploitation does not depend on a victim performing an action beyond the attacker’s own syscall activity and helper process setup.\nS:U - Impact is kernel memory corruption and local privilege escalation within the same kernel security domain, not a VM-guest-to-host or IOMMU boundary escape.\nC:H - This is a heap use-after-free of `struct request_key_auth`; after free the code dereferences `rka->target_key` and related fields, enabling attacker-controlled reuse and arbitrary kernel memory disclosure.\nI:H - The UAF corrupts trusted kernel pointers (`target_key`, `dest_keyring`) used in `key_instantiate_and_link()`, which can be turned into arbitrary kernel writes and local privilege escalation.\nA:H - Use-after-free of kernel heap objects can cause kernel oops/panic during post-fault dereferences, and is independently severe even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63823","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63879","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local AMDGPU DRM ioctls (e.g., AMDGPU_GEM_USERPTR, AMDGPU_CS) and KFD ioctls on /dev/kfd that call amdgpu_hmm_range_get_pages(); there is no network-facing entry point.\nAC:L - Exploitation requires a >2GB userptr/SVM mapping and a concurrent munmap/remap during the multi-chunk HMM walk, but the attacker controls both the ioctl thread and the address-space manipulation, so the race is attacker-driven rather than dependent on uncontrollable conditions.\nPR:L - Any unprivileged local user with access to the AMDGPU render node or /dev/kfd (typically render/video group membership) can create large userptr buffers and submit GPU work that triggers the vulnerable HMM path; root or init-namespace capabilities are not required.\nUI:N - Exploitation is fully attacker-driven through GPU memory registration and command submission ioctls and does not require any action from another user or administrator.\nS:U - The flaw corrupts or misuses kernel-tracked page metadata and enables standard local kernel memory safety impact and privilege escalation within the same kernel security domain, not a VM escape or IOMMU boundary bypass.\nC:H - Re-reading the MMU notifier sequence per 2GB chunk lets later validation pass while earlier PFNs may reference unmapped or freed pages, giving the GPU (and kernel DMA helpers) a stale-page/use-after-free primitive that can disclose arbitrary physical memory contents.\nI:H - Stale PFNs from invalidated mappings can be DMA-mapped and written by GPU operations, enabling arbitrary memory corruption and potential control-flow hijacking via repurposed physical pages rather than a bounded or crash-only effect.\nA:H - Operating on invalid struct page pointers during pinning/DMA mapping can trigger kernel oopses or panics, and the underlying use-after-free class of bug inherently threatens system availability even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63879","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63881","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local `ioctl()` on `/dev/kfd` via `AMDKFD_IOC_DBG_TRAP` with `KFD_IOC_DBG_TRAP_SUSPEND_QUEUES` or `KFD_IOC_DBG_TRAP_RESUME_QUEUES`; there is no network, adjacent-radio, or physical-access path to the vulnerable code.\nAC:L - On affected 32-bit `size_t` kernel builds, an attacker fully controls `num_queues` in the ioctl and can reliably force the multiply overflow (e.g. `num_queues >= 0x40000001`) to trigger undersized `memdup_user()` followed by unbounded kernel heap corruption.\nPR:L - A local unprivileged user with AMDGPU/KFD device access can open `/dev/kfd`, enable the debug runtime and debug trap on their own process (no ptrace or root required), then invoke suspend/resume with a malicious `num_queues` value.\nUI:N - Exploitation is achieved entirely through attacker-initiated ioctl calls in an established KFD debug session; no victim interaction is required.\nS:U - Impact is kernel heap corruption and potential local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - The integer overflow causes a heap buffer far smaller than `num_queues`, and subsequent `q_array_get_index()`/`copy_to_user()` operations perform out-of-bounds kernel reads that can disclose adjacent heap memory and be leveraged for arbitrary read primitives.\nI:H - `q_array_invalidate()` and per-queue status updates write attacker-influenced values (`KFD_DBG_QUEUE_INVALID_MASK`/`KFD_DBG_QUEUE_ERROR_MASK`) far beyond the allocated buffer, constituting an out-of-bounds heap write exploitable for control-flow hijacking and arbitrary kernel modification.\nA:H - Writing billions of 32-bit values past a 4-byte kmalloc object corrupts adjacent kernel heap metadata and objects, readily causing kernel oops/panic and complete loss of availability even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63881","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63886","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered by a remote iSCSI initiator sending crafted CHAP login PDUs over TCP to the in-kernel LIO iSCSI target during the network login/authentication handshake.\nAC:L - Once an iSCSI target with CHAP is reachable, an attacker can reliably trigger the overflow by sending CHAP_R with a 0b-prefixed base64 string up to 127 characters; no race or special memory layout is required.\nPR:N - The heap overflow occurs during the CHAP authentication handshake before the password hash comparison succeeds, so exploitation is reachable by an unauthenticated remote network attacker who knows a configured CHAP username.\nUI:N - Exploitation requires only the attacker initiating an iSCSI login connection and sending malicious CHAP PDUs; no action from a victim user is needed.\nS:U - Successful exploitation corrupts kernel heap memory within the same kernel security boundary, enabling denial of service or kernel privilege escalation, not a cross-boundary escape such as VM guest-to-host.\nC:H - The out-of-bounds heap write corrupts adjacent kmalloc objects and can be leveraged for arbitrary kernel memory disclosure through heap grooming, consistent with heap overflow impact guidance.\nI:H - A controlled kernel heap out-of-bounds write of up to 79 bytes past a digest-sized buffer can corrupt adjacent structures and be developed into arbitrary code execution or kernel privilege escalation.\nA:H - The overflow causes slab-out-of-bounds writes confirmed by KASAN and can crash or destabilize the kernel during login processing, constituting high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63886","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63887","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The Linux iSCSI target (LIO) is an in-kernel SCSI target that accepts remote TCP connections on the iSCSI portal (typically port 3260); crafted Login PDUs reach the vulnerable encoder via the normal network receive and login-negotiation path.\nAC:L - Once an iSCSI target portal is reachable, an attacker can reliably trigger the overflow by sending a single Login PDU packed with unknown key=value pairs; no races or victim-dependent timing are required.\nPR:N - The heap overflow occurs during login negotiation before iSCSI authentication completes; a discovery-session login requires only InitiatorName and SessionType with no credentials, initiator ACL, or local privileges.\nUI:N - Exploitation requires only network packets sent by the attacker; no action from a legitimate user or administrator is needed beyond the target already exposing its iSCSI portal.\nS:U - The corruption is confined to kernel heap memory in the iSCSI target/login context and does not cross a VM, container, or IOMMU security boundary by itself.\nC:H - A ~24 KiB out-of-bounds write into the kmalloc-8k slab can corrupt adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - The unbounded sprintf heap overrun is a large out-of-bounds write that can corrupt adjacent heap metadata or objects to achieve arbitrary kernel memory modification and potential code execution.\nA:H - Corrupting kmalloc-8k heap objects during login response encoding can cause kernel oops, BUG, or panic, and the attack can be repeated against an exposed iSCSI target."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63887","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63888","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the in-kernel LIO iSCSI target, reachable by sending iSCSI Text PDUs over TCP after connection setup on the network-facing iSCSI portal (typically port 3260), analogous to nfsd/ksmbd network exposure.\nAC:L - An attacker fully controls login parameter negotiation (DataDigest=CRC32C) and subsequent Text PDU content; the CRC overread fires deterministically on every qualifying Text PDU, and the double-free is reliably triggered by sending a bad DataDigest followed by another Text PDU on the same ITT when ERL>0.\nPR:N - No Linux OS privileges are required; the default discovery session permits unauthenticated login (AuthMethod=None, authentication disabled), after which SendTargets Text requests reach the vulnerable handler without any credentials.\nUI:N - Exploitation requires only crafted iSCSI protocol traffic from the attacker; no victim user action such as mounting a filesystem or clicking a link is needed.\nS:U - The vulnerability corrupts kernel heap memory within the iSCSI target subsystem on the host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The CRC path performs a slab out-of-bounds read past the text_in allocation, and the double-free is a use-after-free class bug that reads freed heap metadata; per kernel guidance both OOB reads and UAFs warrant High confidentiality impact.\nI:H - The double-free corrupts the slab freelist (triggering CONFIG_SLAB_FREELIST_HARDENED BUG() on hardened kernels), providing a classic heap corruption primitive that can be leveraged for arbitrary kernel memory writes and code execution.\nA:H - The double-free provably crashes the kernel (KASAN splat or SLAB_FREELIST_HARDENED BUG()), and the heap corruption can cause kernel panics; any UAF is scored as High availability impact per kernel guidance."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63888","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63920","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (nftables netlink to install a payload-set rule, setsockopt for IPV6_RECV* options, and recvmsg). Although the trigger packet is received over IPv6, the mandatory nftables corruption step is classified as Local per kernel guidance.\nAC:L - The attacker fully controls the nftables payload-set rule, the on-wire extension header, socket receive options, and the recvmsg call, making the slab out-of-bounds read reliably reproducible without races or external conditions.\nPR:L - An unprivileged local user can create a user+network namespace, obtain CAP_NET_ADMIN there, configure nftables, open a UDPv6/raw socket with extension-header cmsg options, and trigger the bug without real root in the initial namespace.\nUI:N - No victim interaction is required; the attacker can send the crafted IPv6 datagram and call recvmsg on their own socket to trigger the out-of-bounds read.\nS:U - Impact is confined to kernel memory disclosure and potential kernel instability within the same kernel security domain; it does not cross a VM/host or IOMMU boundary.\nC:H - put_cmsg() can copy up to 2040 bytes past the actual extension header into userspace ancillary data, leaking adjacent slab/kernel memory (confirmed by KASAN slab-out-of-bounds in put_cmsg).\nI:N - The bug is an out-of-bounds read that copies kernel data to userspace; it does not modify kernel memory, corrupt control structures, or provide a write primitive.\nA:H - The out-of-bounds slab read can provoke a KASAN fault/kernel oops during put_cmsg(), and repeated triggering can deny availability of the affected system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63920","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63944","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the Bluetooth HCI ISO/CIS path (`hci_le_create_cis_sync`), reachable only via the Bluetooth radio interface. Per kernel CVSS guidance, Bluetooth vulnerabilities are scored as Adjacent, including on phones and LE Audio devices in public spaces.\nAC:L - The UAF is a race between `hci_le_create_cis_sync` dropping locks and a concurrent `hci_conn_del`. An attacker who controls one side of the CIS setup (local ISO socket threads or a remote peer timing ACL/CIS teardown) can repeatedly trigger the race; success does not depend on uncontrollable conditions like kernel memory layout.\nPR:N - No local Unix privileges are required for the highest-impact scenario: a remote Bluetooth peer in range can provoke CIS teardown/disconnect events while the victim host is performing normal LE Audio CIS establishment (e.g., phone connecting to earbuds). Local exploitation via ISO sockets also requires no special capabilities at the kernel level.\nUI:N - Both sides of the race run inside the kernel's own HCI event handling: hci_le_create_cis_pending() queues the vulnerable work from hci_le_cis_established_evt(), hci_cs_le_create_cis(), hci_unbound_cis_failed() and iso_connect_cfm(), all driven by controller events and remote peer traffic, while the freeing side is a peer-initiated disconnect reaching hci_conn_del(). On an LE Audio host the CIS establishment happens by itself when the earbuds connect and the attacker supplies the disconnect, so nothing is asked of the person holding the device; the existing pairing is a precondition of the deployment, not an in-attack user step.\nS:U - Impact is confined to kernel memory corruption within the Bluetooth subsystem on the host; this is standard kernel compromise, not a cross-boundary escape (KVM guest-to-host, IOMMU bypass, or sandbox breakout).\nC:H - This is a slab use-after-free read of `conn->conn_timeout` on a freed `hci_conn` (kmalloc-8k object). UAF reads against attacker-influencable freed objects can disclose kernel heap contents and are scored as High per kernel CVSS guidance.\nI:H - Although the immediate bug is a post-unlock dereference of a freed `hci_conn`, UAF on large `hci_conn` kmalloc objects enables heap grooming and control of freed memory contents, which can be chained into arbitrary kernel writes or code execution; UAF class bugs are scored I:H.\nA:H - Use-after-free access to a freed connection object can cause kernel oops/panic (as demonstrated by the same bug class in the related `le_read_features_complete` fix found by syzkaller). Even without full exploitation, triggering the UAF reliably causes High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63944","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63970","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local AF_VSOCK transmission (syscall/io_uring send on a connected virtio vsock socket), not by processing remote network packets. Per kernel CVSS guidance, vsock is Local.\nAC:L - An attacker fully controls the trigger: SO_ZEROCOPY, io_uring IORING_OP_SEND_ZC with IORING_RECVSEND_FIXED_BUF and a vectored iov exceeding MAX_SKB_FRAGS (17), causing io_sg_from_iter() to return -EMSGSIZE on a deterministic error rollback path.\nPR:L - Exploitation requires only an unprivileged local process that can open a vsock connection and use io_uring zerocopy send; no CAP_NET_ADMIN or real root is needed beyond ordinary local user access in a virtio-vsock environment (KVM/Firecracker/cloud microVMs).\nUI:N - No victim interaction is required; the attacker triggers the bug directly through their own socket send/io_uring operation.\nS:U - Impact is kernel memory corruption and privilege escalation within the same security domain where the send occurs (guest kernel or host kernel). It is not a cross-boundary VM escape on the receive path; the flaw is in the sender's local skb teardown.\nC:H - Incorrect __skb_frag_unref() on SKBFL_MANAGED_FRAG_REFS pages without a bound uarg corrupts refcount/lifetime of io_uring registered buffer pages, yielding use-after-free and arbitrary kernel memory read primitives.\nI:H - The refcount corruption is a memory-safety bug in kernel heap/page management that can be leveraged for arbitrary write and control-flow hijacking, not merely a bounded data change.\nA:H - The erroneous frag unref on managed zerocopy pages can cause immediate kernel oops/panic from refcount underflow or use-after-free during skb teardown, independent of full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63970","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63992","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code runs on the VXLAN/GENEVE transmit path when processing remotely received UDP-encapsulated tunnel traffic (or L2 frames forwarded through a bridge port), which is reachable by sending crafted packets over the network to the victim VTEP.\nAC:L - The attacker fully controls the inner IPv4 header fields (DF bit, length, addresses) and can reliably craft oversized packets that exceed the tunnel-adjusted PMTU on bridge-port tunnel devices without depending on race timing or uncontrollable system state.\nPR:N - Exploitation requires only the ability to send network packets to a host with VXLAN/GENEVE bridged; no local account, authentication, or capabilities on the victim are needed.\nUI:N - No victim user action is required; the kernel processes attacker-supplied packets automatically through the tunnel receive, bridge forward, and re-encapsulation path.\nS:U - The out-of-bounds read and resulting kernel oops occur within the kernel network stack on the same host; there is no crossing of a VM, container, or IOMMU security boundary beyond standard kernel memory safety failure.\nC:H - Reading through `icmp_hdr(skb)` when `transport_header` is unset causes an out-of-bounds read at `skb->head + 65535`, potentially disclosing adjacent kernel memory beyond the skb buffer before any bounds checking occurs.\nI:N - The flaw is an out-of-bounds read of the ICMP type field; it does not directly modify or write kernel memory, though it may cause a kernel fault.\nA:H - The invalid pointer dereference at offset 65535 can trigger a kernel oops or panic when accessing unmapped memory, causing denial of service on the affected host."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63992","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64000","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached when the kernel processes received Ethernet frames via the netdev RX handler in net/hsr, and a remote attacker on the HSR/PRP ring can deliver a crafted supervision frame without any local access to the victim host.\nAC:L - The attacker fully controls the malformed frame content and length; a precisely truncated supervision frame reliably passes existing TLV validation and triggers the out-of-bounds read with no races or attacker-uncontrollable conditions.\nPR:N - Exploitation requires only the ability to inject L2 HSR/PRP supervision frames onto the ring segment; no local account, capabilities, or authentication on the target kernel is needed.\nUI:N - No victim user action is required beyond normal operation of an HSR/PRP-configured node; the attacker triggers the bug solely by sending a malicious frame.\nS:U - Impact is confined to kernel memory safety within the same security authority; there is no VM escape, IOMMU bypass, or cross-security-boundary scope change.\nC:H - The bug is an out-of-bounds read of supervision TLV header fields past the skb tail, which can disclose adjacent kernel heap/skb memory and is not strictly bounded to a few attacker-uncontrolled bytes.\nI:H - Out-of-bounds access in kernel packet parsing can supply attacker-influenced TLV type/length values that drive further skb_pull arithmetic and extended parsing, creating a plausible path to memory corruption and control-flow hijacking.\nA:H - Reading beyond the skb buffer boundary during softirq packet processing can cause a kernel oops/panic, and the attacker can repeatedly trigger the condition with crafted frames."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64000","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64002","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls—network namespace teardown via unshare/setns/put_net, sysctl access to /proc/sys/net/ipv4/ip_local_reserved_ports, and/or local socket bind/connect—not remote packet delivery.\nAC:L - The attacker can control both sides of the race by concurrently tearing down a network namespace while hammering the sysctl or triggering socket port selection in that namespace.\nPR:L - An unprivileged local user can reach this via user namespaces (CAP_SYS_ADMIN within the user_ns for CLONE_NEWNET) and world-writable sysctl access (mode 0644) during namespace destruction.\nUI:N - No victim interaction is required beyond the attacker's own concurrent namespace teardown and sysctl or socket activity.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it is standard local kernel memory corruption, not a VM/hypervisor boundary escape.\nC:H - Freed 8 KiB bitmap memory remains reachable via sysctl reads (find_next_bit) and inet_is_local_reserved_port() (test_bit), enabling heap information disclosure through a use-after-free.\nI:H - Sysctl writes via proc_do_large_bitmap perform bitmap_copy/bitmap_or into the freed allocation, providing a heap write primitive exploitable for control-flow hijacking.\nA:H - Concurrent access to the freed bitmap can cause kernel oops/panic from invalid memory access, and UAF exploitation inherently threatens kernel availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64002","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64007","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered when remote TCP packets traverse SYNPROXY netfilter hooks (NF_INET_LOCAL_IN / NF_INET_POST_ROUTING) on a host with SYNPROXY configured, which is the standard internet-facing firewall/router deployment for this subsystem.\nAC:L - An attacker who controls a TCP session through SYNPROXY can reliably send timestamp-bearing packets to hit the vulnerable path; the stale-pointer UAF write occurs whenever skb_ensure_writable() must expand a cloned skb, which the attacker can influence by sustaining traffic on the proxied connection.\nPR:N - Exploitation requires only that the victim already runs SYNPROXY (normal for protected services); the remote attacker needs no credentials or local privileges on the target system to send the triggering TCP packets.\nUI:N - No victim user action is required beyond normal network operation; exploitation is fully automated via crafted or sustained TCP traffic through the SYNPROXY session.\nS:U - Impact is confined to kernel memory on the affected host running SYNPROXY; this is standard kernel privilege escalation/memory corruption, not a cross-VM or cross-security-boundary escape.\nC:H - The stale tcphdr pointer causes inet_proto_csum_replace4() to write into freed slab memory, a use-after-free class bug that can be leveraged for arbitrary kernel memory read via heap grooming techniques.\nI:H - The out-of-bounds write into freed slab memory via a stale tcphdr pointer is a use-after-free write primitive that can be developed into arbitrary kernel memory writes and local privilege escalation.\nA:H - Writing into freed slab memory can corrupt adjacent kernel objects and cause kernel oops, panic, or crash, and UAF conditions are inherently capable of destabilizing the system even during exploitation attempts."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64007","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64015","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through find_key_to_update() on the persistent keyring register, which is invoked from keyctl_get_persistent() via the keyctl(2) syscall. There is no network, adjacent-radio, or physical-device path to this code.\nAC:L - Exploitation is a race between assoc_array_find() and assoc_array_gc() on the .persistent_register keyring; the attacker controls both sides by repeatedly calling KEYCTL_GET_PERSISTENT (including from multiple threads) while driving key expiry/GC via keyctl timeouts or natural garbage collection. Per kernel guidance, attacker-controlled races are AC:L.\nPR:L - Any unprivileged local user who can invoke keyctl() can call KEYCTL_GET_PERSISTENT for their own UID (-1) with a writable destination keyring (e.g., session keyring). No real-root or CAP_SETUID capability is required for the vulnerable lookup path; this remains PR:L even inside user namespaces.\nUI:N - Exploitation requires only the attacker's own keyctl syscalls and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary on its own.\nC:H - assoc_array_find() is documented to require an RCU read lock, but the persistent-keyring path called it without one while assoc_array_gc() frees tree nodes via call_rcu(), yielding a use-after-free on assoc_array nodes/leaves. UAF on kernel heap objects can be turned into arbitrary kernel memory reads.\nI:H - The freed assoc_array nodes can be reallocated and corrupted through concurrent GC versus lookup, providing a standard kernel heap UAF primitive that can be developed into arbitrary write or code-execution primitives.\nA:H - Dereferencing RCU-freed assoc_array tree nodes during lookup can cause kernel oops/panic from invalid pointer access, and UAF exploitation commonly destabilizes or crashes the kernel even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64015","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64018","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached via MSI-driven hardware completion processing in the MANA HWC control path (not netdev packet receive), triggered when the Azure hypervisor/host tampers with guest-visible DMA-coherent WQE memory on the same physical compute node.\nAC:L - A malicious host or NIC firmware that can modify shared unencrypted DMA buffers controls both the forged sge->address and the timing of HWC RX completions, allowing reliable out-of-bounds indexing without winning a race or depending on guest state.\nPR:N - Exploitation requires no privileges on the victim guest VM; the attacker operates from the Azure hypervisor/host side by modifying DMA-coherent memory that the guest kernel trusts during HWC response handling.\nUI:N - No victim user action is required; exploitation occurs automatically when the driver processes a hardware completion event on the HWC receive queue.\nS:C - In Confidential VMs the guest relies on host isolation guarantees, but shared unencrypted DMA memory lets a hostile hypervisor cross that CVM security boundary to corrupt guest kernel memory and confidentiality.\nC:H - An out-of-bounds rx_req_idx yields a corrupted hwc_work_request whose buf_va is dereferenced and copied via memcpy in mana_hwc_handle_resp(), enabling arbitrary kernel memory disclosure.\nI:H - The out-of-bounds hwc_work_request supplies attacker-controlled pointers and SGE fields used to repost RX WQEs via mana_hwc_post_rx_wqe(), enabling kernel heap corruption and exploitable memory writes.\nA:H - Indexing reqs[] out of bounds with attacker-controlled values can dereference invalid kernel pointers and corrupt adjacent heap objects, causing kernel oops/panic and denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64018","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64029","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access via the ALSA sequencer device node (/dev/snd/seq) using write(2) and port-subscription ioctls; there is no network, Bluetooth, or physical-device attack surface on the vulnerable code path.\nAC:L - The race is between concurrent UMP event delivery and the last output-port unsubscribe/close path, and a local attacker can control both sides with parallel threads (flood write() while repeatedly subscribing/unsubscribing to the UMP port).\nPR:L - Any local unprivileged user who can open /dev/snd/seq (typically membership in the audio group on desktop/workstation systems where UMP MIDI hardware is present) can create sequencer clients, subscribe to UMP kernel ports, and trigger the bug without real root or init-namespace capabilities.\nUI:N - Exploitation is fully attacker-driven through sequencer writes and subscription management; no victim interaction such as opening files, mounting filesystems, or plugging in devices is required beyond the UMP endpoint already being present on the system.\nS:U - Impact is confined to kernel memory corruption and potential local privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary bypass.\nC:H - KASAN confirmed a slab use-after-free on freed substream runtime metadata in snd_rawmidi_kernel_write1(); UAF on kernel heap objects enables controlled reallocation and arbitrary kernel memory disclosure primitives.\nI:H - The UAF occurs inside snd_rawmidi_kernel_write1(), which performs memcpy() into runtime->buffer using attacker-supplied UMP event payload, providing a plausible path to arbitrary kernel memory corruption and code execution beyond a simple crash.\nA:H - The confirmed KASAN slab-use-after-free in kernel write path causes kernel oops/panic; even without full exploitation, the bug reliably threatens system availability through kernel crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64029","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64034","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a malicious hypervisor or host that can modify MANA HWC DMA-coherent response buffers between guest kernel loads; it is not reachable by sending network packets to the guest's data path.\nAC:L - The attacker controlling the hypervisor fully controls DMA buffer contents and can reliably flip hwc_msg_id between the validation read and the use in mana_hwc_handle_resp() on uncacheable coherent memory.\nPR:N - The attacking hypervisor needs no guest OS credentials or capabilities; exploitation targets the guest kernel through the virtual device DMA path while the MANA driver is active.\nUI:N - No victim user action is required beyond normal Azure VM operation with the MANA driver loaded and HWC receive buffers posted.\nS:C - The vulnerability crosses the VM/DMA security boundary by allowing a hostile hypervisor to corrupt guest kernel memory that the confidential-guest threat model assumes is protected from host tampering.\nC:H - Out-of-bounds indexing via bypassed hwc_msg_id validation enables reading adjacent kernel heap objects through misdirected caller_ctx access and test_bit() on the inflight bitmap.\nI:H - Host-controlled response data is copied with memcpy() to an out-of-bounds output_buf pointer, enabling arbitrary kernel memory corruption and potential control-flow hijacking.\nA:H - Out-of-bounds caller_ctx access and corrupted completion signaling can cause kernel oops, panic, or hang during HWC response handling."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64034","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64048","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The fault is triggered while processing a malicious CLC ACCEPT message received from a remote TCP peer during the SMC-D handshake; the attacker controls the server response over the network.\nAC:L - Once a victim with SMC-Dv2 hardware initiates an SMC connection, a malicious peer can reliably send `d1.chid == 0` in the CLC ACCEPT to match the empty reserved slot 0 without races or special timing.\nPR:N - No local privileges are required on the victim host; an unauthenticated remote attacker operating a malicious SMC server can crash connecting clients, and unprivileged users can create SMC sockets without capability checks.\nUI:N - Exploitation requires only that a victim application initiate a normal outbound SMC connection to the attacker's server, which occurs automatically in enterprise middleware without per-connection user action.\nS:U - The vulnerability causes a kernel crash on the victim host but does not cross a security boundary such as VM escape or sandbox breakout.\nC:N - The bug is a null pointer dereference when taking `ism_dev[0]->lgr_lock`; it causes an immediate kernel fault with no information disclosure.\nI:N - The attempted write at address 0x68 is a spinlock operation on a NULL `smcd_dev` pointer, not a controlled or arbitrary memory modification primitive.\nA:H - A successful trigger causes a kernel null pointer dereference (KASAN-reported oops/panic), crashing the affected system or at minimum the connecting process's kernel context."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64048","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64098","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through local DRM ioctl syscalls (DRM_IOCTL_MODE_CURSOR and DRM_MASTER modesetting ioctls) on /dev/dri/card0, not via any network-facing kernel service.\nAC:L - An attacker can reliably trigger the bug by signaling a thread blocked in dma_resv_lock_interruptible (-EINTR), forcing memory pressure for -ENOMEM, or running concurrent plane updates to race the unlocked fence-list mutation.\nPR:L - Exploitation requires DRM master on the virtio-gpu device, which a local user with standard DRI access (video/render group membership on typical virtio-gpu VMs) can obtain when no compositor holds master; this is not init-namespace root.\nUI:N - Triggering the bug requires only attacker-initiated DRM ioctl calls (cursor/plane updates); no action by another user or victim is needed.\nS:U - The corruption occurs within the same kernel security domain (guest or host) that issued the ioctl; virtio-gpu runs in the guest kernel and this does not cross a VM/hypervisor boundary to the host.\nC:H - Mutating the dma_resv fence list without holding the lock races with concurrent readers and can corrupt kernel heap metadata, which is reasonably leverageable for arbitrary memory disclosure.\nI:H - The same unlocked fence-list corruption can corrupt kernel pointers and synchronization state, providing a plausible path to arbitrary kernel writes or control-flow hijacking.\nA:H - The bug produces kernel WARN/oops under lockdep and fence-list corruption can cause kernel crashes, hangs, or panics during subsequent dma_resv operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64098","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64109","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local syscalls on AF_UNIX SOCK_STREAM sockets (recvmsg, splice_read, setsockopt SO_PEEK_OFF), not via any network protocol handler.\nAC:L - The attacker controls both racing threads on the same socket fd and can retry the peek/normal-recv interleaving; this is a self-induced race, not one dependent on uncontrollable kernel state.\nPR:L - Any unprivileged local user can create AF_UNIX socketpairs, set SO_PEEK_OFF, and run concurrent recv operations without capabilities, including from within user namespaces.\nUI:N - Exploitation requires no victim interaction; the attacker sets up and races their own socket endpoints programmatically.\nS:C - Successful kernel heap UAF exploitation from an unprivileged container, Android app sandbox, or user-namespace tenant crosses the sandbox boundary to compromise the host kernel.\nC:H - This is a slab use-after-free read of sk_buff->len on freed memory, which per UAF guidance enables arbitrary kernel memory disclosure and heap layout leaks.\nI:H - UAF on sk_buff objects in the kernel heap can be leveraged through heap grooming and spraying to obtain arbitrary write and kernel code execution primitives.\nA:H - The UAF read can trigger KASAN slab-use-after-free faults, kernel oops, or panic during the dereference, and repeated triggering causes denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64109","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64114","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (socket/sendmsg on a raw IP_HDRINCL socket); malformed packets are injected locally into the output path, not via remote network ingress which validates ihl >= 5.\nAC:L - The attacker fully controls the crafted header ihl value and can install the required xfrm AH policy and route via CAP_NET_ADMIN in their own network namespace, making exploitation reliable without conditions outside attacker control.\nPR:L - Triggering requires CAP_NET_RAW for raw sockets and CAP_NET_ADMIN to install xfrm AH policy, both obtainable by an unprivileged user via user+network namespaces or a container granted NET_ADMIN without init-namespace root.\nUI:N - No victim interaction is required; the attacker sends the malformed packet directly through their own raw socket and configured IPsec policy.\nS:U - Impact is kernel memory corruption and panic within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The integer underflow in ah_output() memcpy length produces an out-of-bounds read of near SIZE_MAX bytes, providing an arbitrary kernel memory read primitive beyond any bounded disclosure.\nI:H - The same memcpy with underflowed length causes a massive out-of-bounds write that can corrupt adjacent kernel heap memory and be leveraged for control-flow hijacking.\nA:H - The OOB memcpy reliably causes a kernel-mode fault and host panic, as reproduced with KASAN and in a rootless Docker container, denying all system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64114","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64115","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local AF_VSOCK syscalls (connect/close) to drive VMCI control packets; per kernel CVSS guidance, vsock is scored Local even when the peer is a VM guest reaching a host listener.\nAC:L - The attacker controls both sides of the handshake race by initiating a connection and aborting it with RST during TCP_SYN_SENT; KASAN testing showed 52/100 repro without conditions outside attacker control.\nPR:L - Any unprivileged local user inside a VM (or on the same host) can open AF_VSOCK sockets and connect to a listening peer without CAP_NET_ADMIN or other elevated privileges.\nUI:N - Exploitation requires only a victim service with a bound/listening vsock socket, which is normal background operation; no interactive victim action is needed.\nS:C - In the most severe reasonable VMware deployment, an unprivileged guest VM triggers kernel memory corruption on the hypervisor host via VMCI vsock, crossing the guest-to-host virtualisation security boundary analogous to KVM/Xen VM escape.\nC:H - The bug is a slab use-after-free on struct sock; UAF on kernel heap objects enables arbitrary memory read primitives through controlled reuse of the freed socket structure.\nI:H - The UAF involves a write to a freed object's refcount field and corrupts kernel heap metadata, providing a foundation for arbitrary write and kernel code execution via heap grooming.\nA:H - The vulnerability reliably triggers kernel UAF detected by KASAN (refcount write to freed memory on a kworker), which causes kernel oops/panic and denial of host availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64115","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64247","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggering requires a Hyper-V TLB-flush hypercall from an L2 vCPU under KVM, ultimately reached through the local KVM_RUN ioctl; no network path reaches it.\nAC:L - A malicious nested-virtualization tenant controls both the unchecked enlightened-VMCS/VMCB VP ID and the sparse-bank hypercall data, with no uncontrollable race required.\nPR:L - The attacker needs control of a KVM guest with nested virtualization, or ordinary /dev/kvm access to create one, but requires neither host root nor an init-namespace capability.\nUI:N - Once the crafted nested guest executes, no action by another user is required.\nS:C - The out-of-bounds access occurs in the host kernel from attacker-controlled guest state, crossing the KVM guest-to-host isolation boundary.\nC:H - The attacker-selected VP ID makes test_bit() query selectable bits far beyond the stack-resident 64-bit mask, and the resulting TLB-flush decision can provide an oracle for host kernel memory.\nI:N - The primitive performs reads only; a set result merely selects a legitimate L2 vCPU for an extra TLB flush, with no out-of-bounds write or unsafe mapping change.\nA:H - The selectable access can reach a VMAP_STACK guard or another unmapped page and oops the host; KASAN already detects the access as an eight-byte invalid read, which can become a host-wide denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64247","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64266","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - A local attacker reaches the flaw by serving a self-created FUSE mount and invoking splice() on its associated /dev/fuse descriptor.\nAC:L - The attacker controls writeback generation, splice processing, and concurrent connection abort, allowing repeated attempts at the race without an uncontrollable prerequisite.\nPR:L - FUSE supports user-namespace mounts, and an unprivileged mount owner can operate /dev/fuse and abort their own connection without init-namespace root.\nUI:N - The attacker can create and exercise their own FUSE connection without any victim action.\nS:U - Exploitation compromises the kernel within the same operating-system security authority and does not inherently cross a virtualization boundary.\nC:H - The freed argument and folio arrays are subsequently dereferenced, permitting attacker-influenced stale folio pointers and potential arbitrary kernel-memory disclosure through pipe buffers.\nI:H - Heap reclamation can replace the freed folio pointers and loop metadata, enabling attacker-directed memory or refcount operations that may support arbitrary writes and kernel code execution.\nA:H - The repeatable use-after-free and invalid folio operations can cause an oops, panic, or other complete system failure."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64266","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64268","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - siw carries iWARP over ordinary routable TCP, and the vulnerable receive callback processes crafted Read Response FPDUs from the remote endpoint of an established RDMA connection.\nAC:L - The peer learns the sink tag, address, and length from the RREAD and can deterministically send oversized continuation segments; no race or uncontrollable condition is required.\nPR:N - The MPA/siw data path performs no credential or capability check on the connected peer, and an unauthenticated RDMA service can accept the connection and issue attacker-induced RREADs.\nUI:N - The overflow is triggered through an automated RDMA protocol exchange and requires no human action.\nS:U - The corruption compromises resources within the affected host's kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The global DMA/KVA sink case exposes the sink address and permits attacker-controlled kernel memory corruption, which can enable control-flow hijacking and arbitrary kernel-memory disclosure.\nI:H - Attacker-chosen response bytes are written beyond the validated sink into adjacent kernel memory, providing an exploitable out-of-bounds write capable of modifying objects or achieving kernel code execution.\nA:H - The overwrite can corrupt critical kernel objects or reach invalid memory, causing an oops or panic; bounded FRWR sinks still permit connection-terminating denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64268","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64304","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An unprivileged local process can add a crafted PKCS#8 RSA private key to its own keyring and invoke KEYCTL_PKEY_QUERY, which selects qat-rsa and reaches the vulnerable key setup path.\nAC:L - With an active QAT asymmetric service and PKCS#8 parser, an oversized CRT integer deterministically causes unsigned offset underflow and an out-of-bounds memcpy. No race or attacker-uncontrollable condition is required.\nPR:L - An ordinary user can create, search, and use keys in a personal process, thread, or session keyring. No capability, administrator privilege, or user namespace is required.\nUI:N - The attacker directly performs the add_key and keyctl system calls without any victim action.\nS:U - The vulnerable QAT driver and the corrupted kernel resources share the same security authority. Ordinary kernel privilege escalation does not cross a CVSS scope boundary.\nC:H - The controlled kernel-memory overwrite can corrupt page tables, credentials, or control-flow objects and plausibly yield code execution with access to protected kernel memory.\nI:H - Attacker-controlled CRT bytes are written outside the coherent DMA allocation, potentially through multiple CRT components. This can provide powerful kernel-memory corruption and control-flow hijacking primitives.\nA:H - The invalid destination can cause an immediate kernel fault or corrupt unrelated kernel memory and subsequently panic or hang the system. The attack is repeatable."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64312","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - pcrypt is designed for network-facing IPsec use, and an inbound ESP packet can traverse xfrm_input(), esp_input(), crypto_aead_decrypt(), and pcrypt_aead_decrypt().\nAC:L - In load-responsive CPU-hotplug deployments, an attacker can flood qualifying ESP requests across repeated PADATA_RESET windows without precise timing or an uncontrollable memory-layout condition.\nPR:N - The ESP SPI is transmitted in clear, and the faulty path is reached before the child AEAD validates the integrity tag, so an unauthenticated on-path attacker needs no target-system privileges.\nUI:N - Packet delivery and asynchronous completion require no victim action.\nS:U - The failure affects the same kernel security authority processing the request and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The rejected request retains a zero padata->pd pointer, producing a NULL dereference without an out-of-bounds read or information disclosure.\nI:N - The callback writes only the completion status into its valid request context before dereferencing NULL; it provides no attacker-directed corruption or write primitive.\nA:H - padata_do_serial() dereferences the uninitialized padata->pd pointer, causing a kernel oops or panic that can terminate the system and can be retriggered."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64312","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64355","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A remote peer can send an oversized packet that a fragment-capable NIC represents as a multi-buffer XDP frame, reaching the vulnerable devmap broadcast clone path on a configured forwarding host.\nAC:L - No race or uncontrollable timing condition is required; fragmented packets reliably enter the faulty clone path and can be sent repeatedly.\nPR:N - Although initial-namespace CAP_BPF and CAP_NET_ADMIN are needed to configure the XDP deployment, the attacker sending packets through the already-configured unauthenticated data path needs no privileges.\nUI:N - Packet reception and XDP processing occur automatically without victim action.\nS:U - The corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other distinct boundary.\nC:H - Uninitialized fragment descriptors are consumed as page references and can be used by scatter-gather transmitters for unintended DMA mappings, potentially exposing arbitrary kernel memory.\nI:H - An uninitialized fragment count can overrun fixed-size driver arrays, while bogus page references can cause invalid refcount decrements, premature frees, and exploitable kernel memory corruption.\nA:H - Invalid fragment metadata can fault during DMA mapping, transmission, or frame return and cause a kernel oops or panic; an attacker can trigger this repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64355","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64383","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB server can trigger the flaw through crafted replayable responses and connection failures over the network.\nAC:L - The server controls both the replayable error and subsequent reconnect failure, allowing repeated triggering without an uncontrollable race.\nPR:N - The attacking SMB endpoint requires no privileges on the client system once an SMB session and file handle exist.\nUI:N - An automatically mounted share and routine service-generated fsync, truncate, timestamp, or seek operations can reach SMB2_flush() without human participation.\nS:U - The memory corruption compromises resources governed by the same host kernel security authority.\nC:H - The response-buffer double-free can create overlapping CIFS slab allocations and use-after-free primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and attacker-influenced overlapping network buffers can provide arbitrary-write or control-flow-hijacking primitives.\nA:H - The double-free can immediately trigger an allocator BUG, kernel oops, or panic and can be invoked repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64383","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64384","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious SMB server can return a replayable response and then force reconnect failure over the network, causing the client to free stale response state twice.\nAC:L - The peer controls both prerequisites by returning a status such as STATUS_RETRY and then disconnecting or refusing reconnection; repeated attempts make the scheduling window attacker-controllable.\nPR:N - The malicious SMB peer requires no account, capability, or other privilege on the vulnerable client; the established client session does not grant the attacker privileges on that host.\nUI:N - An ordinary automated CIFS workload can maintain an outstanding change-notify request, after which the remote peer completes the trigger without human involvement.\nS:U - Exploitation compromises the kernel and resources governed by the same host security authority, without crossing a separate virtualization or sandbox boundary.\nC:H - The double-free corrupts the CIFS response-buffer slab or mempool, permitting overlapping live objects and freelist manipulation that can support disclosure of arbitrary kernel memory.\nI:H - The heap corruption can provide attacker-influenced writes through aliased request and response buffers or freelist poisoning, potentially enabling kernel control-flow hijacking.\nA:H - Hardened allocators can immediately panic on the consecutive double-free, while unhardened allocators can crash later through freelist corruption."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64384","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64385","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - An attacker-controlled SMB server can deliver crafted SMB2 IOCTL responses over TCP, including through the kernel's periodic interface-query FSCTL on an existing SMB3 mount.\nAC:L - On a hard or retrans-enabled mount, the server controls replayable statuses, response contents, disconnects, reconnects, and repeated attempts, allowing it to drive both sides of the triggering sequence.\nPR:N - The malicious SMB server needs no account or privilege on the target; victim mounting authority and client authentication do not grant or require attacker-side target privileges.\nUI:N - Once the share is mounted, kernel delayed work can automatically issue the affected FSCTL when the server advertises multichannel support, requiring no user action during exploitation.\nS:U - The memory corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, container, or IOMMU boundary.\nC:H - The response-buffer double-free can corrupt SLUB or mempool state and create dangling or overlapping live buffers, enabling use-after-free exploitation and kernel-memory disclosure.\nI:H - Attacker-controlled network data can overwrite aliased or freed buffers and poison allocator state, supporting arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can trigger an allocator BUG or corrupt kernel heap state, causing an oops, panic, or complete system crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64385","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64386","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB2/3 server can remotely return a response-bearing replayable error and manipulate the subsequent connection state, reaching the vulnerable client over TCP.\nAC:L - The server controls the error response, disconnect, and reconnection sequence and can repeat it until the stale free occurs. Replay-enabled hard or retrans-configured SMB mounts are a reasonable deployment.\nPR:N - The malicious SMB peer needs no privileges or credentials on the client; SMB session setup authenticates the client to the server, not the attacker to the victim kernel.\nUI:N - Once the share is mounted, ordinary or automated file and metadata operations issue query-info requests, and exploitation requires no human action during the crafted response and reconnect sequence.\nS:U - The corruption and resulting impacts occur within the same Linux kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:H - The double-free corrupts SMB response-buffer slab and mempool state, enabling aliased or use-after-free buffers that can be leveraged to expose kernel memory.\nI:H - Allocator freelist corruption and reuse of one buffer by concurrent SMB operations can provide attacker-controlled modification of live kernel memory and support control-flow hijacking.\nA:H - The repeated free can immediately cause allocator corruption, a BUG, kernel oops, or panic, and the malicious server can trigger the sequence repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64386","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64387","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious remote SMB server can trigger the flaw through crafted responses to SMB2 QUERY_DIRECTORY requests over the established network connection.\nAC:L - On a hard/retrans-enabled mount, the server controls the replayable error and can repeatedly induce disconnect/reconnect conditions before request reinitialization, without relying on an uncontrollable race.\nPR:N - The attacker needs no account or privilege on the client; the client authenticates to the attacker-controlled SMB server, and ordinary accessible-share enumeration reaches the code.\nUI:N - In a reasonable auto-mounted deployment, routine directory enumeration can be performed automatically by a daemon or application without human participation.\nS:U - The corruption occurs within the client kernel and compromises resources governed by that same kernel security authority.\nC:H - Double-freeing the attacker-influenced CIFS response object can poison the slab freelist or create overlapping allocations, providing UAF-style primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and aliased CIFS buffers can enable attacker-influenced writes and potentially control-flow hijacking or kernel code execution.\nA:H - The double-free can immediately trigger allocator diagnostics, an oops, or a kernel panic, and corrupted freelists can cause subsequent fatal faults."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64387","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64423","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An end-to-end attacker-controlled trigger requires local socket and netlink operations to create multicast memberships and concurrently destroy IPv4 device state; received multicast packets alone cannot initiate the necessary teardown. These operations are reachable inside an attacker-created user and network namespace.\nAC:L - The attacker can populate mc_hash, generate continuous multicast traffic, and repeatedly tear down IPv4 state, controlling both sides of the race. No victim-dependent timing or secret state is required.\nPR:L - Device teardown or invalid-MTU configuration requires CAP_NET_ADMIN in the target network namespace, while multicast joins and UDP sends are unprivileged. An ordinary user can obtain this namespace-scoped capability through unprivileged user and network namespaces.\nUI:N - Exploitation requires no action by another user once the attacker can execute locally and create the required namespace and traffic.\nS:U - The vulnerable code and resulting host-kernel compromise remain within the same security authority; this is conventional kernel privilege escalation rather than a guest-to-host escape.\nC:H - The stale kmalloc-256 ip_mc_list entry exposes reuse-controlled fields and pointers to kernel reads, making kernel-memory disclosure and broader read primitives plausible.\nI:H - Reallocation permits attacker-influenced object contents to drive spinlock writes and pointer traversal on freed memory, making heap corruption and control-flow hijacking defensible.\nA:H - The confirmed slab use-after-free can dereference corrupted hash pointers or operate on an invalid spinlock, causing a kernel oops, panic, general-protection fault, or hang."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64423","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64450","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - TIPC packets can arrive through an IP/UDP bearer from a routable remote source, and the receive callback does not restrict packets to configured remote addresses. An attacker can also establish or spoof the required TIPC neighbour state without credentials.\nAC:L - The attacker controls capability advertisement, link establishment, broadcast synchronization, and the malformed STATE message; one packet then reliably performs the out-of-bounds copy without a race or uncontrollable condition.\nPR:N - The packet-receive path performs no capability or user-credential check, and TIPC discovery and link negotiation are unauthenticated when optional cryptographic keys are not configured. The vulnerable broadcast processing also precedes normal STATE-session validation.\nUI:N - No victim action is required after the TIPC bearer is active; receipt of the crafted STATE message directly invokes the vulnerable code.\nS:U - The vulnerability compromises availability and potentially confidentiality within the receiving kernel's existing security authority, without crossing a VM, IOMMU, or comparable scope boundary.\nC:H - The attacker-controlled count makes the kernel copy up to 1,024 bytes from a much smaller skb, incorporating substantial adjacent slab contents rather than a strictly bounded few-byte read.\nI:N - The defect performs an out-of-bounds read into a correctly sized new allocation; investigation found no out-of-bounds write, arbitrary-write primitive, or control-flow corruption.\nA:H - The demonstrated 1,024-byte slab-out-of-bounds access produces a KASAN BUG and can panic or fault hardened kernels, and an unauthenticated attacker can trigger it repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64450","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64481","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the vulnerable callbacks through ALSA control ioctls on /dev/snd/controlC*. No network or physical protocol directly exposes this path.\nAC:L - After teardown, stale controls can repeatedly dereference the freed object or queue its embedded work item, so exploitation does not require winning a narrow race. A queued work_struct also remains directly usable after its containing allocation is freed.\nPR:L - An unprivileged user with ordinary audio-device access can invoke the control callbacks. The ioctl path contains no capability, namespace, or administrative privilege check.\nUI:N - Exploitation requires no victim to open content or perform an interactive action.\nS:U - The vulnerable driver and the affected kernel resources are governed by the same kernel security authority.\nC:H - The heap use-after-free permits attacker-influenced reuse and disclosure of freed kernel object contents, potentially supporting arbitrary kernel memory reads.\nI:H - The freed object embeds mutable workqueue list state and a function pointer that is subsequently invoked, making kernel memory corruption and control-flow hijacking defensible.\nA:H - Stale control accesses or corrupted queued work can cause a kernel oops, panic, or workqueue corruption, resulting in complete system unavailability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64481","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64524","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The malicious resolution response must originate from the local Hyper-V synthetic-video backend over VMBus; it is not reachable through a network protocol or guest userspace ioctl.\nAC:L - The backend can deterministically trigger the flaw by returning a resolution_count from 65 through 255 during the normal WIN10+ probe or resume exchange, without a race or unpredictable condition.\nPR:N - The guest accepts the VMBus response without authentication, capability checks, or guest credentials; a malicious or compromised backend requires no privileges within the vulnerable guest.\nUI:N - The response is processed automatically during device probing or resume, without any victim action.\nS:U - The vulnerable parser and the affected DRM and kernel resources are within the same guest-kernel security authority; this does not produce a guest-to-host escape.\nC:H - A count of 255 causes 191 additional four-byte entries to be read beyond the declared array, substantially exceeding a small bounded disclosure and allowing out-of-bounds kernel data to influence observable display state.\nI:N - The invalid accesses are reads, and their results are written only to the intended resolution fields; no out-of-bounds write, use-after-free, or control-flow corruption was found.\nA:H - Bounds-instrumented hardened kernels can oops when index 64 is reached, while a failed or malformed resolution probe can leave zero maximum dimensions and make every userspace framebuffer creation fail."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64524","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64541","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable handler is driven entirely by a CDC control message sent by the remote SMC-R peer over the RDMA link, with an attacker-chosen `token` field and no local syscall involvement. SMC-R runs over RoCEv2 (IP/UDP-routable, port 4791) with the CLC handshake over plain TCP, and SMC-Rv2 explicitly supports non-local/routed peers, so the attacker need not share an L2 segment.\nAC:L - The attacker controls both sides of the race: it chooses when to emit CDC messages and which connection to target (the alert token is disclosed to it in the CLC accept/confirm), and it can drive the teardown side itself via CDC close/abort flags into `smc_close_passive_work()` or a stale seqno with `failover_validation` into `abort_work` -> `smc_conn_kill()`. The race can be retried indefinitely across many connections in the same link group, and was reproduced in practice with soft-RoCE.\nPR:N - Establishing an SMC-R connection to a listening SMC socket requires no credentials — SMC has no authentication layer of its own, exactly like plain TCP. Everything after connection establishment (sending CDC messages with a chosen token, signalling close/abort) is available to an unauthenticated peer.\nUI:N - The CDC message is processed in a softirq tasklet from the RDMA completion queue with no involvement from any local user or application action. No victim interaction of any kind is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard in-kernel use-after-free.\nC:H - The freed `smc_sock` is reused type-safely as another live socket, so attacker-supplied cursors applied by `smc_cdc_msg_recv_action()` break the `0 <= bytes_to_rcv <= rmb_desc->len` invariant and make `smc_rx_recvmsg()` hand stale RMB contents to userspace, while the urgent-data path reads `*(base + conn->urg_curs.count - 1)` at an attacker-chosen offset. Once the slab page is reclaimed after the RCU grace period, reuse is unconstrained, giving a general kernel-memory read primitive.\nI:H - `sock_hold()` on an already-zero refcount followed by `sock_put()` re-enters `sk_free()`, yielding a double free, and the handler additionally writes `sk_err`/`sk_shutdown`, makes indirect calls through `sk_data_ready()`/`sk_write_space()`, and `queue_work()`s a freed `work_struct`. These are classic heap-spray and control-flow-hijack primitives leading to arbitrary kernel write.\nA:H - The reported symptom is `refcount_warn_saturate` from `smc_cdc_msg_recv()`, which is an immediate kernel panic on `panic_on_warn` systems, and dereferencing freed memory in softirq context otherwise oopses. The attacker can trigger it repeatedly without authentication."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64541","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64543","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The free side is only reachable through the local TIPCv2 generic-netlink `BEARER_DISABLE` command (or netns teardown); a remote peer can supply the discovery packet that performs the use-after-free access but cannot itself cause `bearer_disable()` to run, so the complete attack requires local access.\nAC:L - The attacker controls both sides of the race — one thread floods TIPC discovery packets at the bearer's UDP port while another disables the bearer — and `bearer_disable()` clears `b->up` and then `kfree()`s the discoverer with no synchronization whatsoever, leaving a wide window that a multi-CPU packet flood hits reliably (a working PoC exists).\nPR:L - `tipc_genl_family` is `.netnsok = true` and the bearer enable/disable ops carry no `GENL_ADMIN_PERM` or other capability check, so an unprivileged user can do everything inside `unshare -Urn` after autoloading tipc via `socket(AF_TIPC, ...)`.\nUI:N - The attacking process performs both the bearer disable and the packet injection itself; no victim action or cooperating user is involved.\nS:U - The corruption stays within the kernel's own security authority — no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - `d->net` is read from the freed slab object and dereferenced as a `struct net *`; after reclaiming the kmalloc-192 allocation with sprayed data the attacker gains a controlled-pointer dereference chain usable for arbitrary kernel memory disclosure.\nI:H - `msg_set_prevnode(buf_msg(d->skb), sugg_addr)` writes a wire-controlled 32-bit value through the dangling `d->skb` pointer, and `tipc_disc_add_dest()` takes a spinlock and increments a counter in freed memory — together a controlled-address/controlled-value write suitable for control-flow hijacking.\nA:H - The use-after-free reliably produces a KASAN slab-use-after-free in softirq context and, on production kernels, a corrupted-pointer dereference or spinlock manipulation on reclaimed memory leading to kernel panic."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64543","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64562","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local KVM nested VMX: open /dev/kvm, run a nested guest, then tear down nested state (VMXOFF/handle_vmxoff or vmx_leave_nested). It is not reachable via network or adjacent-radio packets.\nAC:L - A KVM VMM attacker controls both sides of the race by driving nested teardown (VMXOFF/vcpu destroy) while forcing vCPU migration via thread affinity/scheduling so __loaded_vmcs_clear() VMCLEARs the dangling shadow VMCS pointer.\nPR:L - Exploitation needs permission to use /dev/kvm and nested VMX (commonly kvm-group or equivalent), not real init-namespace root; KVM create/run ioctls have no CAP_SYS_ADMIN gate on this path.\nUI:N - After the attacker has KVM/nested access, they trigger free_nested and migration themselves; no separate victim action is required.\nS:C - free_nested runs in host KVM while handling L1 nested VMX teardown, and the UAF corrupts host kernel memory, crossing the guest/hypervisor isolation boundary (guest-to-host escape class).\nC:H - The dangling shadow VMCS pointer lets VMCLEAR operate on a freed page that may be reused, yielding a host kernel use-after-free that can be leveraged for arbitrary information disclosure.\nI:H - VMCLEAR writes VMCS state into the freed page; with page reuse this is host heap corruption enabling write primitives and potential host code execution, consistent with UAF guidance.\nA:H - Use-after-free of the shadow VMCS page can oops/panic the host kernel when VMCLEAR or later accessors touch reallocated memory, fully denying host availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64562","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64563","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via local netlink sock_diag dumps (e.g. netlink_diag over NETLINK_SOCK_DIAG) and similar local dump walkers such as TIPC_NL_SOCK_GET; not reachable from remote packet processing.\nAC:L - Attacker controls both sides of the race by running a multi-fragment rhashtable dump while concurrently creating/destroying netlink (or TIPC) sockets to force table resize and free the walked object.\nPR:L - An unprivileged local user can open NETLINK_SOCK_DIAG and dump without CAP_NET_ADMIN; CAP_NET_ADMIN is only required for SOCK_DESTROY, and TIPC_NL_SOCK_GET likewise has no admin permission flag.\nUI:N - Exploitation requires only attacker-issued syscalls (netlink dump plus concurrent socket churn); no victim action is needed.\nS:U - Impact is memory corruption within the host kernel authority (local privilege escalation/crash), not a cross-boundary escape such as guest-to-host or IOMMU bypass.\nC:H - Use-after-free read of a freed hashed object (e.g. netlink_sock) can be reclaimed via heap spray, yielding an arbitrary read primitive through subsequent walk/diag use of the corrupted pointer.\nI:H - UAF on a reclaimable slab object enables heap spraying and fake-object injection into the walk path, which can be leveraged for arbitrary write or control-flow hijacking.\nA:H - The demonstrated KASAN slab-use-after-free in rhashtable_walk_next can oops/panic the kernel, and UAFs remain crashable even when not fully exploited."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64563","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64581","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via setsockopt(IP_XFRM_POLICY/IP_IPSEC_POLICY) on a local socket racing concurrent udp_sendmsg; entry is a local syscall path (do_ip_setsockopt -> xfrm_user_policy), not packet processing.\nAC:L - Attacker controls both sides of the race (one thread setsockopt to clear/apply per-socket xfrm policy, another sendmsg on the same connected UDP socket) and can create the obsolete xfrm_dst precondition in their netns, retrying until the double dst_release wins.\nPR:L - Path requires CAP_NET_ADMIN checked with sockopt_ns_capable(sock_net(sk)->user_ns), which an unprivileged user obtains via user+network namespaces; the fix commit explicitly states this reachability.\nUI:N - Exploitation uses only the attacker's own socket, threads, and setsockopt/sendmsg loops; no victim action or cooperation is required.\nS:U - Double-free/UAF of the socket's dst_entry/xfrm_dst is standard local kernel memory corruption within the host kernel authority, not a VM escape or other cross-boundary impact.\nC:H - Double dst_release frees the xfrm_dst slab object while still referenced, yielding a use-after-free that can be reclaimed/sprayed to disclose kernel memory via corrupted dst contents and ops.\nI:H - The UAF targets a dst_entry with function pointers (ops/input/output) used on transmit, enabling heap reuse for arbitrary write and control-flow hijack consistent with comparable sk_dst_cache races.\nA:H - The KASAN slab-use-after-free in dst_release demonstrates kernel memory corruption that can oops/panic, and the attacker can repeat the race freely."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68121","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in pppoe_sendmsg(), reached only via the local sendmsg() syscall on a PF_PPPOX/PPPoE socket; it is not triggered by remote packet reception or in-kernel PPP transmit paths such as __pppoe_xmit().\nAC:L - Exploitation requires a race between copy_from_user() blocking in sendmsg and changing team header_ops (e.g., adding the first non-Ethernet GRE port), which an attacker can drive with concurrent threads and retries rather than uncontrollable timing.\nPR:L - PPPoE sockets can be created without special privileges, and configuring the team/GRE topology needed to trigger dev_hard_header() head expansion is achievable with CAP_NET_ADMIN inside an unprivileged user/network namespace (unshare -Urn).\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through socket I/O and netlink/rtnl configuration of the team device.\nS:U - Impact is kernel heap corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - Writing PPPoE header fields through a stale pointer after pskb_expand_head() frees the old skb head is a slab use-after-free; freed kmalloc objects can be reclaimed for sensitive data, enabling arbitrary kernel memory disclosure.\nI:H - The post-dev_hard_header() memcpy/ph->length stores up to eight attacker-influenced bytes into freed skb head memory, providing a heap corruption primitive that can be developed into arbitrary kernel writes or code execution.\nA:H - Use-after-free writes into freed slab memory commonly cause kernel oops/panic and can be triggered repeatedly via sendmsg, yielding persistent denial of service even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68121","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68136","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached from the standard NAPI GRO receive path processing remotely originated TCP/IP packets (napi_gro_receive→dev_gro_receive→tcp_gro_receive→skb_gro_receive_list), including tethering/NAT/forwarding scenarios where packets re-enter GRO on a second netdev after driver LRO or prior GRO aggregation.\nAC:L - An attacker can reliably trigger the bug by crafting a TCP stream through a forwarding host with rx-gro-list enabled, without races or victim-specific timing; the commit documents a deterministic tethering/forwarding repro where flush-marked frag_list skbs are re-aggregated and later crash skb_segment.\nPR:N - No local privileges or authentication are required; any remote peer that can send TCP traffic through a vulnerable forwarding/tethering/NAT Linux host can reach the GRO fraglist merge path, which performs no capability or credential checks on the receive path.\nUI:N - Exploitation requires only network-delivered packets and normal kernel forwarding/GRO processing; the victim does not need to open files, mount filesystems, click links, or perform any deliberate action beyond routine network operation.\nS:U - Impact is confined to kernel memory corruption and panic within the same host kernel security domain during packet GRO aggregation and subsequent segmentation on transmit; it does not cross VM, container, or IOMMU boundaries to affect a separate security authority.\nC:H - Double aggregation corrupts the skb frag_list chain (loops, dangling references, NULL/corrupted list_skb pointers), constituting kernel heap memory corruption that can be read during skb_segment processing and is classifiable as a high-impact info-disclosure primitive beyond a simple crash.\nI:H - Re-aggregating flush-marked skbs with existing frag_list corrupts skb linked-list structure and reference relationships in kernel memory, enabling potential control of subsequent skb metadata and write/control-flow primitives during GSO segmentation, not merely integrity-preserving packet drops.\nA:H - Corrupted frag_list state causes skb_segment to dereference a NULL or invalid list_skb via skb_headlen(), producing a kernel panic/oops on the transmit path (sch_direct_xmit/qdisc_run), fully denying availability of the affected system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68136","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68138","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local RTM_NEWTFILTER rtnetlink messages (tc flower filter with police action) through rtnetlink_rcv_msg→tc_new_tfilter→fl_change→tcf_police_init→qdisc_get_rtab/qdisc_put_rtab; no remote packet or network protocol path exists.\nAC:L - cls_flower is TCF_PROTO_OPS_DOIT_UNLOCKED, so concurrent RTM_NEWTFILTER requests run without RTNL; the attacker controls both racing threads/CPUs and can repeatedly install flower filters with identical police rate tables to deterministically hit the global qdisc_rtab_list/refcnt race.\nPR:L - Non-GET rtnetlink handlers require netlink_net_capable(CAP_NET_ADMIN); this is namespace-scoped, so an unprivileged local user obtains CAP_NET_ADMIN via user namespaces (unshare -Urn), sets up clsact/ingress, and installs flower+police rules without init-namespace root.\nUI:N - Exploitation is fully self-contained: the attacker issues the concurrent tc/netlink commands from its own processes and needs no victim to mount filesystems, click links, or perform any other interactive action.\nS:U - Impact is heap corruption and UAF/double-free in kernel kmalloc-2k slabs within the same kernel security authority; although qdisc_rtab_list is global across netns, this is standard kernel memory corruption/privilege escalation, not a VM, IOMMU, or sandbox boundary escape.\nC:H - Concurrent non-atomic refcnt and list updates cause slab use-after-free/double-free of struct qdisc_rate_table (KASAN-confirmed in qdisc_put_rtab); freed 2KB objects are attacker-influenceable via kmalloc timing and are classically weaponizable for arbitrary kernel memory disclosure.\nI:H - The race corrupts a process-global singly linked list and can double-free a kmalloc-2k qdisc_rate_table, yielding classic heap metadata/object corruption primitives that can be developed into arbitrary kernel writes and local privilege escalation/code execution.\nA:H - Demonstrated KASAN slab-use-after-free in qdisc_put_rtab on the error/teardown path, and concurrent double-free of the same rate table can panic the kernel; the trigger is repeatable at will with concurrent netlink requests and causes task death or system-wide instability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68138","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68155","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when libceph decodes CEPH_MSG_MON_MAP from a remote Ceph monitor over the kernel client's established TCP/msgr2 session (mon_dispatch -> ceph_monc_handle_map -> ceph_monmap_decode), which is a network protocol attack surface on CephFS/RBD/cloud nodes.\nAC:L - An attacker who can send monitor protocol messages only needs to set num_mon=0 in the monmap; once accepted, any later session reopen (keepalive timeout, hunt, or connection fault) deterministically hits BUG_ON in pick_new_mon without races or special memory layout.\nPR:N - In the highest-impact scenario a malicious or compromised Ceph monitor (or equivalent authenticated cluster peer) sends the malformed monmap to already-connected kernel clients; the attacker needs no local privileges on the victim host.\nUI:N - After a Ceph client session exists, monmap updates are delivered and processed automatically by the kernel monitor client; no further mount, open, or other victim interaction is required to accept the bad map and later crash on reconnect.\nS:U - Exploitation causes a kernel BUG/panic within the same kernel security domain and does not cross VM, container, IOMMU, or other security boundaries.\nC:N - The failure mode is a BUG_ON assertion in pick_new_mon when num_mon is zero; there is no memory corruption, out-of-bounds access, or other information disclosure primitive on the vulnerable path.\nI:N - Accepting num_mon==0 only stores an empty monmap and later triggers a deliberate kernel BUG; attacker input does not corrupt or modify arbitrary kernel memory or enable code execution.\nA:H - BUG_ON(monc->monmap->num_mon < 1) in pick_new_mon during __open_session causes a kernel oops/panic, fully denying availability of the affected host until reboot."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68155","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68158","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Malformed incremental osdmap data is delivered in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch) to libceph clients (CephFS/RBD), and the overflow is triggered while decoding received network bytes in osdmap_apply_incremental().\nAC:L - A compromised or attacker-controlled monitor/OSD can publish an incremental osdmap with epoch N+1 and a crafted new_state length that wraps the multiply, reliably bypassing bounds checks without races or victim-specific memory layout.\nPR:N - Exploitation requires no privileges on the victim host; a malicious cluster peer or on-path attacker that can deliver forged osdmaps to an already-connected kernel Ceph client needs no local account, capabilities, or user-namespace tricks.\nUI:N - Once a host is a Ceph client, osdmap subscriptions and updates are applied automatically by the kernel; no additional mount, open, or interactive step is needed at exploit time beyond the existing client session.\nS:U - Impact is confined to kernel memory and libceph client state on the Ceph client host (info leak, map corruption, crash, or privilege escalation); it does not cross VM, IOMMU, or sandbox boundaries to another security authority.\nC:H - Integer-overflow bypass lets decode_new_up_state_weight() run bare ceph_decode_32/8 loops past the message end, performing out-of-bounds reads of adjacent kernel heap/slack memory that can disclose pointers and other sensitive data.\nI:H - Misaligned decoding also drives attacker-controlled osd/xorstate/weight values into map->osd_weight[], map->osd_state[], and map->osd_addr[] updates (including memset), corrupting kernel osdmap state in ways usable for further exploitation.\nA:H - Unbounded out-of-bounds reads while parsing osdmaps can fault on unmapped pages and trigger kernel oops/panic; map corruption can also cause persistent client failure, repeatable on each malicious incremental map."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68158","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68159","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Malicious pg_temp/pg_upmap data arrives in CEPH_MSG_OSD_MAP from a Ceph monitor or OSD over TCP, is decoded in libceph, and later triggers stack corruption in ceph_pg_to_up_acting_osds during RBD/CephFS/libceph client I/O.\nAC:L - A compromised or attacker-controlled monitor can publish osdmap entries with length >32 for chosen PGs; once the client subscribes, kernel I/O paths such as RBD mount/probe via calc_target deterministically invoke apply_upmap/get_temp_osds and overflow the stack buffer.\nPR:N - Exploitation requires no privileges on the victim host; any machine acting as a Ceph client that receives a forged osdmap from a cluster peer over the network can be attacked without local user capabilities or namespace tricks.\nUI:N - No victim user action is needed during exploitation beyond the host already being a Ceph client; forged osdmaps are applied automatically and the overflow fires on subsequent kernel client operations without interactive steps.\nS:U - Impact is confined to kernel memory on the Ceph client host (privilege escalation or crash); it does not cross VM, IOMMU, or sandbox boundaries to other security authorities.\nC:H - KASAN-confirmed stack out-of-bounds write in ceph_pg_to_up_acting_osds corrupts adjacent stack memory and can be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Unbounded copy loops in apply_upmap() and get_temp_osds() write attacker-controlled u32 OSD IDs past the fixed osds[CEPH_PG_MAX_SIZE] stack array, enabling control-flow hijack and arbitrary kernel writes.\nA:H - The reported reproducer triggers KASAN stack-out-of-bounds followed by kernel BUG in ceph_pg_to_up_acting_osds, demonstrating a reliable kernel oops or panic from malformed osdmap processing on Ceph clients."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68159","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68160","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - CEPH_MSG_CLIENT_CAPS is received over the kernel Ceph messenger TCP connection from an MDS peer; mds_dispatch() passes it directly to ceph_handle_caps(), so a malicious or compromised MDS (or on-path attacker on an unsigned msgr session) reaches the bug with network data alone.\nAC:L - The attacker fully controls msg->hdr.version and snap_trace_len in the caps header; setting version=1 bypasses all version-gated decoders and snap_trace_len=0xFFFFFFFF yields a fake end pointer that reliably defeats ceph_decode_need(), with no race or memory-layout dependency.\nPR:N - Exploitation requires only the ability to send crafted caps messages as the remote MDS peer on an established session; the attacker needs no account, mount privilege, or other credentials on the victim host beyond the client already being connected to that cluster.\nUI:N - Once CephFS is mounted and the MDS session is open, CEPH_CAP_OP_IMPORT caps messages are delivered and processed automatically during normal cap migration and MDS failover; no additional local user action is needed at exploit time beyond prior cluster connectivity.\nS:U - The out-of-bounds read and resulting snap-realm corruption affect only the kernel CephFS client’s internal state within the same kernel security authority; there is no VM escape, sandbox breakout, or cross-authority boundary crossing.\nC:H - ceph_update_snap_trace() decodes struct ceph_mds_snap_realm and snap arrays using an attacker-supplied fake end pointer, reading sizeof(*ri) and further attacker-influenced extents past the legitimate msg->front buffer into adjacent kernel memory without copying to userspace.\nI:H - Out-of-bounds kernel memory is interpreted as snap-realm metadata and copied via dup_array() into newly allocated kernel heap structures (realm->snaps, realm->prior_parent_snaps), corrupting authoritative snap state and providing a memory-corruption primitive that could be leveraged for further kernel compromise.\nA:H - Out-of-bounds reads can fault on unmapped pages causing a kernel oops; the ceph_update_snap_trace() error path issues WARN(1), fences I/O via CEPH_MOUNT_FENCE_IO, and can close all MDS sessions—effects an attacker can trigger repeatedly at will."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68160","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68202","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through ioctls on the local character device /dev/snd/seq (SNDRV_SEQ_IOCTL_CREATE_QUEUE/DELETE_QUEUE/SET_QUEUE_CLIENT); no network or adjacent-network path exists to the ALSA sequencer.\nAC:L - The attacker controls both sides of the race — one thread deletes the queue while another spins on SET_QUEUE_CLIENT holding a queueptr() reference — and can retry the loop indefinitely on a default kernel with CONFIG_SND_SEQUENCER, so the window is reliably hit.\nPR:L - Only an unprivileged local user able to open /dev/snd/seq is needed; snd_seq_queue_use() performs no owner or access check and no capability is required, as the fix commit states explicitly.\nUI:N - The attacker's own threads create, delete and re-use the queue and the global system timer fires on its own; no victim action is involved.\nS:U - The use-after-free corrupts kernel heap objects within the same kernel security authority, giving at most kernel privilege escalation rather than crossing a VM, IOMMU or sandbox boundary.\nC:H - The stale timer instance dereferences the freed snd_seq_queue and snd_seq_timer, reading tick/time fields and freed prioq pointers that can be reclaimed by attacker-sprayed objects, giving a route to disclose arbitrary kernel memory.\nI:H - snd_seq_timer_interrupt() writes cur_time, tick and last_update into the freed snd_seq_timer slab and snd_seq_check_queue() dispatches events through freed queue pointers, yielding a controllable write primitive on reclaimed heap memory suitable for privilege escalation.\nA:H - Even unexploited, the timer callback derefs freed memory and takes a spinlock in a freed object from interrupt context, causing oops, lock corruption or panic — a repeatable denial of service for any local user."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68202","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68397","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handler is registered via dev_add_pack() for ethertype ETH_P_AF_IUCV (0xFBFB) on every netdevice, so any peer LPAR/guest on the same HiperSockets internal LAN or any host on an attached Ethernet segment can drive afiucv_hs_rcv() with crafted frames; the frames are raw L2 and cannot be routed across an IP hop, so the vector is adjacent rather than network.\nAC:L - The attacker controls the packet side of the race outright (flooding 0xFBFB frames) and can drive the freeing side too, since SYN frames make a listener spawn and enqueue child sockets while FIN/SYN|FIN frames push sockets to IUCV_DISCONN and wake the application into close(), so the read_unlock()-to-handler window can be retried indefinitely until won.\nPR:N - afiucv_hs_rcv() runs from the netif RX softirq and processes any matching frame with no authentication, credential check, or capability test anywhere on the path; the attacker needs no account or privilege on the target s390 system.\nUI:N - No victim action is required: the attacker's own frames both create the AF_IUCV child sockets and trigger the state changes that lead to their teardown, and the packet handler runs unconditionally in softirq context.\nS:U - The freed struct sock and the resulting corruption stay inside the kernel of the affected LPAR or z/VM guest; no hypervisor, IOMMU, or container boundary is crossed.\nC:H - This is a use-after-free on a socket allocated from a generic kmalloc cache (iucv_proto is registered without its own slab), so an attacker who reclaims the object has the kernel read attacker-influenced or stale heap contents through sk fields, sk_filter()'s BPF program pointer, and the iucv backlog queues, yielding kernel memory disclosure.\nI:H - After the free the handlers perform indirect calls through the freed object (sk->sk_data_ready(), sk->sk_state_change(), sk_filter()) and writes into it (sk_state, atomic_sub on iucv->msg_sent, skb_queue_tail() list-pointer updates), giving control-flow hijack and write primitives once the slab object is reclaimed with attacker-controlled data.\nA:H - Dereferencing the freed socket from softirq context reliably produces an oops or \"Fatal exception in interrupt\" panic, and the attacker can repeat the frame flood at will, causing complete loss of availability of the IBM Z LPAR or guest."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68397","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68398","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The free side of the race is a local close() of the pppol2tp socket, which no remote peer can invoke; the full attack (create tunnel/session via AF_PPPOX socket, drive RX with loopback UDP datagrams, close concurrently) is performed entirely through local syscalls.\nAC:L - The attacker controls both sides of the race, feeding the UDP-encap RX softirq from one thread while closing the pppox socket on another, and can retry the loop indefinitely until the window is hit.\nPR:L - No capability check exists on this path: pppox_create()/pppol2tp_connect() and ppp_register_net_channel() need no CAP_NET_ADMIN, and PPPIOCGCHAN is handled by pppox_ioctl() on the socket itself, so /dev/ppp access is not required; the fix commit states the bug is reachable by an unprivileged user.\nUI:N - The attacker performs every step — socket creation, session setup, packet injection and close() — with no action by any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the channel is freed and its slab object reallocated, ppp_input() reads pch->bridge and pch->ppp from attacker-groomed memory and can route received frames to an arbitrary attacker-chosen structure, giving a path to disclosing kernel memory.\nI:H - skb_queue_tail(&pch->file.rq, skb) writes a linked-list insertion into the freed object and wake_up_interruptible(&pch->file.rwait) traverses a freed waitqueue, so heap grooming yields controlled writes and function-pointer traversal usable for privilege escalation.\nA:H - Dereferencing and writing to the kfree()d struct channel from softirq context reliably corrupts the slab and panics or oopses the kernel, and the race can be re-triggered at will."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68398","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68417","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access to the RDMA character devices (/dev/infiniband/uverbsN for create_qp and /dev/infiniband/rdma_cm for the QPN lookup); no network packet reaches the racing code path without a local trigger first.\nAC:L - The attacker controls both sides of the race: one thread issues create_qp while another issues rdma_connect/rdma_accept with an attacker-supplied qp_num, and QPNs from xa_alloc(XA_FLAGS_ALLOC1) are predictable. The post-publish failure can be made deterministic by passing a short udata->outlen, so the window is wide and repeatable at will.\nPR:L - Any unprivileged local user with access to the siw uverbs and rdma_cm character devices can create QPs and issue rdma_connect/rdma_accept with an arbitrary qp_num; no capability check gates siw_create_qp, siw_connect or siw_accept.\nUI:N - The attacker drives both the QP creation and the concurrent QPN lookup from its own threads; no action by any other user or administrator is needed.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU or sandbox boundary.\nC:H - The siw_qp object can be kfree'd by the ib core error path while the CM thread still holds a reference, giving a use-after-free on a slab object the attacker can groom and read back through QP/CM state, enabling disclosure of arbitrary kernel memory.\nI:H - After the free, siw_free_qp() performs list_del(&qp->devq), vfree() of four pointer fields and siw_put_tx_cpu(qp->tx_cpu) using values read from reallocated attacker-controlled memory, yielding arbitrary-pointer free, list-unlink writes and out-of-range per-CPU decrements suitable for control-flow hijacking.\nA:H - Even without exploitation the race reliably causes kernel crashes: NULL sendq/recvq/scq/rcq dereferences, list_del on an uninitialized devq head, waits on an uninitialized qp_free completion, and use-after-free oopses."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68417","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68426","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPsec transmit path (validate_xmit_xfrm) which processes any skb routed into an offloaded SA, including GRO-aggregated traffic forwarded from remote hosts on an IPsec gateway; xfrm_dev_offload_ok() has no socket/local-origin requirement, so a remote peer's packet stream drives the vulnerable GSO segmentation and async-crypto steal directly.\nAC:L - The attacker drives both preconditions with traffic alone: sustained large GSO flows keep the crypto engine backlogged so ->xmit() returns -EINPROGRESS routinely, and packet volume advances xo->seq.low toward the wrap that forces segmentation; each stolen trailing segment reproduces the stale skb->prev, and the subsequent tail->next write is deterministic once it occurs.\nPR:N - On an IPsec gateway the traffic that triggers the path is forwarded from remote, unauthenticated senders — no account, credentials, or capability on the target host is needed, since the SA and offload are pre-existing administrative configuration rather than something the attacker must set up.\nUI:N - No victim action is required; the vulnerable code runs automatically in softirq context on every qualifying transmit, driven purely by the attacker's packet stream.\nS:U - The corruption is of kernel sk_buff list state within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Writing through the stale ->prev is a use-after-free on an skb whose memory the attacker can influence via heap grooming with concurrent traffic; per kernel UAF guidance this yields a high-confidentiality primitive, and the corrupted list can splice engine-owned skbs into the transmit path, exposing freed/reused memory contents on the wire.\nI:H - tail->next = skb is an attacker-influenced pointer write into freed heap memory, and the resulting skb list corruption lets live and engine-owned skbs be chained together; this is classic heap corruption that can be shaped via spraying into an arbitrary write or control-flow hijack.\nA:H - Even without full exploitation the use-after-free write and the double-ownership of a stolen segment cause list corruption, double-free/oops and kernel panic in the softirq transmit path, taking down the gateway."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68426","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72020","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when a host running the IPVS backup sync receiver processes forged UDP sync datagrams (default multicast 224.0.0.81:8848) in ip_vs_process_message(), which is a network packet receive path rather than a local-only ioctl/netlink interface.\nAC:L - Once IPVS backup sync is enabled, an attacker can reliably send IPVS v1 messages that set IP_VS_CONN_F_IN_SEQ/OUT_SEQ while omitting IPVS_OPT_SEQ_DATA; no race, heap grooming, or victim-specific state beyond matching syncid (often 0) is required.\nPR:N - The backup sync socket accepts unauthenticated UDP input with no capability checks; only an optional syncid filter (frequently left at 0) may drop messages, so the attacker needs no Linux privileges to inject the malformed sync records.\nUI:N - No end-user or administrator interaction is required at exploit time; the attacker directly delivers crafted sync messages to the listening backup daemon without victims opening files, clicking links, or changing settings.\nS:U - Exploitation stays within the IPVS load balancer kernel/network authority and affects connections it forwards; it does not constitute a VM escape, sandbox breakout, or cross-security-authority boundary such as guest-to-host.\nC:H - Uninitialized ip_vs_seq init_seq and previous_delta fields retain stale slab data that vs_fix_seq()/vs_fix_ack_seq() apply when rewriting forwarded TCP seq/ack numbers, leaking kernel heap bytes onto the network to clients or backend servers.\nI:H - Those same uninitialized sequence-adjustment fields cause incorrect TCP sequence/ack rewriting in NAT/application-helper paths (ip_vs_app_pkt_in/out), corrupting load-balanced TCP flows and enabling attacker-driven manipulation of forwarded traffic integrity.\nA:H - Corrupted TCP sequence handling breaks or resets connections on the virtual service and can be triggered repeatedly via additional forged sync messages, causing sustained denial of service to load-balanced traffic on the affected backup node."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72020","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72069","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On CONFIG_PREEMPT_RT, every spin_unlock() is substituted by rt_spin_unlock(); network subsystems such as netfilter xt_hashlimit process inbound packets through hashlimit_mt_common(), spin_lock/unlock on RCU-protected dsthash_ent objects concurrently freed via call_rcu by GC—the exact embedded-spinlock UAF pattern from the fix.\nAC:L - The bug is a cross-CPU race where rt_spin_unlock() calls rcu_read_unlock() before releasing the rtmutex, ending the RCU grace period while still dereferencing the lock; syzbot triggered this reliably on PREEMPT_RT via concurrent unlinkat and dentry teardown, and attackers control both sides with parallel syscalls or packet/GC load.\nPR:N - Remote attackers need no account, capability, or authentication to send packets that hit deployed hashlimit rules on internet-facing PREEMPT_RT gateways; the proven syzbot unlinkat path needs only directory write permission (PR:L), but PR:N reflects the highest-severity unauthenticated network packet scenario.\nUI:N - No victim interaction is required; the attacker drives the race through their own concurrent filesystem syscalls (syzbot: unlinkat racing __fput/dentry_kill) or sustained inbound traffic overlapping netfilter GC, without needing another user to open files or mount filesystems.\nS:U - The UAF corrupts kernel slab memory containing embedded spinlock/rtmutex fields and enables privilege escalation within the same kernel security authority; it does not inherently cross VM/guest, container sandbox, or IOMMU hardware isolation boundaries.\nC:H - Syzbot reported KASAN slab-use-after-free Read in rt_mutex_slowunlock during spin_unlock on a freed dentry in shrink_dcache_tree; the systemic UAF lets attackers read freed objects (dentry, dsthash_ent, etc.) after premature RCU grace-period completion, enabling kernel pointer and memory disclosure.\nI:H - UAF on embedded rtmutex fields inside freed slab objects (dentry->d_lock per syzbot) permits heap grooming and reallocation of attacker-controlled data, providing standard kernel heap corruption primitives for arbitrary write and control-flow hijack beyond the immediate crash.\nA:H - Syzbot hit KASAN slab-use-after-free causing kernel fault in shrink_dcache_tree via rt_spin_unlock on PREEMPT_RT; the bug can oops/panic any RT kernel whenever spin_unlock races RCU-deferred free of the containing object, enabling repeatable denial of service via concurrent VFS or netfilter operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72069","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72072","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is reached by racing MACSEC_CMD_DEL_RXSC/ADD_RXSC netlink configuration (GENL_ADMIN_PERM) against mlx5e MACsec RX processing; the privileged genlink/rtnl control path is required to trigger the bug, not remote packets alone.\nAC:L - An attacker with CAP_NET_ADMIN can drive both sides by looping RX SC add/delete while flooding MACsec-offloaded RX traffic on the mlx5e netdev, reliably winning the RCU race between xa_load/dst_hold and metadata_dst_free.\nPR:L - MACsec offload mutations require GENL_ADMIN_PERM (CAP_NET_ADMIN); on Mellanox ConnectX/BlueField systems this is reachable by cloud tenants with SR-IOV VFs, containers, or user/network namespaces without init-namespace root.\nUI:N - No victim user action is needed; automated concurrent netlink MACsec operations and incoming MACsec-offloaded frames on an active mlx5e interface suffice once MACsec offload is configured.\nS:U - Impact is kernel heap use-after-free and memory corruption within the host kernel on the mlx5 NIC; it enables local privilege escalation but does not by itself cross VM, IOMMU, or hypervisor security boundaries.\nC:H - The race calls dst_hold() and skb_dst_set() on a freed metadata_dst, a classic slab UAF that can disclose kernel memory through subsequent dst_entry and MACsec skb metadata handling.\nI:H - Freed metadata_dst objects can be reallocated via heap spraying while the RX datapath still references them, enabling refcount corruption and arbitrary kernel memory writes or control-flow hijack beyond a mere crash.\nA:H - Concurrent use of freed md_dst during mlx5e MACsec RX processing can cause immediate kernel oops, BUG, or panic on datacenter/cloud hosts using mlx5 hardware MACsec offload, fully denying system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72072","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72083","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On LIO/iSCSI storage servers and appliances, a remote initiator sends PERSISTENT_RESERVE_OUT with REGISTER AND MOVE over TCP (port 3260); iscsit_process_scsi_cmd()→target_execute_cmd()→target_scsi3_emulate_pr_out()→core_scsi3_emulate_pro_register_and_move() with no local access required.\nAC:L - The attacker fully controls the PR-OUT parameter list length (>4096 to force vmap/vunmap), iSCSI TransportID format 01b with ISID, and can establish prerequisite PR registration and reservation via prior SCSI commands on the same session; no uncontrollable race or layout dependency exists.\nPR:N - Exploitation requires only the ability to act as a network SCSI/iSCSI client with LUN access to an exported target; no Linux UID, capability, or init-namespace root on the storage server is needed—only standard iSCSI initiator connectivity (CHAP/ACL when configured).\nUI:N - Triggering is fully automated once an iSCSI session exists: the attacker issues scripted REGISTER, RESERVE, then REGISTER AND MOVE commands with a crafted >4 KiB parameter list; no victim mount, click, or other interactive action is required.\nS:U - The UAF corrupts kernel heap state inside the target-core PR handler on the storage host; impact stays within that kernel security domain and does not inherently cross VM, container, or IOMMU boundaries (standard host compromise, not escape).\nC:H - After vunmap(), iport_ptr aliases freed kernel virtual address space and is dereferenced in strcmp(), __core_scsi3_locate_pr_reg(), and snprintf() into pr_reg_isid; per kernel CVSS guidance, UAF reads enable arbitrary kernel memory disclosure when uncertain.\nI:H - UAF reads of attacker-influenced unmapped PR-OUT data drive strcmp-based registration matching and snprintf copies into persistent kernel pr_reg structures; memory corruption/UAF is scored High for integrity because it can be leveraged for control-flow or state manipulation.\nA:H - Dereferencing iport_ptr after transport_kunmap_data_sg() vunmap() on multi-page buffers causes immediate invalid kernel virtual address accesses (oops/panic) on every qualifying REGISTER AND MOVE; UAF availability impact is High per kernel guidance even before full exploit development."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72083","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72084","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered by a PERSISTENT RESERVE OUT SCSI command delivered over the LIO iSCSI target fabric (TCP/3260); remote initiators reach `iscsi_parse_pr_out_transport_id()` after login and normal SCSI command processing, and the fix commit notes the same path via vhost-scsi-backed exports.\nAC:L - An attacker fully controls the PR-OUT parameter list and can reliably supply a FORMAT CODE 01b iSCSI TransportID without a \",i,0x\" separator or NUL terminator and size it past one page so `strstr()` over-reads into the vmalloc guard page; no races or victim-specific memory layout are required.\nPR:N - Exploitation requires only completing iSCSI login to an exported LUN as any initiator client, not host administrator privileges; LIO demo mode auto-provisions initiator ACLs and many storage appliances expose iSCSI targets to the network without mapping this to elevated OS credentials.\nUI:N - No end-user or administrator action beyond normal automated iSCSI target operation is needed; a remote initiator can send the malicious PR OUT command directly once a session to the LUN exists.\nS:U - The flaw corrupts or reads kernel memory and crashes the target host kernel within the same kernel security boundary; it does not by itself cross a VM, container, or IOMMU isolation boundary to another authority.\nC:H - Unbounded `strstr()` and an unbounded `%s` on the error path perform out-of-bounds reads past the received PR-OUT buffer, potentially disclosing adjacent kernel memory before the fault, matching CVSS guidance for out-of-bounds reads beyond a few bytes.\nI:H - A malformed TransportID can leave the ISID pointer one byte past the descriptor so subsequent registration code dereferences out of bounds, and the ISID normalization loop can write with `tolower()` beyond the buffer, giving a memory-corruption primitive in kernel context.\nA:H - The over-read into a multi-page vmalloc mapping hits the guard page and triggers a KASAN vmalloc-out-of-bounds fault and kernel oops, remotely denying service to the host and all consumers of the iSCSI target."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72123","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local BCM socket syscalls (sendmsg with RX_SETUP/SETTIMER/ival2 throttling and RX_DELETE); CAN frames can be injected locally via loopback without physical bus access.\nAC:L - The attacker controls both sides of the race by concurrently issuing RX_DELETE teardown and delivering matching CAN frames (e.g., via threads or paired BCM/RAW sockets), making the thrtimer re-arm UAF reliably triggerable.\nPR:L - No kernel capability check gates AF_CAN/CAN_BCM socket creation or bcm_sendmsg opcodes; any unprivileged local user with socket access (including via user namespaces with vcan) can reach the vulnerable path.\nUI:N - No victim interaction is required; the attacker self-triggers the race through their own BCM socket operations and locally injected CAN traffic.\nS:U - Impact is confined to kernel memory corruption and local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM or IOMMU bypass.\nC:H - The thrtimer UAF dereferences freed bcm_op fields (locks, frame buffers, op->sk) in bcm_rx_thr_handler/bcm_send_to_user, enabling attacker-controlled heap reuse and arbitrary kernel memory disclosure.\nI:H - UAF on the bcm_op slab object allows heap spraying to corrupt function pointers, timers, and sock structures, providing a standard path to arbitrary kernel writes and local privilege escalation.\nA:H - The freed-op dereference in the hrtimer softirq path causes kernel oops/panic under normal exploitation attempts, and successful memory corruption can crash or hang the system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72123","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72135","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local pread()/write() syscalls on /dev/tpm0 or /dev/tpmrm0 character devices; there is no network, Bluetooth, or physical-bus code path to the vulnerable tpm_common_read() handler.\nAC:L - An attacker who can open the device reliably triggers the bug by writing any TPM command to create a pending response, then calling pread() with a large offset; no races or special memory layout are required.\nPR:L - Upstream tpm2-tss udev rules grant non-root users in the tss group read/write access to /dev/tpmrm0 (mode 0660), which is the standard TPM2 user-space interface on laptops and servers with TPM hardware.\nUI:N - No victim interaction is required; the attacker opens the TPM device, submits a command, and issues the malicious pread() themselves without relying on another user to mount, click, or configure anything.\nS:U - The vulnerability corrupts kernel heap memory in the TPM driver on the same host; it does not by itself cross a VM, container, or IOMMU security boundary to affect a different trust domain.\nC:H - Unchecked pread offsets cause copy_to_user() to read beyond the 4096-byte data_buffer into adjacent kmalloc slab memory (including tpm_space pointers), leaking kernel heap contents to userspace.\nI:H - A successful out-of-bounds pread also executes memset() past data_buffer, zeroing adjacent heap objects such as tpm_space session/context pointers and enabling further memory corruption or control-flow manipulation.\nA:H - KASAN reports slab-out-of-bounds faults on both the copy_to_user read and memset write; corrupting adjacent heap structures can oops or panic the kernel during subsequent TPM operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72135","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72221","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Reachable over TCP by any remote peer of an in-kernel NFS/RPC server (nfsd) via the pre-auth RPC_AUTH_TLS NULL-procedure STARTTLS path that invokes svc_tcp_handshake() on the accepted SUNRPC transport.\nAC:L - The attacker controls both sides of the race by timing TLS client handshake messages against the fixed 5-second SVC_HANDSHAKE_TO and opening many parallel connections to reliably hit the cancel-lost window.\nPR:N - No credentials or export authorization are required; svcauth_tls_accept() accepts empty AUTH_TLS on RPC NULL from any TCP client, and svcauth_unix_set_client() skips IP export checks when rq_proc==0.\nUI:N - Exploitation requires only scripted network connections and TLS client traffic to nfsd; no victim user interaction such as mounting a filesystem or opening a file is needed.\nS:U - Memory corruption occurs in nfsd kernel worker context on the same host; impact is kernel privilege compromise within the server security authority, not a VM escape or IOMMU boundary bypass.\nC:H - A second svc_tcp_handshake() can call init_completion() while svc_tcp_handshake_done() concurrently calls complete_all(), corrupting the embedded swait_queue in heap-allocated svc_sock and enabling arbitrary kernel memory disclosure.\nI:H - Corrupting completion wait-queue metadata in the svc_sock heap object can be leveraged for arbitrary kernel writes and control-flow hijacking to achieve local privilege escalation on the NFS server.\nA:H - The swait_queue corruption can trigger kernel oops/panic, and the alternate race path tears down connections whose TLS handshake is about to succeed, enabling repeatable remote denial-of-service against nfsd."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72221","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72222","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in nfsd's server-side SUNRPC/TCP TLS handshake (net/sunrpc/svcsock.c), reached when a remote peer connects to port 2049 and sends a pre-authentication AUTH_TLS NULL STARTTLS probe that triggers svc_tcp_handshake() via svcauth_tls_accept().\nAC:L - The attacker controls both sides of the race by initiating AUTH_TLS handshakes and concurrently resetting/closing TCP or waiting for SVC_HANDSHAKE_TO while tlshd delivers completion; repeated parallel connections make the overlap window reliably reachable.\nPR:N - AUTH_TLS is processed on RPC procedure 0 before credentials are verified, so an unauthenticated remote client can reach svc_tcp_handshake() and the asynchronous callback without any account, export access, or kernel capability.\nUI:N - nfsd worker threads automatically accept the TCP connection, process the STARTTLS probe, run the TLS handshake, and handle teardown/completion callbacks without any local user or administrator action.\nS:U - Exploitation corrupts kernel memory on the NFS server host itself and does not cross a VM-guest/host, sandbox, or IOMMU security boundary; impact stays within the kernel's security authority.\nC:H - svc_tcp_handshake_done() use-after-frees svc_sock and performs set_bit/clear_bit RMW on freed xpt_flags plus complete_all() on freed sk_handshake_done, a slab-corruption UAF that can disclose arbitrary kernel memory.\nI:H - The same UAF delivers attacker-timed writes into reclaimed slab slots through atomic bit operations and wait-queue list updates, enabling heap grooming and further kernel memory corruption for arbitrary modification or code execution.\nA:H - Slab corruption and UAF during handshake completion can cause kernel oops/panic, and unauthenticated remote peers can trigger the fault repeatedly by overlapping TLS handshake completion with connection close."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72222","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72251","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit in nf_nat_sip() from sip_help_udp/tcp() during nf_confirm() on POST_ROUTING/LOCAL_IN while processing attacker-supplied SIP/UDP or SIP/TCP packets traversing a netfilter NAT gateway, so exploitation is via remote network traffic rather than local syscalls or physical access.\nAC:L - Once nf_conntrack_sip and nf_nat_sip are active on a NATed SIP flow, a remote peer can set forced_dport with a crafted Via header and drive the reply-path skb_ensure_writable() reallocation on cloned skbs without races or rare layout luck.\nPR:N - Exploitation needs no privileges on the victim kernel; a remote SIP endpoint only has to send malicious SIP through an already-configured SIP conntrack/NAT helper, with no authentication or local access to the firewall or router.\nUI:N - No victim user action is required beyond normal automated packet forwarding; the SIP helper parses and NAT-rewrites attacker-supplied SIP data in softirq during connection-tracking confirmation without opening files, clicking links, or mounting filesystems.\nS:U - Impact stays within kernel netfilter/conntrack memory on the same security authority (for example a NAT firewall, SBC, or VoIP gateway). This is standard kernel memory corruption, not a VM escape, sandbox breakout, or cross-tenant boundary violation.\nC:H - skb_ensure_writable() can free the old linear buffer while *dptr still points into it; sip_help_tcp() then continues parsing with that stale pointer, giving a use-after-free read of freed skb data and enabling disclosure of adjacent kernel heap contents.\nI:H - The stale dptr UAF and, on TCP flows, mistaken nf_nat_mangle_udp_packet() header rewriting corrupt kernel packet-buffer memory; such heap corruption is exploitable with grooming for arbitrary writes, control-flow hijacking, and kernel code execution.\nA:H - Use-after-free and mis-mangled L4 headers during softirq SIP NAT processing can trigger kernel oops/panic or reliably drop or corrupt in-flight VoIP signaling, causing high availability impact on internet-facing NAT/SBC systems handling SIP."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72251","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72262","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl on /dev/snd/controlC* (SNDRV_CTL_IOCTL_TLV_WRITE/READ) through the ALSA control device; there is no network, adjacent-radio, or physical-bus attack surface for this SOF IPC3 kcontrol path.\nAC:L - On affected SOF IPC3 systems with topology bytes_ext controls, an attacker can deterministically trigger the bug by issuing TLV writes with header.length equal to max_size, causing copy_from_user/memcpy to overrun the kzalloc(max_size) buffer by sizeof(struct sof_ipc_ctrl_data).\nPR:L - The fix commit states the overflow is reachable from unprivileged userspace via ALSA TLV kcontrols; any local user who can open the sound control device (typically membership in the audio group on Linux, or an app with audio access on Android/ChromeOS) can reach the vulnerable code without real root.\nUI:N - Exploitation is performed entirely by the attacker issuing ALSA TLV ioctls against an existing bytes_ext kcontrol; no victim click, mount, or other interactive action beyond the attacker's own access to the sound control interface is required.\nS:U - The vulnerability corrupts kernel heap memory from a local userspace context and enables standard kernel privilege escalation or denial of service; it does not cross a VM, container, or IOMMU security boundary into a separate authority.\nC:H - The get path can copy_to_user up to sizeof(struct sof_ipc_ctrl_data) bytes beyond the allocated ipc_control_data buffer, leaking adjacent kernel heap contents; combined with the controllable overflow, this is an out-of-bounds read/memory corruption primitive consistent with arbitrary disclosure potential.\nI:H - The put path performs an out-of-bounds heap write of up to sizeof(struct sof_ipc_ctrl_data) bytes past the kzalloc(max_size) allocation (including via the err_restore memcpy), enabling heap metadata/object corruption that can be developed into arbitrary kernel write or code execution.\nA:H - Heap out-of-bounds writes of roughly 96 bytes into adjacent slab objects can corrupt kernel structures and trigger oops/panic or wedged audio/subsystem state; repeated TLV operations make denial of service reliably achievable even without full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72262","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72288","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached only from KVM guest MMIO traps on GICv3 redistributor GICR_CTLR LPI-disable writes, ITS MOVI affinity changes, and vCPU-exit paths into vgic_prune_ap_list(); no network-facing host protocol is involved.\nAC:L - A guest controls all three racing vCPUs by pinning threads to concurrently issue ITS MOVI, cross-vCPU GICR_CTLR LPI-disable writes, and vCPU exits that invoke vgic_prune_ap_list(); the attacker creates and wins the race rather than depending on uncontrollable host timing.\nPR:N - No host privileges are required beyond running code in an assigned KVM guest (e.g. a cloud VM tenant on arm64); exploitation needs guest-kernel access to GIC/ITS MMIO, not host root or capabilities in the init namespace.\nUI:N - Exploitation is fully attacker-driven from within a multi-vCPU guest VM and does not require any victim user or administrator action on the host.\nS:C - The use-after-free corrupts host-kernel heap memory (struct vgic_irq) from guest-controlled VGIC operations, crossing the guest-to-host virtualization security boundary with VM-escape impact.\nC:H - vgic_flush_pending_lpis() can free the LPI vgic_irq while vgic_prune_ap_list() still dereferences it after reacquiring dropped locks, yielding a kernel heap use-after-free exploitable for arbitrary host memory disclosure via heap grooming.\nI:H - The dangling vgic_irq pointer permits attacker-influenced writes through irq_lock, list_head, vcpu, and target_vcpu fields during ap_list migration, enabling host control-flow or data corruption primitives.\nA:H - The race frees live kernel objects still referenced by the ap_list migration path, causing host kernel oops, panic, or hang during list_del, lock operations, or subsequent LPI delivery on arm64 KVM hosts."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72288","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72289","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only from KVM guest execution paths—GICv3 redistributor GICR_CTLR LPI-disable MMIO traps into vgic_flush_pending_lpis() and vCPU exit/sync paths into vgic_prune_ap_list()—not from any remote network, adjacent-radio, or physical-device interface on the host.\nAC:L - A malicious multi-vCPU guest controls both racing sides by pinning threads, changing LPI affinity via ITS so an interrupt must migrate off one vCPU's ap_list, and concurrently disabling LPIS on that redistributor; the attacker creates the window rather than depending on uncontrollable host timing or memory layout.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant on arm64 KVM who needs no host privileges beyond code already running inside the assigned guest; exploitation uses guest-kernel GIC MMIO/ITS operations, not host root, CAP_SYS_ADMIN in the init namespace, or additional /dev/kvm access beyond having a VM.\nUI:N - Exploitation is fully attacker-driven from within the guest VM through deliberate LPI setup, affinity changes, and timed GICR_CTLR writes; no victim user or administrator action on the host is required beyond normal VM operation.\nS:C - Double list_del()/list_add_tail() on host-kernel ap_list linkages corrupts KVM VGIC state from guest-controlled interrupt operations, crossing the guest-to-host virtualization security boundary with VM-escape-class impact rather than confining damage to the attacker's VM.\nC:H - Corrupting detached ap_list pointers and inserting them into another vCPU's ap_list_head enables out-of-bounds kernel linked-list traversal and disclosure of adjacent kmalloc slab memory (struct vgic_irq and neighboring objects); per kernel guidance, this list corruption is leverageable for arbitrary host memory read primitives.\nI:H - The vulnerable path performs list_del() on an already removed entry and may follow with list_add_tail() onto another vCPU's ap_list, letting a guest steer kernel list pointers and overwrite adjacent vgic_irq/host heap metadata for control-flow or data corruption on the hypervisor.\nA:H - Re-running list_del() on an entry already removed by vgic_flush_pending_lpis() dereferences poisoned list pointers and corrupts live ap_list_heads, causing immediate host kernel BUG/oops/panic or persistent interrupt-delivery failure during subsequent VGIC processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72289","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72317","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in the SUNRPC TCP-with-TLS client connect_worker processing a remote NFS server's TLS handshake; a malicious or misconfigured server can induce fatal handshake failure over the network before the delayed worker runs, matching network-reachable kTLS/RPC-with-TLS client paths.\nAC:L - An attacker operating a reachable NFS endpoint can reliably cause fatal TLS handshake failure (e.g., reject mTLS client certificates or send TLS alerts) and influence reconnect timing/backoff so client teardown frees rpc_clnt before the queued connect_worker executes.\nPR:N - Exploitation requires no privileges on the victim host; a remote peer only needs the client kernel to initiate or re-establish an NFS RPC-with-TLS connection, and TLS handshake processing occurs before NFS authentication completes.\nUI:N - No further victim action is needed once an NFS xprtsec=tls/mtls mount exists because automatic reconnect after server-induced disconnect or handshake failure can trigger the race without additional user interaction.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is standard local kernel compromise rather than crossing VM, container, or IOMMU security scopes.\nC:H - This is a kernel heap use-after-free where xs_tcp_tls_setup_socket reads multiple fields from a freed rpc_clnt (including cl_cred and cl_program), enabling information disclosure and further exploitation beyond a simple crash.\nI:H - Use-after-free of rpc_clnt permits corrupting allocator metadata and adjacent kernel objects; freed-object reuse can yield arbitrary write or control-flow hijack primitives, not merely authenticated data alteration.\nA:H - Accessing the freed rpc_clnt produces a refcount_t underflow and kernel oops/panic; even unsuccessful exploitation typically crashes or hangs the system, and repeated reconnect attempts can deny availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72317","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72339","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the qede NIC RX fastpath reached when remote Ethernet frames are received, hardware posts completion queue entries, and NAPI runs qede_poll() -> qede_rx_int() -> qede_rx_process_cqe()/qede_tpa_start() into qede_rx_build_skb() or qede_tpa_rx_build_skb().\nAC:L - An attacker can reliably trigger build_skb() NULL returns by flooding the interface with frames larger than rx_copybreak (256 bytes) to exhaust GFP_ATOMIC skb slab allocations, then the off-by-one BD consumption desynchronizes the ring without races or victim-specific state.\nPR:N - No local account, capability, or authentication is required; any unauthenticated remote host that can send IP/Ethernet traffic to a server using a Marvell/QLogic FastLinQ qede NIC can hit the vulnerable RX/TPA handlers.\nUI:N - Exploitation requires no victim interaction beyond normal network operation; packet reception, MSI-X interrupt handling, and NAPI polling process attacker-supplied frames automatically in kernel context.\nS:U - The flaw corrupts kernel heap metadata (DMA page refcounts and SLUB freelists) within the host kernel security boundary; it does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - BD ring desynchronization corrupts DMA page reference counts and can corrupt SLUB freelists; this class of kernel heap corruption is exploitable for arbitrary kernel memory reads and information disclosure beyond a simple crash.\nI:H - SLUB freelist corruption from mismatched BD ring consumption enables arbitrary kernel memory writes and control-flow hijacking primitives, supporting local privilege escalation or arbitrary code execution in kernel context.\nA:H - Reference-count and SLUB corruption from the desynchronized BD ring can cause kernel BUG/oops/panic or a wedged RX datapath, resulting in complete loss of host availability on affected systems."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72339","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72389","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation is via local RTNETLINK/ioctl to create a down bridge, enable kernel STP, enslave ports, and delete the bridge; remote STP BPDU handling is blocked when IFF_UP is clear, so the arming path that leaves timers active on a down bridge is local.\nAC:L - The public PoC uses a reliable, attacker-controlled netlink sequence (down bridge + kernel STP + port state progression + dellink) without winning races; per-port forward-delay timers deterministically reach br_topology_change_detection and arm topology_change_timer before deletion.\nPR:L - All reachable paths (RTM_NEWLINK/DELLINK, IFLA_BR_STP_STATE, enslaving ports) require CAP_NET_ADMIN, which unprivileged users can obtain in user/network namespaces (unshare -Urn, Kubernetes NET_ADMIN, LXC/libvirt network namespaces).\nUI:N - Triggering requires only programmatic bridge configuration by the attacker; no victim must click, mount, or open anything beyond the attacker's own netlink operations.\nS:U - Impact is kernel memory corruption and privilege escalation within the same kernel/host security domain; it does not cross a VM, container-to-host, or IOMMU boundary by itself.\nC:H - Use-after-free of the net_device/net_bridge kmalloc object lets an attacker reclaim freed slab memory and obtain arbitrary kernel read/disclosure primitives from corrupted timer and bridge structures.\nI:H - Disclosed analysis and PoC show the dangling timer callback can hijack control flow by reclaiming the freed object with attacker-controlled data, replacing the timer function pointer for arbitrary kernel code execution.\nA:H - Deleting the bridge with active STP timers queued causes the per-CPU timer wheel to invoke callbacks on freed memory, producing kernel BUG/oops/panics and denial of service even if full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72389","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74345","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit while processing attacker-supplied MPA/TCP data on an inbound SIW listener socket during connection establishment, which is a standard network protocol path analogous to other in-kernel TCP service handlers.\nAC:L - An attacker fully controls the TCP connection and malformed MPA request bytes that deterministically fail parsing and drive the endpoint teardown path where the refcount bug frees the cep before it is accessed again.\nPR:N - Exploitation requires only the ability to open a TCP connection to a host running an SIW RDMA listener; the MPA handshake is unauthenticated and occurs before any RDMA credentials or local privileges are established.\nUI:N - No end-user action is required at exploit time; the kernel processes the malicious inbound connection automatically once an administrator has started an RDMA listener service.\nS:U - Impact is confined to kernel memory corruption and potential host privilege escalation within the same kernel security authority, not a VM escape or cross-authority boundary such as guest-to-hypervisor.\nC:H - The vulnerability is a slab use-after-free on a freed siw_cep object; UAF on attacker-influenced connection teardown enables heap grooming and arbitrary kernel memory read primitives beyond a simple crash.\nI:H - Use-after-free of the connection endpoint structure in kernel heap can be leveraged for controlled writes and code execution via object reuse and function pointer/callback corruption, not merely data integrity of a single field.\nA:H - The bug was reproduced as a KASAN slab-use-after-free in siw_cm_work_handler during malformed MPA processing, which can cause kernel oops/panic and denial of service on the target host."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74345","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74377","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires mutating mmap'd receive WQEs through /dev/infiniband/uverbs; inbound RoCE packets (rxe_udp_encap_recv→rxe_rcv→rxe_receiver) only trigger processing and cannot alter WQE fields without local control of the userspace-mapped receive queue.\nAC:L - The attacker controls both sides of the TOCTOU—userspace threads racing num_sge/sge edits while posting recv WRs and driving inbound RoCE SEND/WRITE traffic—so out-of-bounds reads in rxe_resp_check_length() and copy_data() are reliably triggerable with retries.\nPR:L - uverbs_devnode() publishes /dev/infiniband/uverbsN as mode 0666, letting any local account create userspace QPs and mmap receive queues; rxe link setup needs CAP_NET_ADMIN obtainable in a user+network namespace via unshare -Urn, matching PR:L kernel guidance.\nUI:N - Exploitation is entirely self-driven from the attacker's own RDMA verbs client and concurrent userspace threads; no victim user action, mount, or file open is required.\nS:U - Impact is kernel memory corruption and local privilege escalation within the host kernel security authority, not a VM guest-to-host escape, IOMMU/DMA boundary bypass, or other cross-scope compromise.\nC:H - Inflating num_sge or rewriting sge entries during processing causes out-of-bounds reads in rxe_resp_check_length() and copy_data() beyond the allocated WQE slot, potentially into adjacent vmalloc/kernel memory, enabling arbitrary kernel information disclosure.\nI:H - copy_data() walks attacker-forged out-of-bounds sge entries and performs rxe_mr_copy writes of incoming RDMA payload into MR-backed memory; combined with queue overruns this yields controlled memory corruption exploitable for arbitrary write and code execution.\nA:H - Processing a WQE with an attacker-inflated num_sge causes the kernel to walk far past valid sge slots, dereferencing invalid pointers and corrupting memory, reliably producing kernel oops/panic and total loss of availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74377","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74378","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local process with mmap write access to the SRQ receive queue shared with the kernel; although incoming RoCE/UDP packets trigger get_srq_wqe(), a remote peer cannot modify num_sge in the victim's userspace-mapped WQE buffer, so the TOCTOU overflow cannot be achieved from the network alone.\nAC:L - The attacker controls both sides of the race: a userspace thread that repeatedly rewrites num_sge in the mmap'd SRQ entry and the thread/process that posts recv WQEs and receives the triggering RoCE Send/Write packet, making the TOCTOU window reliably winnable without external timing luck.\nPR:L - An unprivileged local user with access to /dev/infiniband/uverbs can create an SRQ (mmap'd queue), associate a QP, and post recv buffers via ibverbs; rxe device setup via \"rdma link add type rxe\" is reachable with CAP_NET_ADMIN inside a user namespace (unshare -Urn).\nUI:N - No victim user interaction is required; the attacker operates their own malicious RDMA userspace process and can self-trigger the vulnerable responder path with RoCE request packets once SRQ/QP resources are configured.\nS:U - The heap overflow corrupts kernel memory within the rxe_qp responder context on the same host kernel, enabling local privilege escalation rather than crossing a VM, container, or IOMMU security boundary to impact a different authority.\nC:H - The attacker-controlled memcpy size causes an out-of-bounds copy from the mmap'd SRQ ring buffer and overflows the fixed qp->resp.srq_wqe kernel buffer, enabling adjacent kernel heap data disclosure and providing primitives that can be developed into arbitrary kernel memory reads.\nI:H - Overflowing qp->resp.srq_wqe corrupts subsequent fields in rxe_resp_info/rxe_qp (e.g., responder resource pointers and state), giving a kernel heap buffer overflow that can be leveraged for arbitrary kernel memory writes and local privilege escalation.\nA:H - Corrupting responder state inside rxe_qp can cause kernel oops/panic or wedged RDMA processing during packet handling; even failed exploitation attempts can crash the kernel through use of corrupted function pointers and queue state."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74378","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74390","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl on /dev/infiniband/uverbs to register CQ/QP/SRQ memory via irdma_reg_user_mr; the bug is not reachable from remote iWARP/RoCE packet handling.\nAC:L - An attacker fully controls reg_type, cq_pages/sq_pages/rq_pages, and umem size; triggering lvl==0 with many DMA blocks is deterministic and needs no races or special memory layout.\nPR:L - Any unprivileged local user who can open the uverbs device (mode 0666) and use the RDMA NIC—typical on cloud/HPC RDMA nodes—can invoke the vulnerable MR registration path without real root.\nUI:N - No victim interaction is required; the attacker triggers the overflow directly through their own RDMA verbs memory registration calls.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel security boundary, not a cross-VM or cross-IOMMU sandbox escape.\nC:H - The out-of-bounds write of attacker-influenced DMA addresses into adjacent irdma_mr/iwpbl heap metadata can be leveraged for arbitrary kernel memory read primitives, not merely a bounded leak.\nI:H - Controlled out-of-bounds u64 writes past pgaddrmem[4] corrupt adjacent kernel heap structures and are suitable for control-flow or arbitrary kernel write exploitation.\nA:H - Heap corruption in a kzalloc'd irdma_mr can cause immediate kernel oops/panic during registration or on subsequent use of corrupted queue memory metadata."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74390","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74394","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - SRPT is an in-kernel SCSI RDMA target reached by remote initiators over InfiniBand/RoCE via RDMA/IB CM; malicious SRP_CMD IUs are delivered through `srpt_recv_done()` without any local syscall or physical access.\nAC:L - Once connected on an immediate-data SRPT target (use_srq=0), a malicious initiator deterministically sets `imm_buf->len=0xFFFFFFFF` to wrap `req_size` and bypass checks; no race or attacker-uncontrollable condition is required.\nPR:N - SRPT enables LIO demo mode (`srpt_check_true`), so any remote initiator that completes SRP login on an enabled target gets a dynamic ACL without target-local credentials, root, or CAP_NET_ADMIN on the victim host.\nUI:N - Exploitation requires only attacker-initiated RDMA connection, SRP login, and crafted SRP_CMD traffic; no administrator or other user must mount storage or perform any action on the target.\nS:U - The integer overflow corrupts kernel heap memory and SCSI-target processing within the host kernel's own security authority; it does not cross VM, IOMMU, or container sandbox boundaries.\nC:H - Passing a ~4GB length to `sg_init_one()` on a small receive buffer creates a massive out-of-bounds scatterlist; subsequent target-core DMA/map operations can read far beyond the buffer, enabling arbitrary kernel memory disclosure.\nI:H - The bogus scatterlist gives the block/SCSI target path an attacker-controlled ~4GB kernel memory write/read primitive over adjacent heap objects, exploitable for control-flow hijacking and privilege escalation.\nA:H - Out-of-bounds access from a ~4GB scatterlist on a kilobyte-scale receive buffer readily triggers kernel oops, KASAN faults, or panic, denying availability even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74394","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74488","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when the mwifiex driver processes attacker-supplied A-MSDU TDLS frames received over WiFi from a nearby peer, AP, or injector on the same wireless segment, which is an adjacent RF attack vector rather than remote Internet or local syscall access.\nAC:L - Once TDLS-capable mwifiex firmware receives an A-MSDU, the attacker fully controls subframe sizes and TDLS content to trigger either the skb use-after-free or the overstated-length out-of-bounds parse reliably without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation requires only the ability to deliver crafted 802.11 data frames to the victim radio; it does not require any local account, capability, or root access on the Linux host and is not gated by user-namespace privilege boundaries.\nUI:N - No victim user action beyond normal wireless operation is required; the driver parses malicious TDLS subframes automatically during receive and A-MSDU decomposition before forwarding traffic to the network stack.\nS:U - Impact is confined to kernel memory corruption and driver state within the host kernel security authority; it does not by itself cross a VM, container, or IOMMU boundary to affect a separate security domain.\nC:H - The skb use-after-free reads freed sk_buff metadata and the inflated length drives an out-of-bounds IE walk that reads kernel memory beyond the subframe, including attacker-positioned bytes from subsequent A-MSDU subframes, enabling substantial information disclosure.\nI:H - The same out-of-bounds parse copies attacker-controlled IE data from beyond the subframe into heap-allocated sta_node/tdls_cap structures via memcpy, providing a memory-corruption primitive that can be developed into arbitrary kernel write or code execution.\nA:H - Reading skb->len after the parent A-MSDU skb may already be freed can immediately fault or corrupt memory, and the out-of-bounds TDLS element parsing can provoke kernel oopses or panics even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74488","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74496","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is opened only via local FOU_CMD_ADD genetlink into fou_create(); remote UDP can race the dangling sk_user_data read in fou_udp_recv/gue_udp_recv but cannot alone reach the erroneous teardown path.\nAC:L - An attacker with CAP_NET_ADMIN controls both sides: issue a second FOU_CMD_ADD with port 0 to force -EALREADY on fou_add_to_port_list while concurrently sending UDP/GRO traffic to the just-bound ephemeral socket during the kfree window.\nPR:L - FOU_CMD_ADD is gated by GENL_ADMIN_PERM (CAP_NET_ADMIN); the fou genl family is netnsok, so a user with CAP_NET_ADMIN inside unshare -Urn can configure FOU and trigger the failing add path without init-namespace root.\nUI:N - Exploitation is fully programmatic via concurrent netlink FOU_CMD_ADD requests and attacker-controlled UDP packets; no victim mount, file open, or other interactive action is required.\nS:U - Impact is kernel heap corruption and privilege escalation within the same security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Concurrent readers call fou_from_sock() and dereference freed struct fou fields (family, protocol, flags); reclaimed slab contents give attacker-controlled reads and kernel pointer disclosure primitives typical of UAF.\nI:H - Freed struct fou is attacker-reclaimable kmalloc memory; fou_gro_receive indexes inet_offloads[fou->protocol] from the dangling pointer, enabling heap grooming for arbitrary writes and control-flow hijack.\nA:H - Use-after-free in UDP receive/GRO softirq reliably causes KASAN violations and, on production kernels, invalid pointer dereferences or panics when accessing the freed fou object during packet processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74496","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74516","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires triggering KVM nested SVM/AVIC paths via local /dev/kvm ioctls (KVM_CREATE_VM, KVM_CREATE_VCPU, KVM_RUN) from L1; there is no network, adjacent, or physical packet/device path to the vulnerable code.\nAC:L - An L1 attacker fully controls nested VM configuration (x2APIC, AVIC, L2 MSR bitmap, IRQ-window/ExtINT conditions) and can reliably reproduce AVIC inhibition while L2 is active without races or uncontrollable host state.\nPR:H - Reaching the bug requires running nested AMD KVM as L1 (nested virtualization enabled and control of a guest hypervisor), which is not available to an unprivileged host user or via user-namespace capabilities alone without delegated /dev/kvm access.\nUI:N - No victim interaction is required; exploitation is driven entirely by the attacker’s nested hypervisor configuration and KVM_RUN operations once nested virtualization is available.\nS:C - The flaw lets an L1 nested guest hypervisor access the host’s physical x2APIC MSRs, crossing the VM/host security boundary rather than staying within the guest’s own security scope.\nC:H - With x2APIC MSR intercepts left disabled, L1 can read most of the host APIC state (IDs, IRR/ISR, timers, ICR), leaking sensitive host interrupt-controller information beyond the guest boundary.\nI:H - L1 can write host x2APIC MSRs to send arbitrary IPIs, change task priority, and invoke host interrupt vectors (e.g. posted-interrupt wakeup), enabling host integrity compromise beyond mere guest-local effects.\nA:H - Host availability is trivially impacted by injecting spurious or high-priority interrupts to host CPUs; the fix commit demonstrates host kernel warnings and spurious interrupt storms causing denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74516","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74518","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local hugetlb reservation paths (mmap/memfd_create/fault syscalls into region_chg/region_add/region_del); no network protocol or remote packet handler invokes allocate_file_region_entries().\nAC:L - Exploitation needs a race while resv->lock is dropped during GFP_KERNEL allocation, but an attacker can spawn concurrent MAP_SHARED mappers/faulters on one hugetlb inode and controls both sides of that race.\nPR:L - Unprivileged local users can trigger this via memfd_create(MFD_HUGETLB) plus MAP_SHARED mmap/fault activity, or by mapping accessible shared hugetlbfs files, without init-namespace root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the needed concurrent syscalls and shared hugetlb mappings themselves to hit the corrupted list splice retry path.\nS:U - Impact is kernel hugetlb resv_map list/memory corruption on the host; it does not by itself cross a VM, IOMMU, or separate security-authority boundary even though KVM/DPDK hosts are a prime deployment.\nC:H - Without CONFIG_DEBUG_LIST, stale list_splice leaves a kernel-stack pointer in resv->region_cache, producing later use-after-free that can be turned into arbitrary kernel memory read/disclosure primitives.\nI:H - Corrupted region_cache pointers let subsequent region_add/region_del/cache operations write through attacker-influenced list links, enabling heap metadata corruption and potential arbitrary kernel write or code execution.\nA:H - Real host panics were reported on dense KVM hugetlb workloads; DEBUG_LIST kernels BUG on list_add corruption, and default builds can crash from UAF while walking the poisoned region_cache."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74518","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74537","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the Bluetooth ISO stack; iso_conn_ready runs from HCI connection-confirmation events (CIS/BIS/PA sync) driven by LE isochronous traffic from Bluetooth peers within radio range, which is an adjacent attack surface (phones, earbuds, automotive, embedded).\nAC:L - This is a use-after-free race between iso_conn_ready and iso_sock_release/iso_sock_kill; an attacker who controls both an ISO socket close and concurrent HCI completion (e.g., dual-thread connect/close or rapid adjacent CIS/BIS establish-teardown) can reliably trigger it without uncontrollable conditions.\nPR:N - Exploitation requires no elevated credentials on the victim: HCI events are processed for any Bluetooth-enabled device in range, and the racing socket close can occur from automatic stack/daemon teardown during connection setup without the victim performing privileged local actions.\nUI:N - No victim interaction is required when the OS Bluetooth stack (e.g., LE Audio on Android phones or bluetoothd on Linux) automatically manages ISO sockets during pairing, reconnection, or broadcast sync while processing peer-initiated CIS/BIS traffic.\nS:U - The UAF corrupts kernel socket memory and can enable local privilege escalation within the kernel; it does not cross a VM, container, or IOMMU security boundary, so scope remains unchanged.\nC:H - Use-after-free on struct sock after iso_sock_kill frees the socket lets an attacker dereference attacker-influenced freed heap memory, enabling arbitrary kernel memory disclosure via heap grooming and reuse of the sock object.\nI:H - The UAF touches sk->sk_state and sk->sk_state_change during iso_sock_ready on a freed sock, providing a standard kernel heap corruption primitive that can be leveraged for arbitrary write and control-flow hijack.\nA:H - Concurrent iso_sock_kill and iso_conn_ready can dereference freed socket memory, causing kernel oops/panic from invalid lock_sock/sk_state access; UAF in the Bluetooth ISO path is inherently a high-availability risk even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74537","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74556","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised iSCSI target delivers crafted SCSI Command Response PDUs over the established TCP iSCSI session; reception flows through iscsi_sw_tcp_recv/iscsi_tcp_recv_skb into iscsi_tcp_hdr_dissect without local access.\nAC:L - The attacker controls the target and can set DataSegmentLength between 8193 and negotiated max_recv_dlength (open-iscsi commonly 262144) on SCSI_CMD_RSP for any outstanding command ITT; no races or victim-specific heap layout are required.\nPR:N - No privileges on the victim host are needed; a remote attacker acting as or MITMing the iSCSI target sends malicious responses after session login, independent of victim user accounts or capabilities.\nUI:N - On systems with persistent iSCSI sessions (cloud VMs, SAN-boot hosts, Kubernetes iSCSI volumes), exploitation triggers automatically during normal SCSI I/O when command responses are received; no victim action is needed at attack time.\nS:U - Heap corruption is confined to the kernel iSCSI initiator on the affected host; successful exploitation yields kernel compromise or DoS within the same security authority, not a VM escape or cross-boundary scope change.\nC:H - iscsi_tcp_segment_recv memcpy writes up to max_recv_dlength bytes into an 8192-byte conn->data buffer, causing a large heap overflow whose controlled corruption can be leveraged for arbitrary kernel memory disclosure.\nI:H - Attacker-controlled response data is copied past the fixed conn->data allocation via iscsi_tcp_data_recv_prep/iscsi_segment_init_linear, enabling heap metadata/object corruption exploitable for arbitrary kernel write and privilege escalation.\nA:H - Overflowing the conn->data heap buffer can immediately corrupt adjacent kernel allocations and cause oops/panic; a malicious target can repeatedly trigger this on active sessions to deny storage availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74556","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74581","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - fib6_rule_suppress() runs on every IPv6 route lookup via fib6_rule_lookup(), including ip6_route_input() for received packets and icmp6/icmpv6 redirect handlers; WireGuard/VPN servers commonly deploy suppress_prefixlength rules (wg-quick), so remote IPv6 traffic to those hosts reaches the bug.\nAC:L - Once suppress_prefixlength IPv6 policy routing rules exist, any matching packet deterministically triggers fib6_rule_suppress() to release the route while leaving a stale res->rt6 pointer; no race or uncontrollable memory layout is required.\nPR:N - Remote exploitation needs only the ability to send IPv6 packets through a host whose operator already configured suppress rules (e.g., wg-quick); CAP_NET_ADMIN is an admin deployment prerequisite, not attacker privilege on the target.\nUI:N - No victim action is required beyond normal delivery of attacker-generated IPv6 traffic (or ICMPv6 redirect) to a host performing policy-route lookup.\nS:U - The stale rt6_info/dst_entry UAF corrupts kernel heap memory within the same host security boundary; it is not a VM escape or cross-authority sandbox break.\nC:H - Returning a released rt6_info leaves a dangling dst_entry in ip6_dst_cache; subsequent reads through ip6_dst_idev(), dst metrics, or error paths are classic slab UAF with attacker-influencable heap reuse via sustained IPv6 traffic.\nI:H - Double-free/imbalanced rcuref put and post-free use of rt6_info fields give heap corruption primitives; UAF on dst/route cache objects is routinely leveraged for kernel write and control-flow hijack.\nA:H - Commit explicitly reports rcuref_put_slowpath() WARN from dst_release() on the freed route; UAF and refcount corruption can oops/panic the kernel, fully denying availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74582","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb->data before skb->head, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74612","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":10,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Remote packets routed through container/host veth pairs reach veth_xdp_rcv_skb() after veth_xmit on the peer; cloud and edge nodes routinely forward Internet traffic across veth links with XDP attached, matching the reproduced UDP receive path.\nAC:L - The fix commit shows 10/10 reliable reproduction with a 60000-byte UDP datagram and XDP bpf_xdp_adjust_tail()/bpf_xdp_pull_data() fragment shrink; the attacker controls packet size, timing, and both veth ends without races or uncontrollable kernel state.\nPR:N - Exploitation only requires an XDP program using bpf_xdp_adjust_tail or bpf_xdp_pull_data to already be attached on a reachable veth peer; the remote packet sender needs no local account, capabilities, or authentication to trigger the bad skb length accounting.\nUI:N - No victim interaction is needed beyond normal always-on packet reception and socket delivery; corrupted payloads and leaked kernel metadata are produced automatically when a userspace process reads the affected datagram.\nS:C - veth links intentionally cross container/host network namespaces on multi-tenant servers, and skb_shared_info metadata plus kernel pointers leaked into a tenant userspace recv buffer exceed that tenant's authorized security boundary.\nC:H - Desynchronized skb->len makes skb_headlen() exceed the real linear tail, so __skb_datagram_iter() copies up to 1024 bytes past the skb into userspace, exposing nr_frags, xdp_frags_size, and a kernel pointer from skb_shinfo(skb)->frags[0].\nI:H - The same length mismatch inflates the linear region, displacing and truncating real datagram bytes in the delivered UDP buffer and corrupting application-visible data beyond intended packet bounds while compounding misuse of leaked kernel metadata.\nA:H - bpf_xdp_pull_data() can leave frags present while the old __skb_put() path hits SKB_LINEAR_ASSERT()/BUG_ON on nonlinear skbs; the commit reports deterministic kernel asserts and crashes in addition to datagram corruption."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74612","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74669","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74669","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74695","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug fires in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS when remotely sourced IPv4/IPv6 packets matching an offloaded flow are received on nftables flowtable-bound interfaces, not via netlink configuration APIs.\nAC:L - Once a flowtable ingress hook and offloaded TCP/UDP flow exist, an attacker can reliably send matching traffic that reaches FLOW_OFFLOAD_XMIT_NEIGH or the XFRM offload path with a ref-counted skb dst; syzbot reproduced this without uncontrollable races.\nPR:N - Exploitation requires only sending network traffic through an already deployed nftables flow-offload path on an ingress device; no local account, authentication, or CAP_NET_ADMIN on the victim is needed to trigger the leak.\nUI:N - No victim interaction is required beyond normal network delivery; packets are processed automatically in softirq on the netdev ingress netfilter hook without opening files or mounting filesystems.\nS:U - Impact is confined to kernel refcount imbalance and availability degradation on the affected host; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:N - The flaw leaks a dst_entry reference by overwriting skb->_skb_refdst without releasing the prior dst; it does not expose kernel memory or provide an arbitrary read primitive.\nI:N - No unauthorized data modification occurs; the skb is forwarded using the intended flowtable destination while the previous dst reference is orphaned, not corrupted into a controllable write primitive.\nA:H - Each matching packet leaks a dst_entry refcount on the flowtable fast path, enabling sustained unauthenticated remote memory exhaustion on high-volume routers; CONFIG_DEBUG_NET builds also emit WARN_ON_ONCE during the overwrite."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74695","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-80722","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - Malformed S1G TWT setup action frames reach mac80211 via normal WiFi RX (driver -> ieee80211_rx_h_action -> ieee80211_process_rx_twt_action -> ieee80211_s1g_rx_twt_setup); an adjacent attacker within radio range sends crafted 802.11 management frames to a vulnerable AP.\nAC:L - The attacker fully controls the TWT element length and payload; ieee80211_process_rx_twt_action() only validates two bytes of req_type before queueing, so a short individual agreement reliably reaches drv_add_twt_setup() without races or victim-specific timing.\nPR:N - No Linux privileges on the victim AP are required; exploitation needs only normal 802.11 association as a WiFi client to an S1G AP with twt_responder enabled and a driver implementing add_twt_setup (e.g. MediaTek mt7915/mt7996).\nUI:N - No deliberate victim action is needed beyond operating an S1G AP that accepts associated stations; the attacker directly injects the malformed TWT setup frame and mac80211 processes it automatically on receive.\nS:U - Impact is kernel/driver heap memory corruption on the AP host within the same security authority; it does not cross VM, IOMMU, or sandbox boundaries (standard kernel compromise scope).\nC:H - drv_add_twt_setup(), its tracepoint, and driver callbacks read the full ieee80211_twt_params (twt, min_twt_dur, mantissa, channel) beyond the validated skb bounds, causing out-of-bounds reads of adjacent skb/heap memory that can disclose kernel data.\nI:H - MediaTek add_twt_setup() handlers write twt_agrt fields (req_type, min_twt_dur, twt) past the undersized params block into skb tail/heap memory, providing out-of-bounds write primitives exploitable for further memory corruption or code execution.\nA:H - Out-of-bounds access in mac80211/driver TWT setup can kernel-oops the AP or hang/crash WiFi firmware when corrupted parameters are programmed into hardware TWT state from attacker-controlled short frames."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80722","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4369-1","advisory_id":"ddb2c304-0ccc-4573-96b3-606b178f0dff","event_types":["advisory"],"published_at":"2026-10-25T22:45:55.826745+00:00","technologies":["core-osv","kernel-64kb","kernel-default","kernel-default-base","kernel-docs","kernel-livepatch-sle15-sp6-update-31","kernel-obs-build","kernel-source","kernel-syms","kernel-zfcpdump"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:46:28+00:00","detail_url":"/advisories/advisory%3Addb2c304-0ccc-4573-96b3-606b178f0dff","group":{"id":"advisory:ddb2c304-0ccc-4573-96b3-606b178f0dff","revision":1,"primary_event_id":71343,"change":"published","superseded_by":[],"changed":{"id":71343,"cve_ids":["CVE-2024-44981","CVE-2024-57841","CVE-2025-38469","CVE-2025-40022","CVE-2025-68179","CVE-2025-68214","CVE-2025-71104","CVE-2026-23210","CVE-2026-23230","CVE-2026-23451","CVE-2026-23454","CVE-2026-31502","CVE-2026-43147","CVE-2026-43456","CVE-2026-45968","CVE-2026-52910","CVE-2026-52912","CVE-2026-52929","CVE-2026-52977","CVE-2026-52994","CVE-2026-53059","CVE-2026-53110","CVE-2026-53163","CVE-2026-53260","CVE-2026-53264","CVE-2026-53365","CVE-2026-53366","CVE-2026-53381","CVE-2026-63801","CVE-2026-63823","CVE-2026-63827","CVE-2026-63879","CVE-2026-63881","CVE-2026-63886","CVE-2026-63887","CVE-2026-63888","CVE-2026-63920","CVE-2026-63944","CVE-2026-63970","CVE-2026-63972","CVE-2026-63973","CVE-2026-63992","CVE-2026-64000","CVE-2026-64002","CVE-2026-64007","CVE-2026-64010","CVE-2026-64011","CVE-2026-64015","CVE-2026-64018","CVE-2026-64029","CVE-2026-64034","CVE-2026-64048","CVE-2026-64098","CVE-2026-64109","CVE-2026-64114","CVE-2026-64115","CVE-2026-64121","CVE-2026-64217","CVE-2026-64247","CVE-2026-64266","CVE-2026-64268","CVE-2026-64304","CVE-2026-64312","CVE-2026-64355","CVE-2026-64383","CVE-2026-64384","CVE-2026-64385","CVE-2026-64386","CVE-2026-64387","CVE-2026-64423","CVE-2026-64450","CVE-2026-64481","CVE-2026-64524","CVE-2026-64527","CVE-2026-64541","CVE-2026-64543","CVE-2026-64562","CVE-2026-64563","CVE-2026-64572","CVE-2026-64577","CVE-2026-64581","CVE-2026-64593","CVE-2026-68121","CVE-2026-68133","CVE-2026-68136","CVE-2026-68138","CVE-2026-68155","CVE-2026-68158","CVE-2026-68159","CVE-2026-68160","CVE-2026-68202","CVE-2026-68397","CVE-2026-68398","CVE-2026-68417","CVE-2026-68426","CVE-2026-68428","CVE-2026-68480","CVE-2026-72020","CVE-2026-72069","CVE-2026-72072","CVE-2026-72083","CVE-2026-72084","CVE-2026-72123","CVE-2026-72135","CVE-2026-72221","CVE-2026-72222","CVE-2026-72251","CVE-2026-72262","CVE-2026-72288","CVE-2026-72289","CVE-2026-72317","CVE-2026-72339","CVE-2026-72389","CVE-2026-74345","CVE-2026-74377","CVE-2026-74378","CVE-2026-74390","CVE-2026-74394","CVE-2026-74454","CVE-2026-74488","CVE-2026-74496","CVE-2026-74516","CVE-2026-74518","CVE-2026-74537","CVE-2026-74556","CVE-2026-74581","CVE-2026-74582","CVE-2026-74612","CVE-2026-74669","CVE-2026-74695","CVE-2026-80722"],"payload":{"kind":"advisory","title":"Security update for the Linux Kernel","summary":"The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731). - CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225). - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604). - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072). - CVE-2026-43147: Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (bsc#1264642). - CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734). - CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023). - CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659). - CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000). - CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004). - CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242). - CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126). - CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655). - CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985). - CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqu","evidence":"osv:SUSE-SU-2026:4369-1","products":[{"name":{"value":"kernel-default","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-livepatch-SLE15-SP6_Update_31","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1-150600.13.3.4","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-64kb","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1.150600.12.62.4","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-zfcpdump","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1.150600.12.62.4","evidence":"/affected/12/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/13/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/13/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/14/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/14/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/15/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/15/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/16/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/16/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4369-1","aliases":["SUSE-SU-2026:4369-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.135.1","kernel-default-livepatch-devel":"6.4.0-150600.23.135.1","kernel-livepatch-6_4_0-150600_23_135-default":"1-150600.13.3.4"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.3.4"}]}],"package":{"name":"kernel-livepatch-SLE15-SP6_Update_31","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_31&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.135.1","kernel-default-livepatch-devel":"6.4.0-150600.23.135.1","kernel-livepatch-6_4_0-150600_23_135-default":"1-150600.13.3.4"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-64kb","purl":"pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-zfcpdump","purl":"pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}}],"modified":"2026-10-02T18:42:50.599983491Z","provider":"osv","upstream":["CVE-2024-44981","CVE-2024-57841","CVE-2025-38469","CVE-2025-40022","CVE-2025-68179","CVE-2025-68214","CVE-2025-71104","CVE-2026-23210","CVE-2026-23230","CVE-2026-23451","CVE-2026-23454","CVE-2026-31502","CVE-2026-43147","CVE-2026-43456","CVE-2026-45968","CVE-2026-52910","CVE-2026-52912","CVE-2026-52929","CVE-2026-52977","CVE-2026-52994","CVE-2026-53059","CVE-2026-53110","CVE-2026-53163","CVE-2026-53260","CVE-2026-53264","CVE-2026-53365","CVE-2026-53366","CVE-2026-53381","CVE-2026-63801","CVE-2026-63823","CVE-2026-63827","CVE-2026-63879","CVE-2026-63881","CVE-2026-63886","CVE-2026-63887","CVE-2026-63888","CVE-2026-63920","CVE-2026-63944","CVE-2026-63970","CVE-2026-63972","CVE-2026-63973","CVE-2026-63992","CVE-2026-64000","CVE-2026-64002","CVE-2026-64007","CVE-2026-64010","CVE-2026-64011","CVE-2026-64015","CVE-2026-64018","CVE-2026-64029","CVE-2026-64034","CVE-2026-64048","CVE-2026-64098","CVE-2026-64109","CVE-2026-64114","CVE-2026-64115","CVE-2026-64121","CVE-2026-64217","CVE-2026-64247","CVE-2026-64266","CVE-2026-64268","CVE-2026-64304","CVE-2026-64312","CVE-2026-64355","CVE-2026-64383","CVE-2026-64384","CVE-2026-64385","CVE-2026-64386","CVE-2026-64387","CVE-2026-64423","CVE-2026-64450","CVE-2026-64481","CVE-2026-64524","CVE-2026-64527","CVE-2026-64541","CVE-2026-64543","CVE-2026-64562","CVE-2026-64563","CVE-2026-64572","CVE-2026-64577","CVE-2026-64581","CVE-2026-64593","CVE-2026-68121","CVE-2026-68133","CVE-2026-68136","CVE-2026-68138","CVE-2026-68155","CVE-2026-68158","CVE-2026-68159","CVE-2026-68160","CVE-2026-68202","CVE-2026-68397","CVE-2026-68398","CVE-2026-68417","CVE-2026-68426","CVE-2026-68428","CVE-2026-68480","CVE-2026-72020","CVE-2026-72069","CVE-2026-72072","CVE-2026-72083","CVE-2026-72084","CVE-2026-72123","CVE-2026-72135","CVE-2026-72221","CVE-2026-72222","CVE-2026-72251","CVE-2026-72262","CVE-2026-72288","CVE-2026-72289","CVE-2026-72317","CVE-2026-72339","CVE-2026-72389","CVE-2026-74345","CVE-2026-74377","CVE-2026-74378","CVE-2026-74390","CVE-2026-74394","CVE-2026-74454","CVE-2026-74488","CVE-2026-74496","CVE-2026-74516","CVE-2026-74518","CVE-2026-74537","CVE-2026-74556","CVE-2026-74581","CVE-2026-74582","CVE-2026-74612","CVE-2026-74669","CVE-2026-74695","CVE-2026-80722"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264369-1/","https://bugzilla.suse.com/1230238","https://bugzilla.suse.com/1235944","https://bugzilla.suse.com/1247455","https://bugzilla.suse.com/1250748","https://bugzilla.suse.com/1252682","https://bugzilla.suse.com/1254306","https://bugzilla.suse.com/1255225","https://bugzilla.suse.com/1255250","https://bugzilla.suse.com/1256708","https://bugzilla.suse.com/1257154","https://bugzilla.suse.com/1258430","https://bugzilla.suse.com/1258517","https://bugzilla.suse.com/1260522","https://bugzilla.suse.com/1261604","https://bugzilla.suse.com/1261780","https://bugzilla.suse.com/1263072","https://bugzilla.suse.com/1264642","https://bugzilla.suse.com/1264734","https://bugzilla.suse.com/1265449","https://bugzilla.suse.com/1265928","https://bugzilla.suse.com/1266402","https://bugzilla.suse.com/1267023","https://bugzilla.suse.com/1268659","https://bugzilla.suse.com/1269000","https://bugzilla.suse.com/1269004","https://bugzilla.suse.com/1269126","https://bugzilla.suse.com/1269238","https://bugzilla.suse.com/1269242","https://bugzilla.suse.com/1269306","https://bugzilla.suse.com/1269655","https://bugzilla.suse.com/1269731","https://bugzilla.suse.com/1269792","https://bugzilla.suse.com/1269981","https://bugzilla.suse.com/1269985","https://bugzilla.suse.com/1271365","https://bugzilla.suse.com/1271366","https://bugzilla.suse.com/1271830","https://bugzilla.suse.com/1272179","https://bugzilla.suse.com/1272182","https://bugzilla.suse.com/1272230","https://bugzilla.suse.com/1272381","https://bugzilla.suse.com/1272385","https://bugzilla.suse.com/1272390","https://bugzilla.suse.com/1272569","https://bugzilla.suse.com/1272571","https://bugzilla.suse.com/1272662","https://bugzilla.suse.com/1272673","https://bugzilla.suse.com/1272680","https://bugzilla.suse.com/1272682","https://bugzilla.suse.com/1272756","https://bugzilla.suse.com/1272798","https://bugzilla.suse.com/1272868","https://bugzilla.suse.com/1272877","https://bugzilla.suse.com/1273030","https://bugzilla.suse.com/1273053","https://bugzilla.suse.com/1273054","https://bugzilla.suse.com/1273105","https://bugzilla.suse.com/1273276","https://bugzilla.suse.com/1273303","https://bugzilla.suse.com/1273311","https://bugzilla.suse.com/1273422","https://bugzilla.suse.com/1273426","https://bugzilla.suse.com/1273484","https://bugzilla.suse.com/1273488","https://bugzilla.suse.com/1273523","https://bugzilla.suse.com/1273555","https://bugzilla.suse.com/1273578","https://bugzilla.suse.com/1273742","https://bugzilla.suse.com/1273743","https://bugzilla.suse.com/1273745","https://bugzilla.suse.com/1273748","https://bugzilla.suse.com/1273762","https://bugzilla.suse.com/1273766","https://bugzilla.suse.com/1273774","https://bugzilla.suse.com/1273869","https://bugzilla.suse.com/1273882","https://bugzilla.suse.com/1273891","https://bugzilla.suse.com/1273903","https://bugzilla.suse.com/1273930","https://bugzilla.suse.com/1273944","https://bugzilla.suse.com/1273968","https://bugzilla.suse.com/1273995","https://bugzilla.suse.com/1274014","https://bugzilla.suse.com/1274031","https://bugzilla.suse.com/1274041","https://bugzilla.suse.com/1274208","https://bugzilla.suse.com/1274226","https://bugzilla.suse.com/1274274","https://bugzilla.suse.com/1274497","https://bugzilla.suse.com/1274539","https://bugzilla.suse.com/1274541","https://bugzilla.suse.com/1274543","https://bugzilla.suse.com/1274545","https://bugzilla.suse.com/1274547","https://bugzilla.suse.com/1274550","https://bugzilla.suse.com/1274620","https://bugzilla.suse.com/1274696","https://bugzilla.suse.com/1274699","https://bugzilla.suse.com/1274705","https://bugzilla.suse.com/1274752","https://bugzilla.suse.com/1274753","https://bugzilla.suse.com/1274754","https://bugzilla.suse.com/1274888","https://bugzilla.suse.com/1274898","https://bugzilla.suse.com/1274902","https://bugzilla.suse.com/1274908","https://bugzilla.suse.com/1274941","https://bugzilla.suse.com/1275161","https://bugzilla.suse.com/1275304","https://bugzilla.suse.com/1275307","https://bugzilla.suse.com/1275470","https://bugzilla.suse.com/1275472","https://bugzilla.suse.com/1275474","https://bugzilla.suse.com/1275506","https://bugzilla.suse.com/1275528","https://bugzilla.suse.com/1275535","https://bugzilla.suse.com/1275540","https://bugzilla.suse.com/1275555","https://bugzilla.suse.com/1275665","https://bugzilla.suse.com/1275669","https://bugzilla.suse.com/1275687","https://bugzilla.suse.com/1275696","https://bugzilla.suse.com/1275782","https://bugzilla.suse.com/1275784","https://bugzilla.suse.com/1275797","https://bugzilla.suse.com/1275798","https://bugzilla.suse.com/1275827","https://bugzilla.suse.com/1275867","https://bugzilla.suse.com/1275886","https://bugzilla.suse.com/1275905","https://bugzilla.suse.com/1275925","https://bugzilla.suse.com/1276006","https://bugzilla.suse.com/1276350","https://bugzilla.suse.com/1276665","https://bugzilla.suse.com/1276931","https://bugzilla.suse.com/1277073","https://bugzilla.suse.com/1277155","https://bugzilla.suse.com/1277254","https://bugzilla.suse.com/1277285","https://bugzilla.suse.com/1277391","https://bugzilla.suse.com/1277408","https://bugzilla.suse.com/1277505","https://bugzilla.suse.com/1277523","https://bugzilla.suse.com/1277571","https://bugzilla.suse.com/1277678","https://bugzilla.suse.com/1277860","https://bugzilla.suse.com/1278088","https://bugzilla.suse.com/1278233","https://bugzilla.suse.com/1278236","https://bugzilla.suse.com/1279813","https://www.suse.com/security/cve/CVE-2024-44981","https://www.suse.com/security/cve/CVE-2024-57841","https://www.suse.com/security/cve/CVE-2025-38469","https://www.suse.com/security/cve/CVE-2025-40022","https://www.suse.com/security/cve/CVE-2025-68179","https://www.suse.com/security/cve/CVE-2025-68214","https://www.suse.com/security/cve/CVE-2025-71104","https://www.suse.com/security/cve/CVE-2026-23210","https://www.suse.com/security/cve/CVE-2026-23230","https://www.suse.com/security/cve/CVE-2026-23451","https://www.suse.com/security/cve/CVE-2026-23454","https://www.suse.com/security/cve/CVE-2026-31502","https://www.suse.com/security/cve/CVE-2026-43147","https://www.suse.com/security/cve/CVE-2026-43456","https://www.suse.com/security/cve/CVE-2026-45968","https://www.suse.com/security/cve/CVE-2026-52910","https://www.suse.com/security/cve/CVE-2026-52912","https://www.suse.com/security/cve/CVE-2026-52929","https://www.suse.com/security/cve/CVE-2026-52977","https://www.suse.com/security/cve/CVE-2026-52994","https://www.suse.com/security/cve/CVE-2026-53059","https://www.suse.com/security/cve/CVE-2026-53110","https://www.suse.com/security/cve/CVE-2026-53163","https://www.suse.com/security/cve/CVE-2026-53260","https://www.suse.com/security/cve/CVE-2026-53264","https://www.suse.com/security/cve/CVE-2026-53365","https://www.suse.com/security/cve/CVE-2026-53366","https://www.suse.com/security/cve/CVE-2026-53381","https://www.suse.com/security/cve/CVE-2026-63801","https://www.suse.com/security/cve/CVE-2026-63823","https://www.suse.com/security/cve/CVE-2026-63827","https://www.suse.com/security/cve/CVE-2026-63879","https://www.suse.com/security/cve/CVE-2026-63881","https://www.suse.com/security/cve/CVE-2026-63886","https://www.suse.com/security/cve/CVE-2026-63887","https://www.suse.com/security/cve/CVE-2026-63888","https://www.suse.com/security/cve/CVE-2026-63920","https://www.suse.com/security/cve/CVE-2026-63944","https://www.suse.com/security/cve/CVE-2026-63970","https://www.suse.com/security/cve/CVE-2026-63972","https://www.suse.com/security/cve/CVE-2026-63973","https://www.suse.com/security/cve/CVE-2026-63992","https://www.suse.com/security/cve/CVE-2026-64000","https://www.suse.com/security/cve/CVE-2026-64002","https://www.suse.com/security/cve/CVE-2026-64007","https://www.suse.com/security/cve/CVE-2026-64010","https://www.suse.com/security/cve/CVE-2026-64011","https://www.suse.com/security/cve/CVE-2026-64015","https://www.suse.com/security/cve/CVE-2026-64018","https://www.suse.com/security/cve/CVE-2026-64029","https://www.suse.com/security/cve/CVE-2026-64034","https://www.suse.com/security/cve/CVE-2026-64048","https://www.suse.com/security/cve/CVE-2026-64098","https://www.suse.com/security/cve/CVE-2026-64109","https://www.suse.com/security/cve/CVE-2026-64114","https://www.suse.com/security/cve/CVE-2026-64115","https://www.suse.com/security/cve/CVE-2026-64121","https://www.suse.com/security/cve/CVE-2026-64217","https://www.suse.com/security/cve/CVE-2026-64247","https://www.suse.com/security/cve/CVE-2026-64266","https://www.suse.com/security/cve/CVE-2026-64268","https://www.suse.com/security/cve/CVE-2026-64304","https://www.suse.com/security/cve/CVE-2026-64312","https://www.suse.com/security/cve/CVE-2026-64355","https://www.suse.com/security/cve/CVE-2026-64383","https://www.suse.com/security/cve/CVE-2026-64384","https://www.suse.com/security/cve/CVE-2026-64385","https://www.suse.com/security/cve/CVE-2026-64386","https://www.suse.com/security/cve/CVE-2026-64387","https://www.suse.com/security/cve/CVE-2026-64423","https://www.suse.com/security/cve/CVE-2026-64450","https://www.suse.com/security/cve/CVE-2026-64481","https://www.suse.com/security/cve/CVE-2026-64524","https://www.suse.com/security/cve/CVE-2026-64527","https://www.suse.com/security/cve/CVE-2026-64541","https://www.suse.com/security/cve/CVE-2026-64543","https://www.suse.com/security/cve/CVE-2026-64562","https://www.suse.com/security/cve/CVE-2026-64563","https://www.suse.com/security/cve/CVE-2026-64572","https://www.suse.com/security/cve/CVE-2026-64577","https://www.suse.com/security/cve/CVE-2026-64581","https://www.suse.com/security/cve/CVE-2026-64593","https://www.suse.com/security/cve/CVE-2026-68121","https://www.suse.com/security/cve/CVE-2026-68133","https://www.suse.com/security/cve/CVE-2026-68136","https://www.suse.com/security/cve/CVE-2026-68138","https://www.suse.com/security/cve/CVE-2026-68155","https://www.suse.com/security/cve/CVE-2026-68158","https://www.suse.com/security/cve/CVE-2026-68159","https://www.suse.com/security/cve/CVE-2026-68160","https://www.suse.com/security/cve/CVE-2026-68202","https://www.suse.com/security/cve/CVE-2026-68397","https://www.suse.com/security/cve/CVE-2026-68398","https://www.suse.com/security/cve/CVE-2026-68417","https://www.suse.com/security/cve/CVE-2026-68426","https://www.suse.com/security/cve/CVE-2026-68428","https://www.suse.com/security/cve/CVE-2026-68480","https://www.suse.com/security/cve/CVE-2026-72020","https://www.suse.com/security/cve/CVE-2026-72069","https://www.suse.com/security/cve/CVE-2026-72072","https://www.suse.com/security/cve/CVE-2026-72083","https://www.suse.com/security/cve/CVE-2026-72084","https://www.suse.com/security/cve/CVE-2026-72123","https://www.suse.com/security/cve/CVE-2026-72135","https://www.suse.com/security/cve/CVE-2026-72221","https://www.suse.com/security/cve/CVE-2026-72222","https://www.suse.com/security/cve/CVE-2026-72251","https://www.suse.com/security/cve/CVE-2026-72262","https://www.suse.com/security/cve/CVE-2026-72288","https://www.suse.com/security/cve/CVE-2026-72289","https://www.suse.com/security/cve/CVE-2026-72317","https://www.suse.com/security/cve/CVE-2026-72339","https://www.suse.com/security/cve/CVE-2026-72389","https://www.suse.com/security/cve/CVE-2026-74345","https://www.suse.com/security/cve/CVE-2026-74377","https://www.suse.com/security/cve/CVE-2026-74378","https://www.suse.com/security/cve/CVE-2026-74390","https://www.suse.com/security/cve/CVE-2026-74394","https://www.suse.com/security/cve/CVE-2026-74454","https://www.suse.com/security/cve/CVE-2026-74488","https://www.suse.com/security/cve/CVE-2026-74496","https://www.suse.com/security/cve/CVE-2026-74516","https://www.suse.com/security/cve/CVE-2026-74518","https://www.suse.com/security/cve/CVE-2026-74537","https://www.suse.com/security/cve/CVE-2026-74556","https://www.suse.com/security/cve/CVE-2026-74581","https://www.suse.com/security/cve/CVE-2026-74582","https://www.suse.com/security/cve/CVE-2026-74612","https://www.suse.com/security/cve/CVE-2026-74669","https://www.suse.com/security/cve/CVE-2026-74695","https://www.suse.com/security/cve/CVE-2026-80722"]},"related_cves":[{"value":"CVE-2024-44981","evidence":"/upstream"},{"value":"CVE-2024-57841","evidence":"/upstream"},{"value":"CVE-2025-38469","evidence":"/upstream"},{"value":"CVE-2025-40022","evidence":"/upstream"},{"value":"CVE-2025-68179","evidence":"/upstream"},{"value":"CVE-2025-68214","evidence":"/upstream"},{"value":"CVE-2025-71104","evidence":"/upstream"},{"value":"CVE-2026-23210","evidence":"/upstream"},{"value":"CVE-2026-23230","evidence":"/upstream"},{"value":"CVE-2026-23451","evidence":"/upstream"},{"value":"CVE-2026-23454","evidence":"/upstream"},{"value":"CVE-2026-31502","evidence":"/upstream"},{"value":"CVE-2026-43147","evidence":"/upstream"},{"value":"CVE-2026-43456","evidence":"/upstream"},{"value":"CVE-2026-45968","evidence":"/upstream"},{"value":"CVE-2026-52910","evidence":"/upstream"},{"value":"CVE-2026-52912","evidence":"/upstream"},{"value":"CVE-2026-52929","evidence":"/upstream"},{"value":"CVE-2026-52977","evidence":"/upstream"},{"value":"CVE-2026-52994","evidence":"/upstream"},{"value":"CVE-2026-53059","evidence":"/upstream"},{"value":"CVE-2026-53110","evidence":"/upstream"},{"value":"CVE-2026-53163","evidence":"/upstream"},{"value":"CVE-2026-53260","evidence":"/upstream"},{"value":"CVE-2026-53264","evidence":"/upstream"},{"value":"CVE-2026-53365","evidence":"/upstream"},{"value":"CVE-2026-53366","evidence":"/upstream"},{"value":"CVE-2026-53381","evidence":"/upstream"},{"value":"CVE-2026-63801","evidence":"/upstream"},{"value":"CVE-2026-63823","evidence":"/upstream"},{"value":"CVE-2026-63827","evidence":"/upstream"},{"value":"CVE-2026-63879","evidence":"/upstream"},{"value":"CVE-2026-63881","evidence":"/upstream"},{"value":"CVE-2026-63886","evidence":"/upstream"},{"value":"CVE-2026-63887","evidence":"/upstream"},{"value":"CVE-2026-63888","evidence":"/upstream"},{"value":"CVE-2026-63920","evidence":"/upstream"},{"value":"CVE-2026-63944","evidence":"/upstream"},{"value":"CVE-2026-63970","evidence":"/upstream"},{"value":"CVE-2026-63972","evidence":"/upstream"},{"value":"CVE-2026-63973","evidence":"/upstream"},{"value":"CVE-2026-63992","evidence":"/upstream"},{"value":"CVE-2026-64000","evidence":"/upstream"},{"value":"CVE-2026-64002","evidence":"/upstream"},{"value":"CVE-2026-64007","evidence":"/upstream"},{"value":"CVE-2026-64010","evidence":"/upstream"},{"value":"CVE-2026-64011","evidence":"/upstream"},{"value":"CVE-2026-64015","evidence":"/upstream"},{"value":"CVE-2026-64018","evidence":"/upstream"},{"value":"CVE-2026-64029","evidence":"/upstream"},{"value":"CVE-2026-64034","evidence":"/upstream"},{"value":"CVE-2026-64048","evidence":"/upstream"},{"value":"CVE-2026-64098","evidence":"/upstream"},{"value":"CVE-2026-64109","evidence":"/upstream"},{"value":"CVE-2026-64114","evidence":"/upstream"},{"value":"CVE-2026-64115","evidence":"/upstream"},{"value":"CVE-2026-64121","evidence":"/upstream"},{"value":"CVE-2026-64217","evidence":"/upstream"},{"value":"CVE-2026-64247","evidence":"/upstream"},{"value":"CVE-2026-64266","evidence":"/upstream"},{"value":"CVE-2026-64268","evidence":"/upstream"},{"value":"CVE-2026-64304","evidence":"/upstream"},{"value":"CVE-2026-64312","evidence":"/upstream"},{"value":"CVE-2026-64355","evidence":"/upstream"},{"value":"CVE-2026-64383","evidence":"/upstream"},{"value":"CVE-2026-64384","evidence":"/upstream"},{"value":"CVE-2026-64385","evidence":"/upstream"},{"value":"CVE-2026-64386","evidence":"/upstream"},{"value":"CVE-2026-64387","evidence":"/upstream"},{"value":"CVE-2026-64423","evidence":"/upstream"},{"value":"CVE-2026-64450","evidence":"/upstream"},{"value":"CVE-2026-64481","evidence":"/upstream"},{"value":"CVE-2026-64524","evidence":"/upstream"},{"value":"CVE-2026-64527","evidence":"/upstream"},{"value":"CVE-2026-64541","evidence":"/upstream"},{"value":"CVE-2026-64543","evidence":"/upstream"},{"value":"CVE-2026-64562","evidence":"/upstream"},{"value":"CVE-2026-64563","evidence":"/upstream"},{"value":"CVE-2026-64572","evidence":"/upstream"},{"value":"CVE-2026-64577","evidence":"/upstream"},{"value":"CVE-2026-64581","evidence":"/upstream"},{"value":"CVE-2026-64593","evidence":"/upstream"},{"value":"CVE-2026-68121","evidence":"/upstream"},{"value":"CVE-2026-68133","evidence":"/upstream"},{"value":"CVE-2026-68136","evidence":"/upstream"},{"value":"CVE-2026-68138","evidence":"/upstream"},{"value":"CVE-2026-68155","evidence":"/upstream"},{"value":"CVE-2026-68158","evidence":"/upstream"},{"value":"CVE-2026-68159","evidence":"/upstream"},{"value":"CVE-2026-68160","evidence":"/upstream"},{"value":"CVE-2026-68202","evidence":"/upstream"},{"value":"CVE-2026-68397","evidence":"/upstream"},{"value":"CVE-2026-68398","evidence":"/upstream"},{"value":"CVE-2026-68417","evidence":"/upstream"},{"value":"CVE-2026-68426","evidence":"/upstream"},{"value":"CVE-2026-68428","evidence":"/upstream"},{"value":"CVE-2026-68480","evidence":"/upstream"},{"value":"CVE-2026-72020","evidence":"/upstream"},{"value":"CVE-2026-72069","evidence":"/upstream"},{"value":"CVE-2026-72072","evidence":"/upstream"},{"value":"CVE-2026-72083","evidence":"/upstream"},{"value":"CVE-2026-72084","evidence":"/upstream"},{"value":"CVE-2026-72123","evidence":"/upstream"},{"value":"CVE-2026-72135","evidence":"/upstream"},{"value":"CVE-2026-72221","evidence":"/upstream"},{"value":"CVE-2026-72222","evidence":"/upstream"},{"value":"CVE-2026-72251","evidence":"/upstream"},{"value":"CVE-2026-72262","evidence":"/upstream"},{"value":"CVE-2026-72288","evidence":"/upstream"},{"value":"CVE-2026-72289","evidence":"/upstream"},{"value":"CVE-2026-72317","evidence":"/upstream"},{"value":"CVE-2026-72339","evidence":"/upstream"},{"value":"CVE-2026-72389","evidence":"/upstream"},{"value":"CVE-2026-74345","evidence":"/upstream"},{"value":"CVE-2026-74377","evidence":"/upstream"},{"value":"CVE-2026-74378","evidence":"/upstream"},{"value":"CVE-2026-74390","evidence":"/upstream"},{"value":"CVE-2026-74394","evidence":"/upstream"},{"value":"CVE-2026-74454","evidence":"/upstream"},{"value":"CVE-2026-74488","evidence":"/upstream"},{"value":"CVE-2026-74496","evidence":"/upstream"},{"value":"CVE-2026-74516","evidence":"/upstream"},{"value":"CVE-2026-74518","evidence":"/upstream"},{"value":"CVE-2026-74537","evidence":"/upstream"},{"value":"CVE-2026-74556","evidence":"/upstream"},{"value":"CVE-2026-74581","evidence":"/upstream"},{"value":"CVE-2026-74582","evidence":"/upstream"},{"value":"CVE-2026-74612","evidence":"/upstream"},{"value":"CVE-2026-74669","evidence":"/upstream"},{"value":"CVE-2026-74695","evidence":"/upstream"},{"value":"CVE-2026-80722","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ddb2c304-0ccc-4573-96b3-606b178f0dff","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-23230","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerability is in the SMB client code (fs/smb/client/). The race is triggered between processing a server's create response (setting is_open) and the server sending a lease break notification. A malicious SMB server can trigger this remotely over the network.\nAC:L - The attacker (malicious SMB server) controls when lease breaks are sent and can time them immediately after the create response. The attacker can retry many times across many directory opens, and the RMW race window is inherent to every bitfield write, making it reliably triggerable.\nPR:N - The attacker is the SMB server, requiring no privileges on the victim system. The lease break is processed as part of normal SMB protocol handling with no additional authentication check beyond the existing session.\nUI:R - The victim must mount an SMB share from the attacker's server (or a compromised server), which requires explicit user or administrator action.\nS:U - The vulnerability impacts the kernel where the SMB client runs; it does not cross a security boundary such as a VM or sandbox.\nC:H - The race can restore has_lease after the lease reference was dropped, leading to reference count corruption and use-after-free. UAF on heap objects gives the attacker read primitives over arbitrary kernel memory through heap spraying.\nI:H - The use-after-free from reference count corruption allows the attacker to reclaim the freed cached_fid object with controlled data, enabling arbitrary kernel write primitives and potential code execution.\nA:H - The reference count corruption and list corruption caused by the restored stale flags will lead to double-free, use-after-free, or list corruption, all of which reliably cause kernel panics/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-23230","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-31502","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the vulnerable team header_ops path by locally creating/enslaving network devices through rtnetlink and then triggering dev_hard_header()/dev_parse_header() via local packet/socket or network-stack activity on the malformed team device. The required setup is a local kernel networking configuration path rather than an unauthenticated packet-processing path.\nAC:L - The vulnerable topology, such as GRE -> bond -> team, is fully attacker-controlled once the required namespace capabilities are available, and triggering the bad callback is deterministic. There is no race or external timing condition required.\nPR:L - Creating team/bond/GRE devices and enslaving them requires CAP_NET_ADMIN, and packet sockets require CAP_NET_RAW, but both are available to an unprivileged user inside a user and network namespace on systems permitting unprivileged user namespaces. This is therefore low privileges, not real init-namespace root.\nUI:N - No victim interaction is required after the attacker has local access and namespace capabilities. The attacker can configure the devices and trigger the callback directly.\nS:U - The impact is within the same kernel security authority. This is a kernel crash/type-confusion or privilege-impact issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a header_ops type confusion where callbacks interpret team private data as another subsystem's private structure, causing attacker-influenced kernel pointer dereferences and potential kernel memory exposure. Following the higher-severity rule for type confusion, confidentiality impact is high.\nI:H - Type confusion in kernel callback dispatch can lead to misinterpreted object pointers and potentially control-flow or write-primitive exploitation beyond the observed crash. Kernel type confusion is scored as high integrity impact.\nA:H - The reported and expected failure mode is a kernel oops/BUG/crash when the inherited callback uses the wrong net_device private layout. This gives high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31502","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43456","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local rtnetlink/AF_PACKET operations: creating/enslaving a non-Ethernet slave to a bond and then causing `dev_hard_header()` on the bond device. Remote packets are not sufficient without the vulnerable local device configuration.\nAC:L - No race or special external timing is required; the attacker can deterministically create the bond/GRE setup and trigger the confused header callback. Required modules/configuration are common and autoloadable through rtnetlink in normal deployments.\nPR:L - The setup requires `CAP_NET_ADMIN` and the AF_PACKET trigger requires `CAP_NET_RAW`, but both are obtainable by an unprivileged local user inside a user/network namespace. Therefore this is low privilege rather than real init-namespace root only.\nUI:N - Exploitation does not require a victim user to perform an action. The attacker can perform the setup and trigger locally.\nS:U - The impact is within the kernel security authority on the same system. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug is kernel type confusion where bonding private data is interpreted as another device's private structure, and the confused callback can read kernel data using the wrong layout. Following the required higher-severity rule for type confusion, confidentiality impact is High.\nI:H - The confused header callback uses bogus private-data fields to construct and push protocol headers into an skb, making this a kernel memory/type confusion condition rather than a pure NULL dereference. Type confusion is scored as High integrity impact.\nA:H - The reported failure is a kernel BUG/oops in `pskb_expand_head()` reachable through the confused `ipgre_header()` call. This provides a reliable local kernel crash/DoS."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43456","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52910","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable attach/detach operation is reached through local `setsockopt()` on an `SO_REUSEPORT` socket with `SO_ATTACH_REUSEPORT_CBPF` or `SO_DETACH_REUSEPORT_BPF`. Although packet receive executes the stale program, the attacker-controlled trigger for freeing/replacing it is a local socket API path.\nAC:L - The race is attacker-controlled: a local attacker can create the UDP reuseport group, replace/detach the cBPF program, and concurrently send packets to drive `reuseport_select_sock()`. No rare external condition is required.\nPR:L - A basic unprivileged local user can create UDP sockets on an unprivileged port, set `SO_REUSEPORT`, and attach a classic reuseport BPF filter; this path does not require `CAP_NET_ADMIN`. User namespaces are not needed to make the path reachable.\nUI:N - No victim user action is required once the attacker runs the local reproducer. The attacker controls the sockets, the filter replacement, and the packet generation.\nS:U - The bug is a kernel memory lifetime error used for local kernel compromise or crash within the same host security authority. It does not cross a VM, IOMMU, or similar security boundary.\nC:H - This is a use-after-free of a `bpf_prog` object that is dereferenced after reclamation while selecting a reuseport socket. Per kernel CVSS guidance, UAFs are treated as enabling high confidentiality impact through potential kernel memory disclosure.\nI:H - The stale freed `bpf_prog` can be reused while the receive path reads and runs through the program object, making control-flow or data corruption plausible. Per kernel CVSS guidance, UAF memory corruption warrants high integrity impact.\nA:H - The reported reproducer triggers a KASAN vmalloc out-of-bounds/use-after-free splat in the packet receive path. Such kernel memory corruption can reliably crash or destabilize the kernel."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52912","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local control of netfilter/NFQUEUE, bridge device lifecycle, and verdict reinjection through netlink/rtnetlink paths. Remote packets alone cannot force the needed bridge teardown and userspace verdict sequence.\nAC:L - A local attacker can deterministically create a namespace, bridge/veth setup, NFQUEUE rule, queued packet, bridge teardown, and reinjection. There is no race dependent on conditions outside attacker control.\nPR:L - The setup requires CAP_NET_ADMIN, but netfilter and bridge configuration are reachable with CAP_NET_ADMIN inside a user-created network namespace on systems allowing unprivileged user namespaces. This is Low, not High.\nUI:N - No victim action is required once the local attacker runs the exploit sequence. The attacker controls packet injection, queueing, device teardown, and verdict delivery.\nS:U - The impact is kernel memory corruption within the same host security authority. This is a standard local kernel privilege escalation/DoS scenario, not a VM or hardware boundary escape.\nC:H - The bug is a use-after-free of the bridge master net_device retained in skb->dev across NFQUEUE. Kernel UAFs can be leveraged for kernel memory disclosure, so confidentiality impact is High.\nI:H - The stale net_device pointer is dereferenced after free in the receive path and can plausibly be combined with heap reclaim/spraying for memory corruption or control-flow impact. As a kernel UAF, integrity impact is High.\nA:H - At minimum, reinjection can dereference freed net_device memory in netif_receive_skb and crash/oops the kernel. Repeated local triggering makes availability impact High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52912","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52929","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached while processing an SCTP RE-CONFIG response chunk received from a remote SCTP peer on an established association. A malicious peer can send a denied ADD_OUT_STREAMS response over the network once stream reconfiguration is negotiated.\nAC:L - The packet/state sequence is protocol-controlled and reproducible: negotiate SCTP RE-CONFIG, trigger an ADD_OUT_STREAMS request, deny it, then cause later reuse of the stale stream state. Although RE-CONFIG must be enabled by the application, there is no race or condition outside the attacker's reasonable influence in a deployment using this feature.\nPR:N - A remote SCTP peer does not need local kernel privileges or authenticated OS privileges to send the denial response. The path is gated by SCTP association state, verification tag, and matching outstanding request sequence, not by credentials.\nUI:N - No human user interaction is required once the SCTP service/association is operating with stream reconfiguration. The triggering input is network protocol traffic from the peer.\nS:U - The vulnerability affects kernel SCTP state within the same host security authority. It does not cross a VM, IOMMU, or other separate authorization boundary.\nC:N - The investigated failure mode is stale SCTP stream scheduler metadata leading to a NULL pointer dereference in scheduler value retrieval. I did not find evidence of an attacker-controlled memory read or information disclosure primitive.\nI:N - The bug leaves scheduler-private stream state inconsistent but the demonstrated impact is a NULL dereference/crash, not controlled data modification or code execution. No arbitrary write primitive was evident from the rollback path.\nA:H - The stale stream extension state can lead to a kernel NULL pointer dereference/oops in the SCTP scheduler path. A remotely reachable kernel crash is a high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52929","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53110","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached by locally loading or attaching BPF programs through the bpf() syscall and then executing the JITed program or generated trampoline. It is not directly reachable from remote network packets without prior local BPF program installation.\nAC:L - An attacker can craft BPF bytecode/attachments that exercise unsigned kfunc arguments or trampoline return values, and there is no race or external timing condition required. The bug is a deterministic ABI/JIT miscompilation on affected s390 systems.\nPR:L - Loading kfunc/tracing BPF normally requires BPF-related capabilities, but BPF token delegation can evaluate these in a non-init user namespace in delegated/containerized deployments. Following the higher-severity rule, this is scored as low privileges rather than requiring real init-namespace root.\nUI:N - No victim action is needed after the attacker can issue the relevant bpf() syscalls. The attacker loads/attaches and triggers the affected BPF program path directly.\nS:U - The vulnerability affects kernel execution in the same security authority as the vulnerable component. It is a local kernel compromise/DoS style issue, not a VM escape or separate security-scope boundary bypass.\nC:H - The missing zero-extension lets attacker-controlled high bits cross the verifier/native ABI boundary for kfunc calls and trampoline returns. This can plausibly turn verifier-assumed bounded values into unsafe kernel values, matching prior BPF JIT verifier-bypass classes with kernel memory disclosure potential.\nI:H - Incorrect unsigned argument or return extension can corrupt kernel control/data flow through kfuncs or BPF modify-return trampolines. Under the required higher-severity assumption, this is treated as exploitable for kernel memory modification or privilege escalation.\nA:H - At minimum, passing ABI-invalid kfunc arguments or malformed trampoline return values can trigger kernel oops/panic paths, as similar BPF JIT argument-extension bugs have done. The attacker can repeatedly load/trigger the crafted BPF program."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53110","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53260","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable TCP request-socket path is reached by unauthenticated IPv4 or IPv6 SYN packets delivered to a listening socket over the network. This occurs before any application-level authentication.\nAC:L - Although the bug is a PREEMPT_RT timing race, an attacker can repeatedly create request sockets and timer/drop races by driving TCP connection attempts; under the required higher-severity rule this is treated as attacker-controllable rather than an uncontrollable environmental condition.\nPR:N - No credentials, capabilities, or prior authentication are required to send SYN packets to an exposed TCP listener and reach `tcp_conn_request()` and `reqsk_queue_hash_req()`. The path is in the generic TCP receive stack.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform an interactive action. Network traffic alone can exercise the vulnerable path on an affected listening service.\nS:U - The impact is within the kernel/network stack security authority on the same host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The failure is explicitly reported as a refcount underflow/use-after-free in a kernel heap object. Per the required guidance, UAF-class lifetime corruption is scored as high confidentiality impact because it can potentially be shaped into memory disclosure.\nI:H - The corrupted request-socket lifetime can leave stale kernel objects reachable through ehash/timer paths. Per the required guidance, UAF-class kernel memory corruption is scored as high integrity impact because it may be exploitable for write or control-flow manipulation.\nA:H - The observed failure triggers a kernel refcount warning with use-after-free semantics in timer context and can destabilize networking or the kernel. Kernel warnings/oopses, hangs, or UAF-triggered crashes are high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53260","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53264","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local rtnetlink `RTM_NEWTFILTER`/`RTM_DELTFILTER` traffic-control netlink messages, not by remote packet input.\nAC:L - The race is attacker-controlled because the same local actor can issue concurrent filter creation and deletion operations against the same action index. No external victim timing or rare environmental condition is required.\nPR:L - The operations require `CAP_NET_ADMIN` for non-GET rtnetlink messages, but traffic control is reachable with `CAP_NET_ADMIN` inside a user-created network namespace. Under the provided kernel guidance, this is Low privileges rather than High.\nUI:N - No victim interaction is needed; exploitation consists of the attacker sending crafted concurrent rtnetlink requests.\nS:U - The impact is within the kernel security authority and is a standard local kernel memory-corruption/privilege-escalation class issue. It does not cross a VM, IOMMU, or separate authorization scope boundary.\nC:H - The bug is a use-after-free of a `tc_action` object during action lookup/refcounting. A kernel heap UAF can be shaped into disclosure primitives, so confidentiality impact is High.\nI:H - The stale freed action pointer can be reused after heap reallocation and then modified/dereferenced through refcount, bind count, ops, and action lifecycle fields. This is memory corruption that can plausibly support arbitrary write or code execution, so integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or mutate freed/reused kernel memory and can crash or oops the kernel. Availability impact is therefore High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53366","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached while a local process constructs outgoing IPv4 UDP/raw/ping datagrams through sendmsg/splice/sendfile-style socket paths. I did not find a defensible received-packet or unauthenticated remote path that supplies the required cork/MSG_MORE-style fraggap conditions.\nAC:L - The attacker can choose UDP socket options/flags, payload sizes, corking/MSG_MORE behavior, and splice/zerocopy-style paged sends to reach the fraggap paged-allocation path. There is no race or external timing condition required.\nPR:L - A normal unprivileged local user can create IPv4 UDP sockets and use UDP_CORK/MSG_MORE/splice or related paged send paths; raw sockets are CAP_NET_RAW-gated but are not needed for the strongest local trigger. This is therefore basic local user privilege, not real administrator privilege.\nUI:N - No victim interaction is required once the attacker can run the local send/splice sequence. The vulnerable skb construction happens synchronously in the attacker-driven socket send path.\nS:U - The impact is within the same kernel security authority as the vulnerable IPv4 networking code. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug under-allocates/accounting for the linear skb area and can copy attacker-controlled fraggap bytes past skb->end into trailing skb_shared_info metadata. Kernel memory corruption of this kind is reasonably capable of being developed into information disclosure, so the higher severity confidentiality value is appropriate.\nI:H - The copied fraggap bytes corrupt kernel skb metadata past the intended buffer boundary. This is an out-of-bounds write in kernel heap/networking structures and is scored as high integrity impact.\nA:H - The corrupted skb metadata can crash or destabilize the kernel networking stack, and related negative-copy accounting can also produce severe send-path failure behavior. Kernel crash or oops potential is high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53366","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53381","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local VFS operations (open/write/close) on a virtiofs mount with FUSE submounts; exploitation is in the guest FUSE client during file release and submount umount, not via remote network packets.\nAC:L - This is a use-after-free where the attacker controls file close (async FUSE RELEASE) and can drive or coincide with submount umount; Kata Containers reproduces it reliably with virtiofsd --announce-submounts (default).\nPR:L - An unprivileged local process with access to the virtiofs mount can trigger it; virtiofs defaults to allow_other and normal POSIX permissions, and no real root or init-namespace capabilities are required.\nUI:N - Exploitation needs no victim interaction beyond the attacker (or their container workload) performing normal filesystem I/O while submount teardown occurs during pod/container lifecycle.\nS:U - Impact stays within the guest kernel security boundary (crash or guest kernel compromise); it does not by itself cross a VM/host or IOMMU boundary.\nC:H - The flaw is a use-after-free in fuse_release_end() calling iput() on an inode after its superblock is destroyed, which can be turned into arbitrary kernel memory read via heap manipulation.\nI:H - Use-after-free on a struct inode in the kernel heap provides a standard path to controlled memory corruption, heap spraying, and arbitrary write or code execution in kernel context.\nA:H - Confirmed kernel general protection fault/oops in iput() from fuse_release_end during virtio_fs request completion, and UAF bugs inherently threaten kernel stability even without full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53381","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63801","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached from the TIPC packet receive path (UDP bearer on port 6118 or L2 bearer) when encrypted frames arrive from a remote peer; no local syscall is required to enter tipc_aead_decrypt().\nAC:L - The attacker can reliably win the race by flooding packets to queue async decrypt completions while repeatedly destroying the network namespace; the repro demonstrates full control of both sides of the timing window.\nPR:L - Reliable exploitation is demonstrated via unshare-created user/network namespaces where the attacker gains CAP_NET_ADMIN-equivalent control to configure TIPC crypto and cycle namespace teardown, which per kernel CNA guidance maps to Low rather than High.\nUI:N - Exploitation requires only sending network packets and namespace lifecycle manipulation; no victim user action such as opening a file or mounting a filesystem is needed.\nS:U - Impact is confined to kernel memory within the same security authority; this is a standard kernel UAF/privilege-escalation class bug, not a VM escape or cross-authority boundary bypass.\nC:H - The UAF reads freed slab memory including aead->crypto->stats, aead->crypto->net, and aead[] pointers in tipc_crypto_rcv_complete, enabling arbitrary kernel memory disclosure via controlled reuse of the freed tipc_crypto object.\nI:H - Use-after-free of tipc_crypto structures can be leveraged for heap spraying and arbitrary write primitives, and tipc_crypto_rcv_complete continues processing with freed pointers including key attachment and node table operations.\nA:H - KASAN confirmed slab-use-after-free in tipc_aead_decrypt_done on a workqueue thread; UAF on this path causes kernel oops/panic even when not fully exploited for code execution."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63801","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63823","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local `request_key()` and `keyctl()` syscalls (`KEYCTL_ASSUME_AUTHORITY`, `KEYCTL_INSTANTIATE`, `KEYCTL_INSTANTIATE_IOV`, `KEYCTL_REJECT`); there is no network, adjacent-radio, or physical-device entry path.\nAC:L - Exploitation is a race the attacker orchestrates by calling `request_key()` and concurrently driving `KEYCTL_INSTANTIATE_IOV` with a user buffer that page-faults during `copy_from_iter_full()`, while a second helper thread or completion path revokes/frees the auth payload.\nPR:L - Any unprivileged local user can invoke `request_key()` and the affected `keyctl` instantiate/reject operations in the spawned helper context; no real-root or non-userns capability is required.\nUI:N - Exploitation does not depend on a victim performing an action beyond the attacker’s own syscall activity and helper process setup.\nS:U - Impact is kernel memory corruption and local privilege escalation within the same kernel security domain, not a VM-guest-to-host or IOMMU boundary escape.\nC:H - This is a heap use-after-free of `struct request_key_auth`; after free the code dereferences `rka->target_key` and related fields, enabling attacker-controlled reuse and arbitrary kernel memory disclosure.\nI:H - The UAF corrupts trusted kernel pointers (`target_key`, `dest_keyring`) used in `key_instantiate_and_link()`, which can be turned into arbitrary kernel writes and local privilege escalation.\nA:H - Use-after-free of kernel heap objects can cause kernel oops/panic during post-fault dereferences, and is independently severe even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63823","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63879","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local AMDGPU DRM ioctls (e.g., AMDGPU_GEM_USERPTR, AMDGPU_CS) and KFD ioctls on /dev/kfd that call amdgpu_hmm_range_get_pages(); there is no network-facing entry point.\nAC:L - Exploitation requires a >2GB userptr/SVM mapping and a concurrent munmap/remap during the multi-chunk HMM walk, but the attacker controls both the ioctl thread and the address-space manipulation, so the race is attacker-driven rather than dependent on uncontrollable conditions.\nPR:L - Any unprivileged local user with access to the AMDGPU render node or /dev/kfd (typically render/video group membership) can create large userptr buffers and submit GPU work that triggers the vulnerable HMM path; root or init-namespace capabilities are not required.\nUI:N - Exploitation is fully attacker-driven through GPU memory registration and command submission ioctls and does not require any action from another user or administrator.\nS:U - The flaw corrupts or misuses kernel-tracked page metadata and enables standard local kernel memory safety impact and privilege escalation within the same kernel security domain, not a VM escape or IOMMU boundary bypass.\nC:H - Re-reading the MMU notifier sequence per 2GB chunk lets later validation pass while earlier PFNs may reference unmapped or freed pages, giving the GPU (and kernel DMA helpers) a stale-page/use-after-free primitive that can disclose arbitrary physical memory contents.\nI:H - Stale PFNs from invalidated mappings can be DMA-mapped and written by GPU operations, enabling arbitrary memory corruption and potential control-flow hijacking via repurposed physical pages rather than a bounded or crash-only effect.\nA:H - Operating on invalid struct page pointers during pinning/DMA mapping can trigger kernel oopses or panics, and the underlying use-after-free class of bug inherently threatens system availability even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63879","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63881","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local `ioctl()` on `/dev/kfd` via `AMDKFD_IOC_DBG_TRAP` with `KFD_IOC_DBG_TRAP_SUSPEND_QUEUES` or `KFD_IOC_DBG_TRAP_RESUME_QUEUES`; there is no network, adjacent-radio, or physical-access path to the vulnerable code.\nAC:L - On affected 32-bit `size_t` kernel builds, an attacker fully controls `num_queues` in the ioctl and can reliably force the multiply overflow (e.g. `num_queues >= 0x40000001`) to trigger undersized `memdup_user()` followed by unbounded kernel heap corruption.\nPR:L - A local unprivileged user with AMDGPU/KFD device access can open `/dev/kfd`, enable the debug runtime and debug trap on their own process (no ptrace or root required), then invoke suspend/resume with a malicious `num_queues` value.\nUI:N - Exploitation is achieved entirely through attacker-initiated ioctl calls in an established KFD debug session; no victim interaction is required.\nS:U - Impact is kernel heap corruption and potential local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - The integer overflow causes a heap buffer far smaller than `num_queues`, and subsequent `q_array_get_index()`/`copy_to_user()` operations perform out-of-bounds kernel reads that can disclose adjacent heap memory and be leveraged for arbitrary read primitives.\nI:H - `q_array_invalidate()` and per-queue status updates write attacker-influenced values (`KFD_DBG_QUEUE_INVALID_MASK`/`KFD_DBG_QUEUE_ERROR_MASK`) far beyond the allocated buffer, constituting an out-of-bounds heap write exploitable for control-flow hijacking and arbitrary kernel modification.\nA:H - Writing billions of 32-bit values past a 4-byte kmalloc object corrupts adjacent kernel heap metadata and objects, readily causing kernel oops/panic and complete loss of availability even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63881","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63886","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered by a remote iSCSI initiator sending crafted CHAP login PDUs over TCP to the in-kernel LIO iSCSI target during the network login/authentication handshake.\nAC:L - Once an iSCSI target with CHAP is reachable, an attacker can reliably trigger the overflow by sending CHAP_R with a 0b-prefixed base64 string up to 127 characters; no race or special memory layout is required.\nPR:N - The heap overflow occurs during the CHAP authentication handshake before the password hash comparison succeeds, so exploitation is reachable by an unauthenticated remote network attacker who knows a configured CHAP username.\nUI:N - Exploitation requires only the attacker initiating an iSCSI login connection and sending malicious CHAP PDUs; no action from a victim user is needed.\nS:U - Successful exploitation corrupts kernel heap memory within the same kernel security boundary, enabling denial of service or kernel privilege escalation, not a cross-boundary escape such as VM guest-to-host.\nC:H - The out-of-bounds heap write corrupts adjacent kmalloc objects and can be leveraged for arbitrary kernel memory disclosure through heap grooming, consistent with heap overflow impact guidance.\nI:H - A controlled kernel heap out-of-bounds write of up to 79 bytes past a digest-sized buffer can corrupt adjacent structures and be developed into arbitrary code execution or kernel privilege escalation.\nA:H - The overflow causes slab-out-of-bounds writes confirmed by KASAN and can crash or destabilize the kernel during login processing, constituting high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63886","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63887","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The Linux iSCSI target (LIO) is an in-kernel SCSI target that accepts remote TCP connections on the iSCSI portal (typically port 3260); crafted Login PDUs reach the vulnerable encoder via the normal network receive and login-negotiation path.\nAC:L - Once an iSCSI target portal is reachable, an attacker can reliably trigger the overflow by sending a single Login PDU packed with unknown key=value pairs; no races or victim-dependent timing are required.\nPR:N - The heap overflow occurs during login negotiation before iSCSI authentication completes; a discovery-session login requires only InitiatorName and SessionType with no credentials, initiator ACL, or local privileges.\nUI:N - Exploitation requires only network packets sent by the attacker; no action from a legitimate user or administrator is needed beyond the target already exposing its iSCSI portal.\nS:U - The corruption is confined to kernel heap memory in the iSCSI target/login context and does not cross a VM, container, or IOMMU security boundary by itself.\nC:H - A ~24 KiB out-of-bounds write into the kmalloc-8k slab can corrupt adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - The unbounded sprintf heap overrun is a large out-of-bounds write that can corrupt adjacent heap metadata or objects to achieve arbitrary kernel memory modification and potential code execution.\nA:H - Corrupting kmalloc-8k heap objects during login response encoding can cause kernel oops, BUG, or panic, and the attack can be repeated against an exposed iSCSI target."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63887","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63888","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the in-kernel LIO iSCSI target, reachable by sending iSCSI Text PDUs over TCP after connection setup on the network-facing iSCSI portal (typically port 3260), analogous to nfsd/ksmbd network exposure.\nAC:L - An attacker fully controls login parameter negotiation (DataDigest=CRC32C) and subsequent Text PDU content; the CRC overread fires deterministically on every qualifying Text PDU, and the double-free is reliably triggered by sending a bad DataDigest followed by another Text PDU on the same ITT when ERL>0.\nPR:N - No Linux OS privileges are required; the default discovery session permits unauthenticated login (AuthMethod=None, authentication disabled), after which SendTargets Text requests reach the vulnerable handler without any credentials.\nUI:N - Exploitation requires only crafted iSCSI protocol traffic from the attacker; no victim user action such as mounting a filesystem or clicking a link is needed.\nS:U - The vulnerability corrupts kernel heap memory within the iSCSI target subsystem on the host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The CRC path performs a slab out-of-bounds read past the text_in allocation, and the double-free is a use-after-free class bug that reads freed heap metadata; per kernel guidance both OOB reads and UAFs warrant High confidentiality impact.\nI:H - The double-free corrupts the slab freelist (triggering CONFIG_SLAB_FREELIST_HARDENED BUG() on hardened kernels), providing a classic heap corruption primitive that can be leveraged for arbitrary kernel memory writes and code execution.\nA:H - The double-free provably crashes the kernel (KASAN splat or SLAB_FREELIST_HARDENED BUG()), and the heap corruption can cause kernel panics; any UAF is scored as High availability impact per kernel guidance."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63888","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63920","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (nftables netlink to install a payload-set rule, setsockopt for IPV6_RECV* options, and recvmsg). Although the trigger packet is received over IPv6, the mandatory nftables corruption step is classified as Local per kernel guidance.\nAC:L - The attacker fully controls the nftables payload-set rule, the on-wire extension header, socket receive options, and the recvmsg call, making the slab out-of-bounds read reliably reproducible without races or external conditions.\nPR:L - An unprivileged local user can create a user+network namespace, obtain CAP_NET_ADMIN there, configure nftables, open a UDPv6/raw socket with extension-header cmsg options, and trigger the bug without real root in the initial namespace.\nUI:N - No victim interaction is required; the attacker can send the crafted IPv6 datagram and call recvmsg on their own socket to trigger the out-of-bounds read.\nS:U - Impact is confined to kernel memory disclosure and potential kernel instability within the same kernel security domain; it does not cross a VM/host or IOMMU boundary.\nC:H - put_cmsg() can copy up to 2040 bytes past the actual extension header into userspace ancillary data, leaking adjacent slab/kernel memory (confirmed by KASAN slab-out-of-bounds in put_cmsg).\nI:N - The bug is an out-of-bounds read that copies kernel data to userspace; it does not modify kernel memory, corrupt control structures, or provide a write primitive.\nA:H - The out-of-bounds slab read can provoke a KASAN fault/kernel oops during put_cmsg(), and repeated triggering can deny availability of the affected system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63920","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63944","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the Bluetooth HCI ISO/CIS path (`hci_le_create_cis_sync`), reachable only via the Bluetooth radio interface. Per kernel CVSS guidance, Bluetooth vulnerabilities are scored as Adjacent, including on phones and LE Audio devices in public spaces.\nAC:L - The UAF is a race between `hci_le_create_cis_sync` dropping locks and a concurrent `hci_conn_del`. An attacker who controls one side of the CIS setup (local ISO socket threads or a remote peer timing ACL/CIS teardown) can repeatedly trigger the race; success does not depend on uncontrollable conditions like kernel memory layout.\nPR:N - No local Unix privileges are required for the highest-impact scenario: a remote Bluetooth peer in range can provoke CIS teardown/disconnect events while the victim host is performing normal LE Audio CIS establishment (e.g., phone connecting to earbuds). Local exploitation via ISO sockets also requires no special capabilities at the kernel level.\nUI:N - Both sides of the race run inside the kernel's own HCI event handling: hci_le_create_cis_pending() queues the vulnerable work from hci_le_cis_established_evt(), hci_cs_le_create_cis(), hci_unbound_cis_failed() and iso_connect_cfm(), all driven by controller events and remote peer traffic, while the freeing side is a peer-initiated disconnect reaching hci_conn_del(). On an LE Audio host the CIS establishment happens by itself when the earbuds connect and the attacker supplies the disconnect, so nothing is asked of the person holding the device; the existing pairing is a precondition of the deployment, not an in-attack user step.\nS:U - Impact is confined to kernel memory corruption within the Bluetooth subsystem on the host; this is standard kernel compromise, not a cross-boundary escape (KVM guest-to-host, IOMMU bypass, or sandbox breakout).\nC:H - This is a slab use-after-free read of `conn->conn_timeout` on a freed `hci_conn` (kmalloc-8k object). UAF reads against attacker-influencable freed objects can disclose kernel heap contents and are scored as High per kernel CVSS guidance.\nI:H - Although the immediate bug is a post-unlock dereference of a freed `hci_conn`, UAF on large `hci_conn` kmalloc objects enables heap grooming and control of freed memory contents, which can be chained into arbitrary kernel writes or code execution; UAF class bugs are scored I:H.\nA:H - Use-after-free access to a freed connection object can cause kernel oops/panic (as demonstrated by the same bug class in the related `le_read_features_complete` fix found by syzkaller). Even without full exploitation, triggering the UAF reliably causes High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63944","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63970","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local AF_VSOCK transmission (syscall/io_uring send on a connected virtio vsock socket), not by processing remote network packets. Per kernel CVSS guidance, vsock is Local.\nAC:L - An attacker fully controls the trigger: SO_ZEROCOPY, io_uring IORING_OP_SEND_ZC with IORING_RECVSEND_FIXED_BUF and a vectored iov exceeding MAX_SKB_FRAGS (17), causing io_sg_from_iter() to return -EMSGSIZE on a deterministic error rollback path.\nPR:L - Exploitation requires only an unprivileged local process that can open a vsock connection and use io_uring zerocopy send; no CAP_NET_ADMIN or real root is needed beyond ordinary local user access in a virtio-vsock environment (KVM/Firecracker/cloud microVMs).\nUI:N - No victim interaction is required; the attacker triggers the bug directly through their own socket send/io_uring operation.\nS:U - Impact is kernel memory corruption and privilege escalation within the same security domain where the send occurs (guest kernel or host kernel). It is not a cross-boundary VM escape on the receive path; the flaw is in the sender's local skb teardown.\nC:H - Incorrect __skb_frag_unref() on SKBFL_MANAGED_FRAG_REFS pages without a bound uarg corrupts refcount/lifetime of io_uring registered buffer pages, yielding use-after-free and arbitrary kernel memory read primitives.\nI:H - The refcount corruption is a memory-safety bug in kernel heap/page management that can be leveraged for arbitrary write and control-flow hijacking, not merely a bounded data change.\nA:H - The erroneous frag unref on managed zerocopy pages can cause immediate kernel oops/panic from refcount underflow or use-after-free during skb teardown, independent of full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63970","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63992","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code runs on the VXLAN/GENEVE transmit path when processing remotely received UDP-encapsulated tunnel traffic (or L2 frames forwarded through a bridge port), which is reachable by sending crafted packets over the network to the victim VTEP.\nAC:L - The attacker fully controls the inner IPv4 header fields (DF bit, length, addresses) and can reliably craft oversized packets that exceed the tunnel-adjusted PMTU on bridge-port tunnel devices without depending on race timing or uncontrollable system state.\nPR:N - Exploitation requires only the ability to send network packets to a host with VXLAN/GENEVE bridged; no local account, authentication, or capabilities on the victim are needed.\nUI:N - No victim user action is required; the kernel processes attacker-supplied packets automatically through the tunnel receive, bridge forward, and re-encapsulation path.\nS:U - The out-of-bounds read and resulting kernel oops occur within the kernel network stack on the same host; there is no crossing of a VM, container, or IOMMU security boundary beyond standard kernel memory safety failure.\nC:H - Reading through `icmp_hdr(skb)` when `transport_header` is unset causes an out-of-bounds read at `skb->head + 65535`, potentially disclosing adjacent kernel memory beyond the skb buffer before any bounds checking occurs.\nI:N - The flaw is an out-of-bounds read of the ICMP type field; it does not directly modify or write kernel memory, though it may cause a kernel fault.\nA:H - The invalid pointer dereference at offset 65535 can trigger a kernel oops or panic when accessing unmapped memory, causing denial of service on the affected host."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63992","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64000","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached when the kernel processes received Ethernet frames via the netdev RX handler in net/hsr, and a remote attacker on the HSR/PRP ring can deliver a crafted supervision frame without any local access to the victim host.\nAC:L - The attacker fully controls the malformed frame content and length; a precisely truncated supervision frame reliably passes existing TLV validation and triggers the out-of-bounds read with no races or attacker-uncontrollable conditions.\nPR:N - Exploitation requires only the ability to inject L2 HSR/PRP supervision frames onto the ring segment; no local account, capabilities, or authentication on the target kernel is needed.\nUI:N - No victim user action is required beyond normal operation of an HSR/PRP-configured node; the attacker triggers the bug solely by sending a malicious frame.\nS:U - Impact is confined to kernel memory safety within the same security authority; there is no VM escape, IOMMU bypass, or cross-security-boundary scope change.\nC:H - The bug is an out-of-bounds read of supervision TLV header fields past the skb tail, which can disclose adjacent kernel heap/skb memory and is not strictly bounded to a few attacker-uncontrolled bytes.\nI:H - Out-of-bounds access in kernel packet parsing can supply attacker-influenced TLV type/length values that drive further skb_pull arithmetic and extended parsing, creating a plausible path to memory corruption and control-flow hijacking.\nA:H - Reading beyond the skb buffer boundary during softirq packet processing can cause a kernel oops/panic, and the attacker can repeatedly trigger the condition with crafted frames."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64000","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64002","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls—network namespace teardown via unshare/setns/put_net, sysctl access to /proc/sys/net/ipv4/ip_local_reserved_ports, and/or local socket bind/connect—not remote packet delivery.\nAC:L - The attacker can control both sides of the race by concurrently tearing down a network namespace while hammering the sysctl or triggering socket port selection in that namespace.\nPR:L - An unprivileged local user can reach this via user namespaces (CAP_SYS_ADMIN within the user_ns for CLONE_NEWNET) and world-writable sysctl access (mode 0644) during namespace destruction.\nUI:N - No victim interaction is required beyond the attacker's own concurrent namespace teardown and sysctl or socket activity.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it is standard local kernel memory corruption, not a VM/hypervisor boundary escape.\nC:H - Freed 8 KiB bitmap memory remains reachable via sysctl reads (find_next_bit) and inet_is_local_reserved_port() (test_bit), enabling heap information disclosure through a use-after-free.\nI:H - Sysctl writes via proc_do_large_bitmap perform bitmap_copy/bitmap_or into the freed allocation, providing a heap write primitive exploitable for control-flow hijacking.\nA:H - Concurrent access to the freed bitmap can cause kernel oops/panic from invalid memory access, and UAF exploitation inherently threatens kernel availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64002","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64007","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered when remote TCP packets traverse SYNPROXY netfilter hooks (NF_INET_LOCAL_IN / NF_INET_POST_ROUTING) on a host with SYNPROXY configured, which is the standard internet-facing firewall/router deployment for this subsystem.\nAC:L - An attacker who controls a TCP session through SYNPROXY can reliably send timestamp-bearing packets to hit the vulnerable path; the stale-pointer UAF write occurs whenever skb_ensure_writable() must expand a cloned skb, which the attacker can influence by sustaining traffic on the proxied connection.\nPR:N - Exploitation requires only that the victim already runs SYNPROXY (normal for protected services); the remote attacker needs no credentials or local privileges on the target system to send the triggering TCP packets.\nUI:N - No victim user action is required beyond normal network operation; exploitation is fully automated via crafted or sustained TCP traffic through the SYNPROXY session.\nS:U - Impact is confined to kernel memory on the affected host running SYNPROXY; this is standard kernel privilege escalation/memory corruption, not a cross-VM or cross-security-boundary escape.\nC:H - The stale tcphdr pointer causes inet_proto_csum_replace4() to write into freed slab memory, a use-after-free class bug that can be leveraged for arbitrary kernel memory read via heap grooming techniques.\nI:H - The out-of-bounds write into freed slab memory via a stale tcphdr pointer is a use-after-free write primitive that can be developed into arbitrary kernel memory writes and local privilege escalation.\nA:H - Writing into freed slab memory can corrupt adjacent kernel objects and cause kernel oops, panic, or crash, and UAF conditions are inherently capable of destabilizing the system even during exploitation attempts."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64007","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64015","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through find_key_to_update() on the persistent keyring register, which is invoked from keyctl_get_persistent() via the keyctl(2) syscall. There is no network, adjacent-radio, or physical-device path to this code.\nAC:L - Exploitation is a race between assoc_array_find() and assoc_array_gc() on the .persistent_register keyring; the attacker controls both sides by repeatedly calling KEYCTL_GET_PERSISTENT (including from multiple threads) while driving key expiry/GC via keyctl timeouts or natural garbage collection. Per kernel guidance, attacker-controlled races are AC:L.\nPR:L - Any unprivileged local user who can invoke keyctl() can call KEYCTL_GET_PERSISTENT for their own UID (-1) with a writable destination keyring (e.g., session keyring). No real-root or CAP_SETUID capability is required for the vulnerable lookup path; this remains PR:L even inside user namespaces.\nUI:N - Exploitation requires only the attacker's own keyctl syscalls and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary on its own.\nC:H - assoc_array_find() is documented to require an RCU read lock, but the persistent-keyring path called it without one while assoc_array_gc() frees tree nodes via call_rcu(), yielding a use-after-free on assoc_array nodes/leaves. UAF on kernel heap objects can be turned into arbitrary kernel memory reads.\nI:H - The freed assoc_array nodes can be reallocated and corrupted through concurrent GC versus lookup, providing a standard kernel heap UAF primitive that can be developed into arbitrary write or code-execution primitives.\nA:H - Dereferencing RCU-freed assoc_array tree nodes during lookup can cause kernel oops/panic from invalid pointer access, and UAF exploitation commonly destabilizes or crashes the kernel even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64015","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64018","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached via MSI-driven hardware completion processing in the MANA HWC control path (not netdev packet receive), triggered when the Azure hypervisor/host tampers with guest-visible DMA-coherent WQE memory on the same physical compute node.\nAC:L - A malicious host or NIC firmware that can modify shared unencrypted DMA buffers controls both the forged sge->address and the timing of HWC RX completions, allowing reliable out-of-bounds indexing without winning a race or depending on guest state.\nPR:N - Exploitation requires no privileges on the victim guest VM; the attacker operates from the Azure hypervisor/host side by modifying DMA-coherent memory that the guest kernel trusts during HWC response handling.\nUI:N - No victim user action is required; exploitation occurs automatically when the driver processes a hardware completion event on the HWC receive queue.\nS:C - In Confidential VMs the guest relies on host isolation guarantees, but shared unencrypted DMA memory lets a hostile hypervisor cross that CVM security boundary to corrupt guest kernel memory and confidentiality.\nC:H - An out-of-bounds rx_req_idx yields a corrupted hwc_work_request whose buf_va is dereferenced and copied via memcpy in mana_hwc_handle_resp(), enabling arbitrary kernel memory disclosure.\nI:H - The out-of-bounds hwc_work_request supplies attacker-controlled pointers and SGE fields used to repost RX WQEs via mana_hwc_post_rx_wqe(), enabling kernel heap corruption and exploitable memory writes.\nA:H - Indexing reqs[] out of bounds with attacker-controlled values can dereference invalid kernel pointers and corrupt adjacent heap objects, causing kernel oops/panic and denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64018","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64029","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access via the ALSA sequencer device node (/dev/snd/seq) using write(2) and port-subscription ioctls; there is no network, Bluetooth, or physical-device attack surface on the vulnerable code path.\nAC:L - The race is between concurrent UMP event delivery and the last output-port unsubscribe/close path, and a local attacker can control both sides with parallel threads (flood write() while repeatedly subscribing/unsubscribing to the UMP port).\nPR:L - Any local unprivileged user who can open /dev/snd/seq (typically membership in the audio group on desktop/workstation systems where UMP MIDI hardware is present) can create sequencer clients, subscribe to UMP kernel ports, and trigger the bug without real root or init-namespace capabilities.\nUI:N - Exploitation is fully attacker-driven through sequencer writes and subscription management; no victim interaction such as opening files, mounting filesystems, or plugging in devices is required beyond the UMP endpoint already being present on the system.\nS:U - Impact is confined to kernel memory corruption and potential local privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary bypass.\nC:H - KASAN confirmed a slab use-after-free on freed substream runtime metadata in snd_rawmidi_kernel_write1(); UAF on kernel heap objects enables controlled reallocation and arbitrary kernel memory disclosure primitives.\nI:H - The UAF occurs inside snd_rawmidi_kernel_write1(), which performs memcpy() into runtime->buffer using attacker-supplied UMP event payload, providing a plausible path to arbitrary kernel memory corruption and code execution beyond a simple crash.\nA:H - The confirmed KASAN slab-use-after-free in kernel write path causes kernel oops/panic; even without full exploitation, the bug reliably threatens system availability through kernel crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64029","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64034","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a malicious hypervisor or host that can modify MANA HWC DMA-coherent response buffers between guest kernel loads; it is not reachable by sending network packets to the guest's data path.\nAC:L - The attacker controlling the hypervisor fully controls DMA buffer contents and can reliably flip hwc_msg_id between the validation read and the use in mana_hwc_handle_resp() on uncacheable coherent memory.\nPR:N - The attacking hypervisor needs no guest OS credentials or capabilities; exploitation targets the guest kernel through the virtual device DMA path while the MANA driver is active.\nUI:N - No victim user action is required beyond normal Azure VM operation with the MANA driver loaded and HWC receive buffers posted.\nS:C - The vulnerability crosses the VM/DMA security boundary by allowing a hostile hypervisor to corrupt guest kernel memory that the confidential-guest threat model assumes is protected from host tampering.\nC:H - Out-of-bounds indexing via bypassed hwc_msg_id validation enables reading adjacent kernel heap objects through misdirected caller_ctx access and test_bit() on the inflight bitmap.\nI:H - Host-controlled response data is copied with memcpy() to an out-of-bounds output_buf pointer, enabling arbitrary kernel memory corruption and potential control-flow hijacking.\nA:H - Out-of-bounds caller_ctx access and corrupted completion signaling can cause kernel oops, panic, or hang during HWC response handling."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64034","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64048","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The fault is triggered while processing a malicious CLC ACCEPT message received from a remote TCP peer during the SMC-D handshake; the attacker controls the server response over the network.\nAC:L - Once a victim with SMC-Dv2 hardware initiates an SMC connection, a malicious peer can reliably send `d1.chid == 0` in the CLC ACCEPT to match the empty reserved slot 0 without races or special timing.\nPR:N - No local privileges are required on the victim host; an unauthenticated remote attacker operating a malicious SMC server can crash connecting clients, and unprivileged users can create SMC sockets without capability checks.\nUI:N - Exploitation requires only that a victim application initiate a normal outbound SMC connection to the attacker's server, which occurs automatically in enterprise middleware without per-connection user action.\nS:U - The vulnerability causes a kernel crash on the victim host but does not cross a security boundary such as VM escape or sandbox breakout.\nC:N - The bug is a null pointer dereference when taking `ism_dev[0]->lgr_lock`; it causes an immediate kernel fault with no information disclosure.\nI:N - The attempted write at address 0x68 is a spinlock operation on a NULL `smcd_dev` pointer, not a controlled or arbitrary memory modification primitive.\nA:H - A successful trigger causes a kernel null pointer dereference (KASAN-reported oops/panic), crashing the affected system or at minimum the connecting process's kernel context."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64048","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64098","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through local DRM ioctl syscalls (DRM_IOCTL_MODE_CURSOR and DRM_MASTER modesetting ioctls) on /dev/dri/card0, not via any network-facing kernel service.\nAC:L - An attacker can reliably trigger the bug by signaling a thread blocked in dma_resv_lock_interruptible (-EINTR), forcing memory pressure for -ENOMEM, or running concurrent plane updates to race the unlocked fence-list mutation.\nPR:L - Exploitation requires DRM master on the virtio-gpu device, which a local user with standard DRI access (video/render group membership on typical virtio-gpu VMs) can obtain when no compositor holds master; this is not init-namespace root.\nUI:N - Triggering the bug requires only attacker-initiated DRM ioctl calls (cursor/plane updates); no action by another user or victim is needed.\nS:U - The corruption occurs within the same kernel security domain (guest or host) that issued the ioctl; virtio-gpu runs in the guest kernel and this does not cross a VM/hypervisor boundary to the host.\nC:H - Mutating the dma_resv fence list without holding the lock races with concurrent readers and can corrupt kernel heap metadata, which is reasonably leverageable for arbitrary memory disclosure.\nI:H - The same unlocked fence-list corruption can corrupt kernel pointers and synchronization state, providing a plausible path to arbitrary kernel writes or control-flow hijacking.\nA:H - The bug produces kernel WARN/oops under lockdep and fence-list corruption can cause kernel crashes, hangs, or panics during subsequent dma_resv operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64098","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64109","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local syscalls on AF_UNIX SOCK_STREAM sockets (recvmsg, splice_read, setsockopt SO_PEEK_OFF), not via any network protocol handler.\nAC:L - The attacker controls both racing threads on the same socket fd and can retry the peek/normal-recv interleaving; this is a self-induced race, not one dependent on uncontrollable kernel state.\nPR:L - Any unprivileged local user can create AF_UNIX socketpairs, set SO_PEEK_OFF, and run concurrent recv operations without capabilities, including from within user namespaces.\nUI:N - Exploitation requires no victim interaction; the attacker sets up and races their own socket endpoints programmatically.\nS:C - Successful kernel heap UAF exploitation from an unprivileged container, Android app sandbox, or user-namespace tenant crosses the sandbox boundary to compromise the host kernel.\nC:H - This is a slab use-after-free read of sk_buff->len on freed memory, which per UAF guidance enables arbitrary kernel memory disclosure and heap layout leaks.\nI:H - UAF on sk_buff objects in the kernel heap can be leveraged through heap grooming and spraying to obtain arbitrary write and kernel code execution primitives.\nA:H - The UAF read can trigger KASAN slab-use-after-free faults, kernel oops, or panic during the dereference, and repeated triggering causes denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64109","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64114","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (socket/sendmsg on a raw IP_HDRINCL socket); malformed packets are injected locally into the output path, not via remote network ingress which validates ihl >= 5.\nAC:L - The attacker fully controls the crafted header ihl value and can install the required xfrm AH policy and route via CAP_NET_ADMIN in their own network namespace, making exploitation reliable without conditions outside attacker control.\nPR:L - Triggering requires CAP_NET_RAW for raw sockets and CAP_NET_ADMIN to install xfrm AH policy, both obtainable by an unprivileged user via user+network namespaces or a container granted NET_ADMIN without init-namespace root.\nUI:N - No victim interaction is required; the attacker sends the malformed packet directly through their own raw socket and configured IPsec policy.\nS:U - Impact is kernel memory corruption and panic within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The integer underflow in ah_output() memcpy length produces an out-of-bounds read of near SIZE_MAX bytes, providing an arbitrary kernel memory read primitive beyond any bounded disclosure.\nI:H - The same memcpy with underflowed length causes a massive out-of-bounds write that can corrupt adjacent kernel heap memory and be leveraged for control-flow hijacking.\nA:H - The OOB memcpy reliably causes a kernel-mode fault and host panic, as reproduced with KASAN and in a rootless Docker container, denying all system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64114","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64115","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local AF_VSOCK syscalls (connect/close) to drive VMCI control packets; per kernel CVSS guidance, vsock is scored Local even when the peer is a VM guest reaching a host listener.\nAC:L - The attacker controls both sides of the handshake race by initiating a connection and aborting it with RST during TCP_SYN_SENT; KASAN testing showed 52/100 repro without conditions outside attacker control.\nPR:L - Any unprivileged local user inside a VM (or on the same host) can open AF_VSOCK sockets and connect to a listening peer without CAP_NET_ADMIN or other elevated privileges.\nUI:N - Exploitation requires only a victim service with a bound/listening vsock socket, which is normal background operation; no interactive victim action is needed.\nS:C - In the most severe reasonable VMware deployment, an unprivileged guest VM triggers kernel memory corruption on the hypervisor host via VMCI vsock, crossing the guest-to-host virtualisation security boundary analogous to KVM/Xen VM escape.\nC:H - The bug is a slab use-after-free on struct sock; UAF on kernel heap objects enables arbitrary memory read primitives through controlled reuse of the freed socket structure.\nI:H - The UAF involves a write to a freed object's refcount field and corrupts kernel heap metadata, providing a foundation for arbitrary write and kernel code execution via heap grooming.\nA:H - The vulnerability reliably triggers kernel UAF detected by KASAN (refcount write to freed memory on a kworker), which causes kernel oops/panic and denial of host availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64115","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64247","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggering requires a Hyper-V TLB-flush hypercall from an L2 vCPU under KVM, ultimately reached through the local KVM_RUN ioctl; no network path reaches it.\nAC:L - A malicious nested-virtualization tenant controls both the unchecked enlightened-VMCS/VMCB VP ID and the sparse-bank hypercall data, with no uncontrollable race required.\nPR:L - The attacker needs control of a KVM guest with nested virtualization, or ordinary /dev/kvm access to create one, but requires neither host root nor an init-namespace capability.\nUI:N - Once the crafted nested guest executes, no action by another user is required.\nS:C - The out-of-bounds access occurs in the host kernel from attacker-controlled guest state, crossing the KVM guest-to-host isolation boundary.\nC:H - The attacker-selected VP ID makes test_bit() query selectable bits far beyond the stack-resident 64-bit mask, and the resulting TLB-flush decision can provide an oracle for host kernel memory.\nI:N - The primitive performs reads only; a set result merely selects a legitimate L2 vCPU for an extra TLB flush, with no out-of-bounds write or unsafe mapping change.\nA:H - The selectable access can reach a VMAP_STACK guard or another unmapped page and oops the host; KASAN already detects the access as an eight-byte invalid read, which can become a host-wide denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64247","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64266","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - A local attacker reaches the flaw by serving a self-created FUSE mount and invoking splice() on its associated /dev/fuse descriptor.\nAC:L - The attacker controls writeback generation, splice processing, and concurrent connection abort, allowing repeated attempts at the race without an uncontrollable prerequisite.\nPR:L - FUSE supports user-namespace mounts, and an unprivileged mount owner can operate /dev/fuse and abort their own connection without init-namespace root.\nUI:N - The attacker can create and exercise their own FUSE connection without any victim action.\nS:U - Exploitation compromises the kernel within the same operating-system security authority and does not inherently cross a virtualization boundary.\nC:H - The freed argument and folio arrays are subsequently dereferenced, permitting attacker-influenced stale folio pointers and potential arbitrary kernel-memory disclosure through pipe buffers.\nI:H - Heap reclamation can replace the freed folio pointers and loop metadata, enabling attacker-directed memory or refcount operations that may support arbitrary writes and kernel code execution.\nA:H - The repeatable use-after-free and invalid folio operations can cause an oops, panic, or other complete system failure."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64266","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64268","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - siw carries iWARP over ordinary routable TCP, and the vulnerable receive callback processes crafted Read Response FPDUs from the remote endpoint of an established RDMA connection.\nAC:L - The peer learns the sink tag, address, and length from the RREAD and can deterministically send oversized continuation segments; no race or uncontrollable condition is required.\nPR:N - The MPA/siw data path performs no credential or capability check on the connected peer, and an unauthenticated RDMA service can accept the connection and issue attacker-induced RREADs.\nUI:N - The overflow is triggered through an automated RDMA protocol exchange and requires no human action.\nS:U - The corruption compromises resources within the affected host's kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The global DMA/KVA sink case exposes the sink address and permits attacker-controlled kernel memory corruption, which can enable control-flow hijacking and arbitrary kernel-memory disclosure.\nI:H - Attacker-chosen response bytes are written beyond the validated sink into adjacent kernel memory, providing an exploitable out-of-bounds write capable of modifying objects or achieving kernel code execution.\nA:H - The overwrite can corrupt critical kernel objects or reach invalid memory, causing an oops or panic; bounded FRWR sinks still permit connection-terminating denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64268","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64304","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An unprivileged local process can add a crafted PKCS#8 RSA private key to its own keyring and invoke KEYCTL_PKEY_QUERY, which selects qat-rsa and reaches the vulnerable key setup path.\nAC:L - With an active QAT asymmetric service and PKCS#8 parser, an oversized CRT integer deterministically causes unsigned offset underflow and an out-of-bounds memcpy. No race or attacker-uncontrollable condition is required.\nPR:L - An ordinary user can create, search, and use keys in a personal process, thread, or session keyring. No capability, administrator privilege, or user namespace is required.\nUI:N - The attacker directly performs the add_key and keyctl system calls without any victim action.\nS:U - The vulnerable QAT driver and the corrupted kernel resources share the same security authority. Ordinary kernel privilege escalation does not cross a CVSS scope boundary.\nC:H - The controlled kernel-memory overwrite can corrupt page tables, credentials, or control-flow objects and plausibly yield code execution with access to protected kernel memory.\nI:H - Attacker-controlled CRT bytes are written outside the coherent DMA allocation, potentially through multiple CRT components. This can provide powerful kernel-memory corruption and control-flow hijacking primitives.\nA:H - The invalid destination can cause an immediate kernel fault or corrupt unrelated kernel memory and subsequently panic or hang the system. The attack is repeatable."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64312","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - pcrypt is designed for network-facing IPsec use, and an inbound ESP packet can traverse xfrm_input(), esp_input(), crypto_aead_decrypt(), and pcrypt_aead_decrypt().\nAC:L - In load-responsive CPU-hotplug deployments, an attacker can flood qualifying ESP requests across repeated PADATA_RESET windows without precise timing or an uncontrollable memory-layout condition.\nPR:N - The ESP SPI is transmitted in clear, and the faulty path is reached before the child AEAD validates the integrity tag, so an unauthenticated on-path attacker needs no target-system privileges.\nUI:N - Packet delivery and asynchronous completion require no victim action.\nS:U - The failure affects the same kernel security authority processing the request and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The rejected request retains a zero padata->pd pointer, producing a NULL dereference without an out-of-bounds read or information disclosure.\nI:N - The callback writes only the completion status into its valid request context before dereferencing NULL; it provides no attacker-directed corruption or write primitive.\nA:H - padata_do_serial() dereferences the uninitialized padata->pd pointer, causing a kernel oops or panic that can terminate the system and can be retriggered."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64312","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64355","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A remote peer can send an oversized packet that a fragment-capable NIC represents as a multi-buffer XDP frame, reaching the vulnerable devmap broadcast clone path on a configured forwarding host.\nAC:L - No race or uncontrollable timing condition is required; fragmented packets reliably enter the faulty clone path and can be sent repeatedly.\nPR:N - Although initial-namespace CAP_BPF and CAP_NET_ADMIN are needed to configure the XDP deployment, the attacker sending packets through the already-configured unauthenticated data path needs no privileges.\nUI:N - Packet reception and XDP processing occur automatically without victim action.\nS:U - The corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other distinct boundary.\nC:H - Uninitialized fragment descriptors are consumed as page references and can be used by scatter-gather transmitters for unintended DMA mappings, potentially exposing arbitrary kernel memory.\nI:H - An uninitialized fragment count can overrun fixed-size driver arrays, while bogus page references can cause invalid refcount decrements, premature frees, and exploitable kernel memory corruption.\nA:H - Invalid fragment metadata can fault during DMA mapping, transmission, or frame return and cause a kernel oops or panic; an attacker can trigger this repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64355","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64383","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB server can trigger the flaw through crafted replayable responses and connection failures over the network.\nAC:L - The server controls both the replayable error and subsequent reconnect failure, allowing repeated triggering without an uncontrollable race.\nPR:N - The attacking SMB endpoint requires no privileges on the client system once an SMB session and file handle exist.\nUI:N - An automatically mounted share and routine service-generated fsync, truncate, timestamp, or seek operations can reach SMB2_flush() without human participation.\nS:U - The memory corruption compromises resources governed by the same host kernel security authority.\nC:H - The response-buffer double-free can create overlapping CIFS slab allocations and use-after-free primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and attacker-influenced overlapping network buffers can provide arbitrary-write or control-flow-hijacking primitives.\nA:H - The double-free can immediately trigger an allocator BUG, kernel oops, or panic and can be invoked repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64383","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64384","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious SMB server can return a replayable response and then force reconnect failure over the network, causing the client to free stale response state twice.\nAC:L - The peer controls both prerequisites by returning a status such as STATUS_RETRY and then disconnecting or refusing reconnection; repeated attempts make the scheduling window attacker-controllable.\nPR:N - The malicious SMB peer requires no account, capability, or other privilege on the vulnerable client; the established client session does not grant the attacker privileges on that host.\nUI:N - An ordinary automated CIFS workload can maintain an outstanding change-notify request, after which the remote peer completes the trigger without human involvement.\nS:U - Exploitation compromises the kernel and resources governed by the same host security authority, without crossing a separate virtualization or sandbox boundary.\nC:H - The double-free corrupts the CIFS response-buffer slab or mempool, permitting overlapping live objects and freelist manipulation that can support disclosure of arbitrary kernel memory.\nI:H - The heap corruption can provide attacker-influenced writes through aliased request and response buffers or freelist poisoning, potentially enabling kernel control-flow hijacking.\nA:H - Hardened allocators can immediately panic on the consecutive double-free, while unhardened allocators can crash later through freelist corruption."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64384","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64385","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - An attacker-controlled SMB server can deliver crafted SMB2 IOCTL responses over TCP, including through the kernel's periodic interface-query FSCTL on an existing SMB3 mount.\nAC:L - On a hard or retrans-enabled mount, the server controls replayable statuses, response contents, disconnects, reconnects, and repeated attempts, allowing it to drive both sides of the triggering sequence.\nPR:N - The malicious SMB server needs no account or privilege on the target; victim mounting authority and client authentication do not grant or require attacker-side target privileges.\nUI:N - Once the share is mounted, kernel delayed work can automatically issue the affected FSCTL when the server advertises multichannel support, requiring no user action during exploitation.\nS:U - The memory corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, container, or IOMMU boundary.\nC:H - The response-buffer double-free can corrupt SLUB or mempool state and create dangling or overlapping live buffers, enabling use-after-free exploitation and kernel-memory disclosure.\nI:H - Attacker-controlled network data can overwrite aliased or freed buffers and poison allocator state, supporting arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can trigger an allocator BUG or corrupt kernel heap state, causing an oops, panic, or complete system crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64385","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64386","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB2/3 server can remotely return a response-bearing replayable error and manipulate the subsequent connection state, reaching the vulnerable client over TCP.\nAC:L - The server controls the error response, disconnect, and reconnection sequence and can repeat it until the stale free occurs. Replay-enabled hard or retrans-configured SMB mounts are a reasonable deployment.\nPR:N - The malicious SMB peer needs no privileges or credentials on the client; SMB session setup authenticates the client to the server, not the attacker to the victim kernel.\nUI:N - Once the share is mounted, ordinary or automated file and metadata operations issue query-info requests, and exploitation requires no human action during the crafted response and reconnect sequence.\nS:U - The corruption and resulting impacts occur within the same Linux kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:H - The double-free corrupts SMB response-buffer slab and mempool state, enabling aliased or use-after-free buffers that can be leveraged to expose kernel memory.\nI:H - Allocator freelist corruption and reuse of one buffer by concurrent SMB operations can provide attacker-controlled modification of live kernel memory and support control-flow hijacking.\nA:H - The repeated free can immediately cause allocator corruption, a BUG, kernel oops, or panic, and the malicious server can trigger the sequence repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64386","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64387","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious remote SMB server can trigger the flaw through crafted responses to SMB2 QUERY_DIRECTORY requests over the established network connection.\nAC:L - On a hard/retrans-enabled mount, the server controls the replayable error and can repeatedly induce disconnect/reconnect conditions before request reinitialization, without relying on an uncontrollable race.\nPR:N - The attacker needs no account or privilege on the client; the client authenticates to the attacker-controlled SMB server, and ordinary accessible-share enumeration reaches the code.\nUI:N - In a reasonable auto-mounted deployment, routine directory enumeration can be performed automatically by a daemon or application without human participation.\nS:U - The corruption occurs within the client kernel and compromises resources governed by that same kernel security authority.\nC:H - Double-freeing the attacker-influenced CIFS response object can poison the slab freelist or create overlapping allocations, providing UAF-style primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and aliased CIFS buffers can enable attacker-influenced writes and potentially control-flow hijacking or kernel code execution.\nA:H - The double-free can immediately trigger allocator diagnostics, an oops, or a kernel panic, and corrupted freelists can cause subsequent fatal faults."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64387","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64423","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An end-to-end attacker-controlled trigger requires local socket and netlink operations to create multicast memberships and concurrently destroy IPv4 device state; received multicast packets alone cannot initiate the necessary teardown. These operations are reachable inside an attacker-created user and network namespace.\nAC:L - The attacker can populate mc_hash, generate continuous multicast traffic, and repeatedly tear down IPv4 state, controlling both sides of the race. No victim-dependent timing or secret state is required.\nPR:L - Device teardown or invalid-MTU configuration requires CAP_NET_ADMIN in the target network namespace, while multicast joins and UDP sends are unprivileged. An ordinary user can obtain this namespace-scoped capability through unprivileged user and network namespaces.\nUI:N - Exploitation requires no action by another user once the attacker can execute locally and create the required namespace and traffic.\nS:U - The vulnerable code and resulting host-kernel compromise remain within the same security authority; this is conventional kernel privilege escalation rather than a guest-to-host escape.\nC:H - The stale kmalloc-256 ip_mc_list entry exposes reuse-controlled fields and pointers to kernel reads, making kernel-memory disclosure and broader read primitives plausible.\nI:H - Reallocation permits attacker-influenced object contents to drive spinlock writes and pointer traversal on freed memory, making heap corruption and control-flow hijacking defensible.\nA:H - The confirmed slab use-after-free can dereference corrupted hash pointers or operate on an invalid spinlock, causing a kernel oops, panic, general-protection fault, or hang."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64423","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64450","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - TIPC packets can arrive through an IP/UDP bearer from a routable remote source, and the receive callback does not restrict packets to configured remote addresses. An attacker can also establish or spoof the required TIPC neighbour state without credentials.\nAC:L - The attacker controls capability advertisement, link establishment, broadcast synchronization, and the malformed STATE message; one packet then reliably performs the out-of-bounds copy without a race or uncontrollable condition.\nPR:N - The packet-receive path performs no capability or user-credential check, and TIPC discovery and link negotiation are unauthenticated when optional cryptographic keys are not configured. The vulnerable broadcast processing also precedes normal STATE-session validation.\nUI:N - No victim action is required after the TIPC bearer is active; receipt of the crafted STATE message directly invokes the vulnerable code.\nS:U - The vulnerability compromises availability and potentially confidentiality within the receiving kernel's existing security authority, without crossing a VM, IOMMU, or comparable scope boundary.\nC:H - The attacker-controlled count makes the kernel copy up to 1,024 bytes from a much smaller skb, incorporating substantial adjacent slab contents rather than a strictly bounded few-byte read.\nI:N - The defect performs an out-of-bounds read into a correctly sized new allocation; investigation found no out-of-bounds write, arbitrary-write primitive, or control-flow corruption.\nA:H - The demonstrated 1,024-byte slab-out-of-bounds access produces a KASAN BUG and can panic or fault hardened kernels, and an unauthenticated attacker can trigger it repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64450","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64481","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the vulnerable callbacks through ALSA control ioctls on /dev/snd/controlC*. No network or physical protocol directly exposes this path.\nAC:L - After teardown, stale controls can repeatedly dereference the freed object or queue its embedded work item, so exploitation does not require winning a narrow race. A queued work_struct also remains directly usable after its containing allocation is freed.\nPR:L - An unprivileged user with ordinary audio-device access can invoke the control callbacks. The ioctl path contains no capability, namespace, or administrative privilege check.\nUI:N - Exploitation requires no victim to open content or perform an interactive action.\nS:U - The vulnerable driver and the affected kernel resources are governed by the same kernel security authority.\nC:H - The heap use-after-free permits attacker-influenced reuse and disclosure of freed kernel object contents, potentially supporting arbitrary kernel memory reads.\nI:H - The freed object embeds mutable workqueue list state and a function pointer that is subsequently invoked, making kernel memory corruption and control-flow hijacking defensible.\nA:H - Stale control accesses or corrupted queued work can cause a kernel oops, panic, or workqueue corruption, resulting in complete system unavailability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64481","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64524","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The malicious resolution response must originate from the local Hyper-V synthetic-video backend over VMBus; it is not reachable through a network protocol or guest userspace ioctl.\nAC:L - The backend can deterministically trigger the flaw by returning a resolution_count from 65 through 255 during the normal WIN10+ probe or resume exchange, without a race or unpredictable condition.\nPR:N - The guest accepts the VMBus response without authentication, capability checks, or guest credentials; a malicious or compromised backend requires no privileges within the vulnerable guest.\nUI:N - The response is processed automatically during device probing or resume, without any victim action.\nS:U - The vulnerable parser and the affected DRM and kernel resources are within the same guest-kernel security authority; this does not produce a guest-to-host escape.\nC:H - A count of 255 causes 191 additional four-byte entries to be read beyond the declared array, substantially exceeding a small bounded disclosure and allowing out-of-bounds kernel data to influence observable display state.\nI:N - The invalid accesses are reads, and their results are written only to the intended resolution fields; no out-of-bounds write, use-after-free, or control-flow corruption was found.\nA:H - Bounds-instrumented hardened kernels can oops when index 64 is reached, while a failed or malformed resolution probe can leave zero maximum dimensions and make every userspace framebuffer creation fail."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64524","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64541","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable handler is driven entirely by a CDC control message sent by the remote SMC-R peer over the RDMA link, with an attacker-chosen `token` field and no local syscall involvement. SMC-R runs over RoCEv2 (IP/UDP-routable, port 4791) with the CLC handshake over plain TCP, and SMC-Rv2 explicitly supports non-local/routed peers, so the attacker need not share an L2 segment.\nAC:L - The attacker controls both sides of the race: it chooses when to emit CDC messages and which connection to target (the alert token is disclosed to it in the CLC accept/confirm), and it can drive the teardown side itself via CDC close/abort flags into `smc_close_passive_work()` or a stale seqno with `failover_validation` into `abort_work` -> `smc_conn_kill()`. The race can be retried indefinitely across many connections in the same link group, and was reproduced in practice with soft-RoCE.\nPR:N - Establishing an SMC-R connection to a listening SMC socket requires no credentials — SMC has no authentication layer of its own, exactly like plain TCP. Everything after connection establishment (sending CDC messages with a chosen token, signalling close/abort) is available to an unauthenticated peer.\nUI:N - The CDC message is processed in a softirq tasklet from the RDMA completion queue with no involvement from any local user or application action. No victim interaction of any kind is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard in-kernel use-after-free.\nC:H - The freed `smc_sock` is reused type-safely as another live socket, so attacker-supplied cursors applied by `smc_cdc_msg_recv_action()` break the `0 <= bytes_to_rcv <= rmb_desc->len` invariant and make `smc_rx_recvmsg()` hand stale RMB contents to userspace, while the urgent-data path reads `*(base + conn->urg_curs.count - 1)` at an attacker-chosen offset. Once the slab page is reclaimed after the RCU grace period, reuse is unconstrained, giving a general kernel-memory read primitive.\nI:H - `sock_hold()` on an already-zero refcount followed by `sock_put()` re-enters `sk_free()`, yielding a double free, and the handler additionally writes `sk_err`/`sk_shutdown`, makes indirect calls through `sk_data_ready()`/`sk_write_space()`, and `queue_work()`s a freed `work_struct`. These are classic heap-spray and control-flow-hijack primitives leading to arbitrary kernel write.\nA:H - The reported symptom is `refcount_warn_saturate` from `smc_cdc_msg_recv()`, which is an immediate kernel panic on `panic_on_warn` systems, and dereferencing freed memory in softirq context otherwise oopses. The attacker can trigger it repeatedly without authentication."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64541","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64543","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The free side is only reachable through the local TIPCv2 generic-netlink `BEARER_DISABLE` command (or netns teardown); a remote peer can supply the discovery packet that performs the use-after-free access but cannot itself cause `bearer_disable()` to run, so the complete attack requires local access.\nAC:L - The attacker controls both sides of the race — one thread floods TIPC discovery packets at the bearer's UDP port while another disables the bearer — and `bearer_disable()` clears `b->up` and then `kfree()`s the discoverer with no synchronization whatsoever, leaving a wide window that a multi-CPU packet flood hits reliably (a working PoC exists).\nPR:L - `tipc_genl_family` is `.netnsok = true` and the bearer enable/disable ops carry no `GENL_ADMIN_PERM` or other capability check, so an unprivileged user can do everything inside `unshare -Urn` after autoloading tipc via `socket(AF_TIPC, ...)`.\nUI:N - The attacking process performs both the bearer disable and the packet injection itself; no victim action or cooperating user is involved.\nS:U - The corruption stays within the kernel's own security authority — no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - `d->net` is read from the freed slab object and dereferenced as a `struct net *`; after reclaiming the kmalloc-192 allocation with sprayed data the attacker gains a controlled-pointer dereference chain usable for arbitrary kernel memory disclosure.\nI:H - `msg_set_prevnode(buf_msg(d->skb), sugg_addr)` writes a wire-controlled 32-bit value through the dangling `d->skb` pointer, and `tipc_disc_add_dest()` takes a spinlock and increments a counter in freed memory — together a controlled-address/controlled-value write suitable for control-flow hijacking.\nA:H - The use-after-free reliably produces a KASAN slab-use-after-free in softirq context and, on production kernels, a corrupted-pointer dereference or spinlock manipulation on reclaimed memory leading to kernel panic."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64543","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64562","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local KVM nested VMX: open /dev/kvm, run a nested guest, then tear down nested state (VMXOFF/handle_vmxoff or vmx_leave_nested). It is not reachable via network or adjacent-radio packets.\nAC:L - A KVM VMM attacker controls both sides of the race by driving nested teardown (VMXOFF/vcpu destroy) while forcing vCPU migration via thread affinity/scheduling so __loaded_vmcs_clear() VMCLEARs the dangling shadow VMCS pointer.\nPR:L - Exploitation needs permission to use /dev/kvm and nested VMX (commonly kvm-group or equivalent), not real init-namespace root; KVM create/run ioctls have no CAP_SYS_ADMIN gate on this path.\nUI:N - After the attacker has KVM/nested access, they trigger free_nested and migration themselves; no separate victim action is required.\nS:C - free_nested runs in host KVM while handling L1 nested VMX teardown, and the UAF corrupts host kernel memory, crossing the guest/hypervisor isolation boundary (guest-to-host escape class).\nC:H - The dangling shadow VMCS pointer lets VMCLEAR operate on a freed page that may be reused, yielding a host kernel use-after-free that can be leveraged for arbitrary information disclosure.\nI:H - VMCLEAR writes VMCS state into the freed page; with page reuse this is host heap corruption enabling write primitives and potential host code execution, consistent with UAF guidance.\nA:H - Use-after-free of the shadow VMCS page can oops/panic the host kernel when VMCLEAR or later accessors touch reallocated memory, fully denying host availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64562","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64563","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via local netlink sock_diag dumps (e.g. netlink_diag over NETLINK_SOCK_DIAG) and similar local dump walkers such as TIPC_NL_SOCK_GET; not reachable from remote packet processing.\nAC:L - Attacker controls both sides of the race by running a multi-fragment rhashtable dump while concurrently creating/destroying netlink (or TIPC) sockets to force table resize and free the walked object.\nPR:L - An unprivileged local user can open NETLINK_SOCK_DIAG and dump without CAP_NET_ADMIN; CAP_NET_ADMIN is only required for SOCK_DESTROY, and TIPC_NL_SOCK_GET likewise has no admin permission flag.\nUI:N - Exploitation requires only attacker-issued syscalls (netlink dump plus concurrent socket churn); no victim action is needed.\nS:U - Impact is memory corruption within the host kernel authority (local privilege escalation/crash), not a cross-boundary escape such as guest-to-host or IOMMU bypass.\nC:H - Use-after-free read of a freed hashed object (e.g. netlink_sock) can be reclaimed via heap spray, yielding an arbitrary read primitive through subsequent walk/diag use of the corrupted pointer.\nI:H - UAF on a reclaimable slab object enables heap spraying and fake-object injection into the walk path, which can be leveraged for arbitrary write or control-flow hijacking.\nA:H - The demonstrated KASAN slab-use-after-free in rhashtable_walk_next can oops/panic the kernel, and UAFs remain crashable even when not fully exploited."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64563","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64581","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via setsockopt(IP_XFRM_POLICY/IP_IPSEC_POLICY) on a local socket racing concurrent udp_sendmsg; entry is a local syscall path (do_ip_setsockopt -> xfrm_user_policy), not packet processing.\nAC:L - Attacker controls both sides of the race (one thread setsockopt to clear/apply per-socket xfrm policy, another sendmsg on the same connected UDP socket) and can create the obsolete xfrm_dst precondition in their netns, retrying until the double dst_release wins.\nPR:L - Path requires CAP_NET_ADMIN checked with sockopt_ns_capable(sock_net(sk)->user_ns), which an unprivileged user obtains via user+network namespaces; the fix commit explicitly states this reachability.\nUI:N - Exploitation uses only the attacker's own socket, threads, and setsockopt/sendmsg loops; no victim action or cooperation is required.\nS:U - Double-free/UAF of the socket's dst_entry/xfrm_dst is standard local kernel memory corruption within the host kernel authority, not a VM escape or other cross-boundary impact.\nC:H - Double dst_release frees the xfrm_dst slab object while still referenced, yielding a use-after-free that can be reclaimed/sprayed to disclose kernel memory via corrupted dst contents and ops.\nI:H - The UAF targets a dst_entry with function pointers (ops/input/output) used on transmit, enabling heap reuse for arbitrary write and control-flow hijack consistent with comparable sk_dst_cache races.\nA:H - The KASAN slab-use-after-free in dst_release demonstrates kernel memory corruption that can oops/panic, and the attacker can repeat the race freely."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68121","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in pppoe_sendmsg(), reached only via the local sendmsg() syscall on a PF_PPPOX/PPPoE socket; it is not triggered by remote packet reception or in-kernel PPP transmit paths such as __pppoe_xmit().\nAC:L - Exploitation requires a race between copy_from_user() blocking in sendmsg and changing team header_ops (e.g., adding the first non-Ethernet GRE port), which an attacker can drive with concurrent threads and retries rather than uncontrollable timing.\nPR:L - PPPoE sockets can be created without special privileges, and configuring the team/GRE topology needed to trigger dev_hard_header() head expansion is achievable with CAP_NET_ADMIN inside an unprivileged user/network namespace (unshare -Urn).\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through socket I/O and netlink/rtnl configuration of the team device.\nS:U - Impact is kernel heap corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - Writing PPPoE header fields through a stale pointer after pskb_expand_head() frees the old skb head is a slab use-after-free; freed kmalloc objects can be reclaimed for sensitive data, enabling arbitrary kernel memory disclosure.\nI:H - The post-dev_hard_header() memcpy/ph->length stores up to eight attacker-influenced bytes into freed skb head memory, providing a heap corruption primitive that can be developed into arbitrary kernel writes or code execution.\nA:H - Use-after-free writes into freed slab memory commonly cause kernel oops/panic and can be triggered repeatedly via sendmsg, yielding persistent denial of service even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68121","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68136","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached from the standard NAPI GRO receive path processing remotely originated TCP/IP packets (napi_gro_receive→dev_gro_receive→tcp_gro_receive→skb_gro_receive_list), including tethering/NAT/forwarding scenarios where packets re-enter GRO on a second netdev after driver LRO or prior GRO aggregation.\nAC:L - An attacker can reliably trigger the bug by crafting a TCP stream through a forwarding host with rx-gro-list enabled, without races or victim-specific timing; the commit documents a deterministic tethering/forwarding repro where flush-marked frag_list skbs are re-aggregated and later crash skb_segment.\nPR:N - No local privileges or authentication are required; any remote peer that can send TCP traffic through a vulnerable forwarding/tethering/NAT Linux host can reach the GRO fraglist merge path, which performs no capability or credential checks on the receive path.\nUI:N - Exploitation requires only network-delivered packets and normal kernel forwarding/GRO processing; the victim does not need to open files, mount filesystems, click links, or perform any deliberate action beyond routine network operation.\nS:U - Impact is confined to kernel memory corruption and panic within the same host kernel security domain during packet GRO aggregation and subsequent segmentation on transmit; it does not cross VM, container, or IOMMU boundaries to affect a separate security authority.\nC:H - Double aggregation corrupts the skb frag_list chain (loops, dangling references, NULL/corrupted list_skb pointers), constituting kernel heap memory corruption that can be read during skb_segment processing and is classifiable as a high-impact info-disclosure primitive beyond a simple crash.\nI:H - Re-aggregating flush-marked skbs with existing frag_list corrupts skb linked-list structure and reference relationships in kernel memory, enabling potential control of subsequent skb metadata and write/control-flow primitives during GSO segmentation, not merely integrity-preserving packet drops.\nA:H - Corrupted frag_list state causes skb_segment to dereference a NULL or invalid list_skb via skb_headlen(), producing a kernel panic/oops on the transmit path (sch_direct_xmit/qdisc_run), fully denying availability of the affected system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68136","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68138","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local RTM_NEWTFILTER rtnetlink messages (tc flower filter with police action) through rtnetlink_rcv_msg→tc_new_tfilter→fl_change→tcf_police_init→qdisc_get_rtab/qdisc_put_rtab; no remote packet or network protocol path exists.\nAC:L - cls_flower is TCF_PROTO_OPS_DOIT_UNLOCKED, so concurrent RTM_NEWTFILTER requests run without RTNL; the attacker controls both racing threads/CPUs and can repeatedly install flower filters with identical police rate tables to deterministically hit the global qdisc_rtab_list/refcnt race.\nPR:L - Non-GET rtnetlink handlers require netlink_net_capable(CAP_NET_ADMIN); this is namespace-scoped, so an unprivileged local user obtains CAP_NET_ADMIN via user namespaces (unshare -Urn), sets up clsact/ingress, and installs flower+police rules without init-namespace root.\nUI:N - Exploitation is fully self-contained: the attacker issues the concurrent tc/netlink commands from its own processes and needs no victim to mount filesystems, click links, or perform any other interactive action.\nS:U - Impact is heap corruption and UAF/double-free in kernel kmalloc-2k slabs within the same kernel security authority; although qdisc_rtab_list is global across netns, this is standard kernel memory corruption/privilege escalation, not a VM, IOMMU, or sandbox boundary escape.\nC:H - Concurrent non-atomic refcnt and list updates cause slab use-after-free/double-free of struct qdisc_rate_table (KASAN-confirmed in qdisc_put_rtab); freed 2KB objects are attacker-influenceable via kmalloc timing and are classically weaponizable for arbitrary kernel memory disclosure.\nI:H - The race corrupts a process-global singly linked list and can double-free a kmalloc-2k qdisc_rate_table, yielding classic heap metadata/object corruption primitives that can be developed into arbitrary kernel writes and local privilege escalation/code execution.\nA:H - Demonstrated KASAN slab-use-after-free in qdisc_put_rtab on the error/teardown path, and concurrent double-free of the same rate table can panic the kernel; the trigger is repeatable at will with concurrent netlink requests and causes task death or system-wide instability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68138","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68155","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when libceph decodes CEPH_MSG_MON_MAP from a remote Ceph monitor over the kernel client's established TCP/msgr2 session (mon_dispatch -> ceph_monc_handle_map -> ceph_monmap_decode), which is a network protocol attack surface on CephFS/RBD/cloud nodes.\nAC:L - An attacker who can send monitor protocol messages only needs to set num_mon=0 in the monmap; once accepted, any later session reopen (keepalive timeout, hunt, or connection fault) deterministically hits BUG_ON in pick_new_mon without races or special memory layout.\nPR:N - In the highest-impact scenario a malicious or compromised Ceph monitor (or equivalent authenticated cluster peer) sends the malformed monmap to already-connected kernel clients; the attacker needs no local privileges on the victim host.\nUI:N - After a Ceph client session exists, monmap updates are delivered and processed automatically by the kernel monitor client; no further mount, open, or other victim interaction is required to accept the bad map and later crash on reconnect.\nS:U - Exploitation causes a kernel BUG/panic within the same kernel security domain and does not cross VM, container, IOMMU, or other security boundaries.\nC:N - The failure mode is a BUG_ON assertion in pick_new_mon when num_mon is zero; there is no memory corruption, out-of-bounds access, or other information disclosure primitive on the vulnerable path.\nI:N - Accepting num_mon==0 only stores an empty monmap and later triggers a deliberate kernel BUG; attacker input does not corrupt or modify arbitrary kernel memory or enable code execution.\nA:H - BUG_ON(monc->monmap->num_mon < 1) in pick_new_mon during __open_session causes a kernel oops/panic, fully denying availability of the affected host until reboot."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68155","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68158","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Malformed incremental osdmap data is delivered in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch) to libceph clients (CephFS/RBD), and the overflow is triggered while decoding received network bytes in osdmap_apply_incremental().\nAC:L - A compromised or attacker-controlled monitor/OSD can publish an incremental osdmap with epoch N+1 and a crafted new_state length that wraps the multiply, reliably bypassing bounds checks without races or victim-specific memory layout.\nPR:N - Exploitation requires no privileges on the victim host; a malicious cluster peer or on-path attacker that can deliver forged osdmaps to an already-connected kernel Ceph client needs no local account, capabilities, or user-namespace tricks.\nUI:N - Once a host is a Ceph client, osdmap subscriptions and updates are applied automatically by the kernel; no additional mount, open, or interactive step is needed at exploit time beyond the existing client session.\nS:U - Impact is confined to kernel memory and libceph client state on the Ceph client host (info leak, map corruption, crash, or privilege escalation); it does not cross VM, IOMMU, or sandbox boundaries to another security authority.\nC:H - Integer-overflow bypass lets decode_new_up_state_weight() run bare ceph_decode_32/8 loops past the message end, performing out-of-bounds reads of adjacent kernel heap/slack memory that can disclose pointers and other sensitive data.\nI:H - Misaligned decoding also drives attacker-controlled osd/xorstate/weight values into map->osd_weight[], map->osd_state[], and map->osd_addr[] updates (including memset), corrupting kernel osdmap state in ways usable for further exploitation.\nA:H - Unbounded out-of-bounds reads while parsing osdmaps can fault on unmapped pages and trigger kernel oops/panic; map corruption can also cause persistent client failure, repeatable on each malicious incremental map."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68158","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68159","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Malicious pg_temp/pg_upmap data arrives in CEPH_MSG_OSD_MAP from a Ceph monitor or OSD over TCP, is decoded in libceph, and later triggers stack corruption in ceph_pg_to_up_acting_osds during RBD/CephFS/libceph client I/O.\nAC:L - A compromised or attacker-controlled monitor can publish osdmap entries with length >32 for chosen PGs; once the client subscribes, kernel I/O paths such as RBD mount/probe via calc_target deterministically invoke apply_upmap/get_temp_osds and overflow the stack buffer.\nPR:N - Exploitation requires no privileges on the victim host; any machine acting as a Ceph client that receives a forged osdmap from a cluster peer over the network can be attacked without local user capabilities or namespace tricks.\nUI:N - No victim user action is needed during exploitation beyond the host already being a Ceph client; forged osdmaps are applied automatically and the overflow fires on subsequent kernel client operations without interactive steps.\nS:U - Impact is confined to kernel memory on the Ceph client host (privilege escalation or crash); it does not cross VM, IOMMU, or sandbox boundaries to other security authorities.\nC:H - KASAN-confirmed stack out-of-bounds write in ceph_pg_to_up_acting_osds corrupts adjacent stack memory and can be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Unbounded copy loops in apply_upmap() and get_temp_osds() write attacker-controlled u32 OSD IDs past the fixed osds[CEPH_PG_MAX_SIZE] stack array, enabling control-flow hijack and arbitrary kernel writes.\nA:H - The reported reproducer triggers KASAN stack-out-of-bounds followed by kernel BUG in ceph_pg_to_up_acting_osds, demonstrating a reliable kernel oops or panic from malformed osdmap processing on Ceph clients."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68159","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68160","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - CEPH_MSG_CLIENT_CAPS is received over the kernel Ceph messenger TCP connection from an MDS peer; mds_dispatch() passes it directly to ceph_handle_caps(), so a malicious or compromised MDS (or on-path attacker on an unsigned msgr session) reaches the bug with network data alone.\nAC:L - The attacker fully controls msg->hdr.version and snap_trace_len in the caps header; setting version=1 bypasses all version-gated decoders and snap_trace_len=0xFFFFFFFF yields a fake end pointer that reliably defeats ceph_decode_need(), with no race or memory-layout dependency.\nPR:N - Exploitation requires only the ability to send crafted caps messages as the remote MDS peer on an established session; the attacker needs no account, mount privilege, or other credentials on the victim host beyond the client already being connected to that cluster.\nUI:N - Once CephFS is mounted and the MDS session is open, CEPH_CAP_OP_IMPORT caps messages are delivered and processed automatically during normal cap migration and MDS failover; no additional local user action is needed at exploit time beyond prior cluster connectivity.\nS:U - The out-of-bounds read and resulting snap-realm corruption affect only the kernel CephFS client’s internal state within the same kernel security authority; there is no VM escape, sandbox breakout, or cross-authority boundary crossing.\nC:H - ceph_update_snap_trace() decodes struct ceph_mds_snap_realm and snap arrays using an attacker-supplied fake end pointer, reading sizeof(*ri) and further attacker-influenced extents past the legitimate msg->front buffer into adjacent kernel memory without copying to userspace.\nI:H - Out-of-bounds kernel memory is interpreted as snap-realm metadata and copied via dup_array() into newly allocated kernel heap structures (realm->snaps, realm->prior_parent_snaps), corrupting authoritative snap state and providing a memory-corruption primitive that could be leveraged for further kernel compromise.\nA:H - Out-of-bounds reads can fault on unmapped pages causing a kernel oops; the ceph_update_snap_trace() error path issues WARN(1), fences I/O via CEPH_MOUNT_FENCE_IO, and can close all MDS sessions—effects an attacker can trigger repeatedly at will."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68160","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68202","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through ioctls on the local character device /dev/snd/seq (SNDRV_SEQ_IOCTL_CREATE_QUEUE/DELETE_QUEUE/SET_QUEUE_CLIENT); no network or adjacent-network path exists to the ALSA sequencer.\nAC:L - The attacker controls both sides of the race — one thread deletes the queue while another spins on SET_QUEUE_CLIENT holding a queueptr() reference — and can retry the loop indefinitely on a default kernel with CONFIG_SND_SEQUENCER, so the window is reliably hit.\nPR:L - Only an unprivileged local user able to open /dev/snd/seq is needed; snd_seq_queue_use() performs no owner or access check and no capability is required, as the fix commit states explicitly.\nUI:N - The attacker's own threads create, delete and re-use the queue and the global system timer fires on its own; no victim action is involved.\nS:U - The use-after-free corrupts kernel heap objects within the same kernel security authority, giving at most kernel privilege escalation rather than crossing a VM, IOMMU or sandbox boundary.\nC:H - The stale timer instance dereferences the freed snd_seq_queue and snd_seq_timer, reading tick/time fields and freed prioq pointers that can be reclaimed by attacker-sprayed objects, giving a route to disclose arbitrary kernel memory.\nI:H - snd_seq_timer_interrupt() writes cur_time, tick and last_update into the freed snd_seq_timer slab and snd_seq_check_queue() dispatches events through freed queue pointers, yielding a controllable write primitive on reclaimed heap memory suitable for privilege escalation.\nA:H - Even unexploited, the timer callback derefs freed memory and takes a spinlock in a freed object from interrupt context, causing oops, lock corruption or panic — a repeatable denial of service for any local user."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68202","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68397","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handler is registered via dev_add_pack() for ethertype ETH_P_AF_IUCV (0xFBFB) on every netdevice, so any peer LPAR/guest on the same HiperSockets internal LAN or any host on an attached Ethernet segment can drive afiucv_hs_rcv() with crafted frames; the frames are raw L2 and cannot be routed across an IP hop, so the vector is adjacent rather than network.\nAC:L - The attacker controls the packet side of the race outright (flooding 0xFBFB frames) and can drive the freeing side too, since SYN frames make a listener spawn and enqueue child sockets while FIN/SYN|FIN frames push sockets to IUCV_DISCONN and wake the application into close(), so the read_unlock()-to-handler window can be retried indefinitely until won.\nPR:N - afiucv_hs_rcv() runs from the netif RX softirq and processes any matching frame with no authentication, credential check, or capability test anywhere on the path; the attacker needs no account or privilege on the target s390 system.\nUI:N - No victim action is required: the attacker's own frames both create the AF_IUCV child sockets and trigger the state changes that lead to their teardown, and the packet handler runs unconditionally in softirq context.\nS:U - The freed struct sock and the resulting corruption stay inside the kernel of the affected LPAR or z/VM guest; no hypervisor, IOMMU, or container boundary is crossed.\nC:H - This is a use-after-free on a socket allocated from a generic kmalloc cache (iucv_proto is registered without its own slab), so an attacker who reclaims the object has the kernel read attacker-influenced or stale heap contents through sk fields, sk_filter()'s BPF program pointer, and the iucv backlog queues, yielding kernel memory disclosure.\nI:H - After the free the handlers perform indirect calls through the freed object (sk->sk_data_ready(), sk->sk_state_change(), sk_filter()) and writes into it (sk_state, atomic_sub on iucv->msg_sent, skb_queue_tail() list-pointer updates), giving control-flow hijack and write primitives once the slab object is reclaimed with attacker-controlled data.\nA:H - Dereferencing the freed socket from softirq context reliably produces an oops or \"Fatal exception in interrupt\" panic, and the attacker can repeat the frame flood at will, causing complete loss of availability of the IBM Z LPAR or guest."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68397","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68398","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The free side of the race is a local close() of the pppol2tp socket, which no remote peer can invoke; the full attack (create tunnel/session via AF_PPPOX socket, drive RX with loopback UDP datagrams, close concurrently) is performed entirely through local syscalls.\nAC:L - The attacker controls both sides of the race, feeding the UDP-encap RX softirq from one thread while closing the pppox socket on another, and can retry the loop indefinitely until the window is hit.\nPR:L - No capability check exists on this path: pppox_create()/pppol2tp_connect() and ppp_register_net_channel() need no CAP_NET_ADMIN, and PPPIOCGCHAN is handled by pppox_ioctl() on the socket itself, so /dev/ppp access is not required; the fix commit states the bug is reachable by an unprivileged user.\nUI:N - The attacker performs every step — socket creation, session setup, packet injection and close() — with no action by any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the channel is freed and its slab object reallocated, ppp_input() reads pch->bridge and pch->ppp from attacker-groomed memory and can route received frames to an arbitrary attacker-chosen structure, giving a path to disclosing kernel memory.\nI:H - skb_queue_tail(&pch->file.rq, skb) writes a linked-list insertion into the freed object and wake_up_interruptible(&pch->file.rwait) traverses a freed waitqueue, so heap grooming yields controlled writes and function-pointer traversal usable for privilege escalation.\nA:H - Dereferencing and writing to the kfree()d struct channel from softirq context reliably corrupts the slab and panics or oopses the kernel, and the race can be re-triggered at will."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68398","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68417","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access to the RDMA character devices (/dev/infiniband/uverbsN for create_qp and /dev/infiniband/rdma_cm for the QPN lookup); no network packet reaches the racing code path without a local trigger first.\nAC:L - The attacker controls both sides of the race: one thread issues create_qp while another issues rdma_connect/rdma_accept with an attacker-supplied qp_num, and QPNs from xa_alloc(XA_FLAGS_ALLOC1) are predictable. The post-publish failure can be made deterministic by passing a short udata->outlen, so the window is wide and repeatable at will.\nPR:L - Any unprivileged local user with access to the siw uverbs and rdma_cm character devices can create QPs and issue rdma_connect/rdma_accept with an arbitrary qp_num; no capability check gates siw_create_qp, siw_connect or siw_accept.\nUI:N - The attacker drives both the QP creation and the concurrent QPN lookup from its own threads; no action by any other user or administrator is needed.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU or sandbox boundary.\nC:H - The siw_qp object can be kfree'd by the ib core error path while the CM thread still holds a reference, giving a use-after-free on a slab object the attacker can groom and read back through QP/CM state, enabling disclosure of arbitrary kernel memory.\nI:H - After the free, siw_free_qp() performs list_del(&qp->devq), vfree() of four pointer fields and siw_put_tx_cpu(qp->tx_cpu) using values read from reallocated attacker-controlled memory, yielding arbitrary-pointer free, list-unlink writes and out-of-range per-CPU decrements suitable for control-flow hijacking.\nA:H - Even without exploitation the race reliably causes kernel crashes: NULL sendq/recvq/scq/rcq dereferences, list_del on an uninitialized devq head, waits on an uninitialized qp_free completion, and use-after-free oopses."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68417","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68426","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPsec transmit path (validate_xmit_xfrm) which processes any skb routed into an offloaded SA, including GRO-aggregated traffic forwarded from remote hosts on an IPsec gateway; xfrm_dev_offload_ok() has no socket/local-origin requirement, so a remote peer's packet stream drives the vulnerable GSO segmentation and async-crypto steal directly.\nAC:L - The attacker drives both preconditions with traffic alone: sustained large GSO flows keep the crypto engine backlogged so ->xmit() returns -EINPROGRESS routinely, and packet volume advances xo->seq.low toward the wrap that forces segmentation; each stolen trailing segment reproduces the stale skb->prev, and the subsequent tail->next write is deterministic once it occurs.\nPR:N - On an IPsec gateway the traffic that triggers the path is forwarded from remote, unauthenticated senders — no account, credentials, or capability on the target host is needed, since the SA and offload are pre-existing administrative configuration rather than something the attacker must set up.\nUI:N - No victim action is required; the vulnerable code runs automatically in softirq context on every qualifying transmit, driven purely by the attacker's packet stream.\nS:U - The corruption is of kernel sk_buff list state within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Writing through the stale ->prev is a use-after-free on an skb whose memory the attacker can influence via heap grooming with concurrent traffic; per kernel UAF guidance this yields a high-confidentiality primitive, and the corrupted list can splice engine-owned skbs into the transmit path, exposing freed/reused memory contents on the wire.\nI:H - tail->next = skb is an attacker-influenced pointer write into freed heap memory, and the resulting skb list corruption lets live and engine-owned skbs be chained together; this is classic heap corruption that can be shaped via spraying into an arbitrary write or control-flow hijack.\nA:H - Even without full exploitation the use-after-free write and the double-ownership of a stolen segment cause list corruption, double-free/oops and kernel panic in the softirq transmit path, taking down the gateway."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68426","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72020","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when a host running the IPVS backup sync receiver processes forged UDP sync datagrams (default multicast 224.0.0.81:8848) in ip_vs_process_message(), which is a network packet receive path rather than a local-only ioctl/netlink interface.\nAC:L - Once IPVS backup sync is enabled, an attacker can reliably send IPVS v1 messages that set IP_VS_CONN_F_IN_SEQ/OUT_SEQ while omitting IPVS_OPT_SEQ_DATA; no race, heap grooming, or victim-specific state beyond matching syncid (often 0) is required.\nPR:N - The backup sync socket accepts unauthenticated UDP input with no capability checks; only an optional syncid filter (frequently left at 0) may drop messages, so the attacker needs no Linux privileges to inject the malformed sync records.\nUI:N - No end-user or administrator interaction is required at exploit time; the attacker directly delivers crafted sync messages to the listening backup daemon without victims opening files, clicking links, or changing settings.\nS:U - Exploitation stays within the IPVS load balancer kernel/network authority and affects connections it forwards; it does not constitute a VM escape, sandbox breakout, or cross-security-authority boundary such as guest-to-host.\nC:H - Uninitialized ip_vs_seq init_seq and previous_delta fields retain stale slab data that vs_fix_seq()/vs_fix_ack_seq() apply when rewriting forwarded TCP seq/ack numbers, leaking kernel heap bytes onto the network to clients or backend servers.\nI:H - Those same uninitialized sequence-adjustment fields cause incorrect TCP sequence/ack rewriting in NAT/application-helper paths (ip_vs_app_pkt_in/out), corrupting load-balanced TCP flows and enabling attacker-driven manipulation of forwarded traffic integrity.\nA:H - Corrupted TCP sequence handling breaks or resets connections on the virtual service and can be triggered repeatedly via additional forged sync messages, causing sustained denial of service to load-balanced traffic on the affected backup node."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72020","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72069","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On CONFIG_PREEMPT_RT, every spin_unlock() is substituted by rt_spin_unlock(); network subsystems such as netfilter xt_hashlimit process inbound packets through hashlimit_mt_common(), spin_lock/unlock on RCU-protected dsthash_ent objects concurrently freed via call_rcu by GC—the exact embedded-spinlock UAF pattern from the fix.\nAC:L - The bug is a cross-CPU race where rt_spin_unlock() calls rcu_read_unlock() before releasing the rtmutex, ending the RCU grace period while still dereferencing the lock; syzbot triggered this reliably on PREEMPT_RT via concurrent unlinkat and dentry teardown, and attackers control both sides with parallel syscalls or packet/GC load.\nPR:N - Remote attackers need no account, capability, or authentication to send packets that hit deployed hashlimit rules on internet-facing PREEMPT_RT gateways; the proven syzbot unlinkat path needs only directory write permission (PR:L), but PR:N reflects the highest-severity unauthenticated network packet scenario.\nUI:N - No victim interaction is required; the attacker drives the race through their own concurrent filesystem syscalls (syzbot: unlinkat racing __fput/dentry_kill) or sustained inbound traffic overlapping netfilter GC, without needing another user to open files or mount filesystems.\nS:U - The UAF corrupts kernel slab memory containing embedded spinlock/rtmutex fields and enables privilege escalation within the same kernel security authority; it does not inherently cross VM/guest, container sandbox, or IOMMU hardware isolation boundaries.\nC:H - Syzbot reported KASAN slab-use-after-free Read in rt_mutex_slowunlock during spin_unlock on a freed dentry in shrink_dcache_tree; the systemic UAF lets attackers read freed objects (dentry, dsthash_ent, etc.) after premature RCU grace-period completion, enabling kernel pointer and memory disclosure.\nI:H - UAF on embedded rtmutex fields inside freed slab objects (dentry->d_lock per syzbot) permits heap grooming and reallocation of attacker-controlled data, providing standard kernel heap corruption primitives for arbitrary write and control-flow hijack beyond the immediate crash.\nA:H - Syzbot hit KASAN slab-use-after-free causing kernel fault in shrink_dcache_tree via rt_spin_unlock on PREEMPT_RT; the bug can oops/panic any RT kernel whenever spin_unlock races RCU-deferred free of the containing object, enabling repeatable denial of service via concurrent VFS or netfilter operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72069","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72072","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is reached by racing MACSEC_CMD_DEL_RXSC/ADD_RXSC netlink configuration (GENL_ADMIN_PERM) against mlx5e MACsec RX processing; the privileged genlink/rtnl control path is required to trigger the bug, not remote packets alone.\nAC:L - An attacker with CAP_NET_ADMIN can drive both sides by looping RX SC add/delete while flooding MACsec-offloaded RX traffic on the mlx5e netdev, reliably winning the RCU race between xa_load/dst_hold and metadata_dst_free.\nPR:L - MACsec offload mutations require GENL_ADMIN_PERM (CAP_NET_ADMIN); on Mellanox ConnectX/BlueField systems this is reachable by cloud tenants with SR-IOV VFs, containers, or user/network namespaces without init-namespace root.\nUI:N - No victim user action is needed; automated concurrent netlink MACsec operations and incoming MACsec-offloaded frames on an active mlx5e interface suffice once MACsec offload is configured.\nS:U - Impact is kernel heap use-after-free and memory corruption within the host kernel on the mlx5 NIC; it enables local privilege escalation but does not by itself cross VM, IOMMU, or hypervisor security boundaries.\nC:H - The race calls dst_hold() and skb_dst_set() on a freed metadata_dst, a classic slab UAF that can disclose kernel memory through subsequent dst_entry and MACsec skb metadata handling.\nI:H - Freed metadata_dst objects can be reallocated via heap spraying while the RX datapath still references them, enabling refcount corruption and arbitrary kernel memory writes or control-flow hijack beyond a mere crash.\nA:H - Concurrent use of freed md_dst during mlx5e MACsec RX processing can cause immediate kernel oops, BUG, or panic on datacenter/cloud hosts using mlx5 hardware MACsec offload, fully denying system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72072","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72083","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On LIO/iSCSI storage servers and appliances, a remote initiator sends PERSISTENT_RESERVE_OUT with REGISTER AND MOVE over TCP (port 3260); iscsit_process_scsi_cmd()→target_execute_cmd()→target_scsi3_emulate_pr_out()→core_scsi3_emulate_pro_register_and_move() with no local access required.\nAC:L - The attacker fully controls the PR-OUT parameter list length (>4096 to force vmap/vunmap), iSCSI TransportID format 01b with ISID, and can establish prerequisite PR registration and reservation via prior SCSI commands on the same session; no uncontrollable race or layout dependency exists.\nPR:N - Exploitation requires only the ability to act as a network SCSI/iSCSI client with LUN access to an exported target; no Linux UID, capability, or init-namespace root on the storage server is needed—only standard iSCSI initiator connectivity (CHAP/ACL when configured).\nUI:N - Triggering is fully automated once an iSCSI session exists: the attacker issues scripted REGISTER, RESERVE, then REGISTER AND MOVE commands with a crafted >4 KiB parameter list; no victim mount, click, or other interactive action is required.\nS:U - The UAF corrupts kernel heap state inside the target-core PR handler on the storage host; impact stays within that kernel security domain and does not inherently cross VM, container, or IOMMU boundaries (standard host compromise, not escape).\nC:H - After vunmap(), iport_ptr aliases freed kernel virtual address space and is dereferenced in strcmp(), __core_scsi3_locate_pr_reg(), and snprintf() into pr_reg_isid; per kernel CVSS guidance, UAF reads enable arbitrary kernel memory disclosure when uncertain.\nI:H - UAF reads of attacker-influenced unmapped PR-OUT data drive strcmp-based registration matching and snprintf copies into persistent kernel pr_reg structures; memory corruption/UAF is scored High for integrity because it can be leveraged for control-flow or state manipulation.\nA:H - Dereferencing iport_ptr after transport_kunmap_data_sg() vunmap() on multi-page buffers causes immediate invalid kernel virtual address accesses (oops/panic) on every qualifying REGISTER AND MOVE; UAF availability impact is High per kernel guidance even before full exploit development."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72083","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72084","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered by a PERSISTENT RESERVE OUT SCSI command delivered over the LIO iSCSI target fabric (TCP/3260); remote initiators reach `iscsi_parse_pr_out_transport_id()` after login and normal SCSI command processing, and the fix commit notes the same path via vhost-scsi-backed exports.\nAC:L - An attacker fully controls the PR-OUT parameter list and can reliably supply a FORMAT CODE 01b iSCSI TransportID without a \",i,0x\" separator or NUL terminator and size it past one page so `strstr()` over-reads into the vmalloc guard page; no races or victim-specific memory layout are required.\nPR:N - Exploitation requires only completing iSCSI login to an exported LUN as any initiator client, not host administrator privileges; LIO demo mode auto-provisions initiator ACLs and many storage appliances expose iSCSI targets to the network without mapping this to elevated OS credentials.\nUI:N - No end-user or administrator action beyond normal automated iSCSI target operation is needed; a remote initiator can send the malicious PR OUT command directly once a session to the LUN exists.\nS:U - The flaw corrupts or reads kernel memory and crashes the target host kernel within the same kernel security boundary; it does not by itself cross a VM, container, or IOMMU isolation boundary to another authority.\nC:H - Unbounded `strstr()` and an unbounded `%s` on the error path perform out-of-bounds reads past the received PR-OUT buffer, potentially disclosing adjacent kernel memory before the fault, matching CVSS guidance for out-of-bounds reads beyond a few bytes.\nI:H - A malformed TransportID can leave the ISID pointer one byte past the descriptor so subsequent registration code dereferences out of bounds, and the ISID normalization loop can write with `tolower()` beyond the buffer, giving a memory-corruption primitive in kernel context.\nA:H - The over-read into a multi-page vmalloc mapping hits the guard page and triggers a KASAN vmalloc-out-of-bounds fault and kernel oops, remotely denying service to the host and all consumers of the iSCSI target."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72123","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local BCM socket syscalls (sendmsg with RX_SETUP/SETTIMER/ival2 throttling and RX_DELETE); CAN frames can be injected locally via loopback without physical bus access.\nAC:L - The attacker controls both sides of the race by concurrently issuing RX_DELETE teardown and delivering matching CAN frames (e.g., via threads or paired BCM/RAW sockets), making the thrtimer re-arm UAF reliably triggerable.\nPR:L - No kernel capability check gates AF_CAN/CAN_BCM socket creation or bcm_sendmsg opcodes; any unprivileged local user with socket access (including via user namespaces with vcan) can reach the vulnerable path.\nUI:N - No victim interaction is required; the attacker self-triggers the race through their own BCM socket operations and locally injected CAN traffic.\nS:U - Impact is confined to kernel memory corruption and local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM or IOMMU bypass.\nC:H - The thrtimer UAF dereferences freed bcm_op fields (locks, frame buffers, op->sk) in bcm_rx_thr_handler/bcm_send_to_user, enabling attacker-controlled heap reuse and arbitrary kernel memory disclosure.\nI:H - UAF on the bcm_op slab object allows heap spraying to corrupt function pointers, timers, and sock structures, providing a standard path to arbitrary kernel writes and local privilege escalation.\nA:H - The freed-op dereference in the hrtimer softirq path causes kernel oops/panic under normal exploitation attempts, and successful memory corruption can crash or hang the system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72123","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72135","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local pread()/write() syscalls on /dev/tpm0 or /dev/tpmrm0 character devices; there is no network, Bluetooth, or physical-bus code path to the vulnerable tpm_common_read() handler.\nAC:L - An attacker who can open the device reliably triggers the bug by writing any TPM command to create a pending response, then calling pread() with a large offset; no races or special memory layout are required.\nPR:L - Upstream tpm2-tss udev rules grant non-root users in the tss group read/write access to /dev/tpmrm0 (mode 0660), which is the standard TPM2 user-space interface on laptops and servers with TPM hardware.\nUI:N - No victim interaction is required; the attacker opens the TPM device, submits a command, and issues the malicious pread() themselves without relying on another user to mount, click, or configure anything.\nS:U - The vulnerability corrupts kernel heap memory in the TPM driver on the same host; it does not by itself cross a VM, container, or IOMMU security boundary to affect a different trust domain.\nC:H - Unchecked pread offsets cause copy_to_user() to read beyond the 4096-byte data_buffer into adjacent kmalloc slab memory (including tpm_space pointers), leaking kernel heap contents to userspace.\nI:H - A successful out-of-bounds pread also executes memset() past data_buffer, zeroing adjacent heap objects such as tpm_space session/context pointers and enabling further memory corruption or control-flow manipulation.\nA:H - KASAN reports slab-out-of-bounds faults on both the copy_to_user read and memset write; corrupting adjacent heap structures can oops or panic the kernel during subsequent TPM operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72135","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72221","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Reachable over TCP by any remote peer of an in-kernel NFS/RPC server (nfsd) via the pre-auth RPC_AUTH_TLS NULL-procedure STARTTLS path that invokes svc_tcp_handshake() on the accepted SUNRPC transport.\nAC:L - The attacker controls both sides of the race by timing TLS client handshake messages against the fixed 5-second SVC_HANDSHAKE_TO and opening many parallel connections to reliably hit the cancel-lost window.\nPR:N - No credentials or export authorization are required; svcauth_tls_accept() accepts empty AUTH_TLS on RPC NULL from any TCP client, and svcauth_unix_set_client() skips IP export checks when rq_proc==0.\nUI:N - Exploitation requires only scripted network connections and TLS client traffic to nfsd; no victim user interaction such as mounting a filesystem or opening a file is needed.\nS:U - Memory corruption occurs in nfsd kernel worker context on the same host; impact is kernel privilege compromise within the server security authority, not a VM escape or IOMMU boundary bypass.\nC:H - A second svc_tcp_handshake() can call init_completion() while svc_tcp_handshake_done() concurrently calls complete_all(), corrupting the embedded swait_queue in heap-allocated svc_sock and enabling arbitrary kernel memory disclosure.\nI:H - Corrupting completion wait-queue metadata in the svc_sock heap object can be leveraged for arbitrary kernel writes and control-flow hijacking to achieve local privilege escalation on the NFS server.\nA:H - The swait_queue corruption can trigger kernel oops/panic, and the alternate race path tears down connections whose TLS handshake is about to succeed, enabling repeatable remote denial-of-service against nfsd."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72221","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72222","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in nfsd's server-side SUNRPC/TCP TLS handshake (net/sunrpc/svcsock.c), reached when a remote peer connects to port 2049 and sends a pre-authentication AUTH_TLS NULL STARTTLS probe that triggers svc_tcp_handshake() via svcauth_tls_accept().\nAC:L - The attacker controls both sides of the race by initiating AUTH_TLS handshakes and concurrently resetting/closing TCP or waiting for SVC_HANDSHAKE_TO while tlshd delivers completion; repeated parallel connections make the overlap window reliably reachable.\nPR:N - AUTH_TLS is processed on RPC procedure 0 before credentials are verified, so an unauthenticated remote client can reach svc_tcp_handshake() and the asynchronous callback without any account, export access, or kernel capability.\nUI:N - nfsd worker threads automatically accept the TCP connection, process the STARTTLS probe, run the TLS handshake, and handle teardown/completion callbacks without any local user or administrator action.\nS:U - Exploitation corrupts kernel memory on the NFS server host itself and does not cross a VM-guest/host, sandbox, or IOMMU security boundary; impact stays within the kernel's security authority.\nC:H - svc_tcp_handshake_done() use-after-frees svc_sock and performs set_bit/clear_bit RMW on freed xpt_flags plus complete_all() on freed sk_handshake_done, a slab-corruption UAF that can disclose arbitrary kernel memory.\nI:H - The same UAF delivers attacker-timed writes into reclaimed slab slots through atomic bit operations and wait-queue list updates, enabling heap grooming and further kernel memory corruption for arbitrary modification or code execution.\nA:H - Slab corruption and UAF during handshake completion can cause kernel oops/panic, and unauthenticated remote peers can trigger the fault repeatedly by overlapping TLS handshake completion with connection close."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72222","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72251","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit in nf_nat_sip() from sip_help_udp/tcp() during nf_confirm() on POST_ROUTING/LOCAL_IN while processing attacker-supplied SIP/UDP or SIP/TCP packets traversing a netfilter NAT gateway, so exploitation is via remote network traffic rather than local syscalls or physical access.\nAC:L - Once nf_conntrack_sip and nf_nat_sip are active on a NATed SIP flow, a remote peer can set forced_dport with a crafted Via header and drive the reply-path skb_ensure_writable() reallocation on cloned skbs without races or rare layout luck.\nPR:N - Exploitation needs no privileges on the victim kernel; a remote SIP endpoint only has to send malicious SIP through an already-configured SIP conntrack/NAT helper, with no authentication or local access to the firewall or router.\nUI:N - No victim user action is required beyond normal automated packet forwarding; the SIP helper parses and NAT-rewrites attacker-supplied SIP data in softirq during connection-tracking confirmation without opening files, clicking links, or mounting filesystems.\nS:U - Impact stays within kernel netfilter/conntrack memory on the same security authority (for example a NAT firewall, SBC, or VoIP gateway). This is standard kernel memory corruption, not a VM escape, sandbox breakout, or cross-tenant boundary violation.\nC:H - skb_ensure_writable() can free the old linear buffer while *dptr still points into it; sip_help_tcp() then continues parsing with that stale pointer, giving a use-after-free read of freed skb data and enabling disclosure of adjacent kernel heap contents.\nI:H - The stale dptr UAF and, on TCP flows, mistaken nf_nat_mangle_udp_packet() header rewriting corrupt kernel packet-buffer memory; such heap corruption is exploitable with grooming for arbitrary writes, control-flow hijacking, and kernel code execution.\nA:H - Use-after-free and mis-mangled L4 headers during softirq SIP NAT processing can trigger kernel oops/panic or reliably drop or corrupt in-flight VoIP signaling, causing high availability impact on internet-facing NAT/SBC systems handling SIP."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72251","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72262","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl on /dev/snd/controlC* (SNDRV_CTL_IOCTL_TLV_WRITE/READ) through the ALSA control device; there is no network, adjacent-radio, or physical-bus attack surface for this SOF IPC3 kcontrol path.\nAC:L - On affected SOF IPC3 systems with topology bytes_ext controls, an attacker can deterministically trigger the bug by issuing TLV writes with header.length equal to max_size, causing copy_from_user/memcpy to overrun the kzalloc(max_size) buffer by sizeof(struct sof_ipc_ctrl_data).\nPR:L - The fix commit states the overflow is reachable from unprivileged userspace via ALSA TLV kcontrols; any local user who can open the sound control device (typically membership in the audio group on Linux, or an app with audio access on Android/ChromeOS) can reach the vulnerable code without real root.\nUI:N - Exploitation is performed entirely by the attacker issuing ALSA TLV ioctls against an existing bytes_ext kcontrol; no victim click, mount, or other interactive action beyond the attacker's own access to the sound control interface is required.\nS:U - The vulnerability corrupts kernel heap memory from a local userspace context and enables standard kernel privilege escalation or denial of service; it does not cross a VM, container, or IOMMU security boundary into a separate authority.\nC:H - The get path can copy_to_user up to sizeof(struct sof_ipc_ctrl_data) bytes beyond the allocated ipc_control_data buffer, leaking adjacent kernel heap contents; combined with the controllable overflow, this is an out-of-bounds read/memory corruption primitive consistent with arbitrary disclosure potential.\nI:H - The put path performs an out-of-bounds heap write of up to sizeof(struct sof_ipc_ctrl_data) bytes past the kzalloc(max_size) allocation (including via the err_restore memcpy), enabling heap metadata/object corruption that can be developed into arbitrary kernel write or code execution.\nA:H - Heap out-of-bounds writes of roughly 96 bytes into adjacent slab objects can corrupt kernel structures and trigger oops/panic or wedged audio/subsystem state; repeated TLV operations make denial of service reliably achievable even without full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72262","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72288","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached only from KVM guest MMIO traps on GICv3 redistributor GICR_CTLR LPI-disable writes, ITS MOVI affinity changes, and vCPU-exit paths into vgic_prune_ap_list(); no network-facing host protocol is involved.\nAC:L - A guest controls all three racing vCPUs by pinning threads to concurrently issue ITS MOVI, cross-vCPU GICR_CTLR LPI-disable writes, and vCPU exits that invoke vgic_prune_ap_list(); the attacker creates and wins the race rather than depending on uncontrollable host timing.\nPR:N - No host privileges are required beyond running code in an assigned KVM guest (e.g. a cloud VM tenant on arm64); exploitation needs guest-kernel access to GIC/ITS MMIO, not host root or capabilities in the init namespace.\nUI:N - Exploitation is fully attacker-driven from within a multi-vCPU guest VM and does not require any victim user or administrator action on the host.\nS:C - The use-after-free corrupts host-kernel heap memory (struct vgic_irq) from guest-controlled VGIC operations, crossing the guest-to-host virtualization security boundary with VM-escape impact.\nC:H - vgic_flush_pending_lpis() can free the LPI vgic_irq while vgic_prune_ap_list() still dereferences it after reacquiring dropped locks, yielding a kernel heap use-after-free exploitable for arbitrary host memory disclosure via heap grooming.\nI:H - The dangling vgic_irq pointer permits attacker-influenced writes through irq_lock, list_head, vcpu, and target_vcpu fields during ap_list migration, enabling host control-flow or data corruption primitives.\nA:H - The race frees live kernel objects still referenced by the ap_list migration path, causing host kernel oops, panic, or hang during list_del, lock operations, or subsequent LPI delivery on arm64 KVM hosts."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72288","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72289","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only from KVM guest execution paths—GICv3 redistributor GICR_CTLR LPI-disable MMIO traps into vgic_flush_pending_lpis() and vCPU exit/sync paths into vgic_prune_ap_list()—not from any remote network, adjacent-radio, or physical-device interface on the host.\nAC:L - A malicious multi-vCPU guest controls both racing sides by pinning threads, changing LPI affinity via ITS so an interrupt must migrate off one vCPU's ap_list, and concurrently disabling LPIS on that redistributor; the attacker creates the window rather than depending on uncontrollable host timing or memory layout.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant on arm64 KVM who needs no host privileges beyond code already running inside the assigned guest; exploitation uses guest-kernel GIC MMIO/ITS operations, not host root, CAP_SYS_ADMIN in the init namespace, or additional /dev/kvm access beyond having a VM.\nUI:N - Exploitation is fully attacker-driven from within the guest VM through deliberate LPI setup, affinity changes, and timed GICR_CTLR writes; no victim user or administrator action on the host is required beyond normal VM operation.\nS:C - Double list_del()/list_add_tail() on host-kernel ap_list linkages corrupts KVM VGIC state from guest-controlled interrupt operations, crossing the guest-to-host virtualization security boundary with VM-escape-class impact rather than confining damage to the attacker's VM.\nC:H - Corrupting detached ap_list pointers and inserting them into another vCPU's ap_list_head enables out-of-bounds kernel linked-list traversal and disclosure of adjacent kmalloc slab memory (struct vgic_irq and neighboring objects); per kernel guidance, this list corruption is leverageable for arbitrary host memory read primitives.\nI:H - The vulnerable path performs list_del() on an already removed entry and may follow with list_add_tail() onto another vCPU's ap_list, letting a guest steer kernel list pointers and overwrite adjacent vgic_irq/host heap metadata for control-flow or data corruption on the hypervisor.\nA:H - Re-running list_del() on an entry already removed by vgic_flush_pending_lpis() dereferences poisoned list pointers and corrupts live ap_list_heads, causing immediate host kernel BUG/oops/panic or persistent interrupt-delivery failure during subsequent VGIC processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72289","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72317","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in the SUNRPC TCP-with-TLS client connect_worker processing a remote NFS server's TLS handshake; a malicious or misconfigured server can induce fatal handshake failure over the network before the delayed worker runs, matching network-reachable kTLS/RPC-with-TLS client paths.\nAC:L - An attacker operating a reachable NFS endpoint can reliably cause fatal TLS handshake failure (e.g., reject mTLS client certificates or send TLS alerts) and influence reconnect timing/backoff so client teardown frees rpc_clnt before the queued connect_worker executes.\nPR:N - Exploitation requires no privileges on the victim host; a remote peer only needs the client kernel to initiate or re-establish an NFS RPC-with-TLS connection, and TLS handshake processing occurs before NFS authentication completes.\nUI:N - No further victim action is needed once an NFS xprtsec=tls/mtls mount exists because automatic reconnect after server-induced disconnect or handshake failure can trigger the race without additional user interaction.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is standard local kernel compromise rather than crossing VM, container, or IOMMU security scopes.\nC:H - This is a kernel heap use-after-free where xs_tcp_tls_setup_socket reads multiple fields from a freed rpc_clnt (including cl_cred and cl_program), enabling information disclosure and further exploitation beyond a simple crash.\nI:H - Use-after-free of rpc_clnt permits corrupting allocator metadata and adjacent kernel objects; freed-object reuse can yield arbitrary write or control-flow hijack primitives, not merely authenticated data alteration.\nA:H - Accessing the freed rpc_clnt produces a refcount_t underflow and kernel oops/panic; even unsuccessful exploitation typically crashes or hangs the system, and repeated reconnect attempts can deny availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72317","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72339","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the qede NIC RX fastpath reached when remote Ethernet frames are received, hardware posts completion queue entries, and NAPI runs qede_poll() -> qede_rx_int() -> qede_rx_process_cqe()/qede_tpa_start() into qede_rx_build_skb() or qede_tpa_rx_build_skb().\nAC:L - An attacker can reliably trigger build_skb() NULL returns by flooding the interface with frames larger than rx_copybreak (256 bytes) to exhaust GFP_ATOMIC skb slab allocations, then the off-by-one BD consumption desynchronizes the ring without races or victim-specific state.\nPR:N - No local account, capability, or authentication is required; any unauthenticated remote host that can send IP/Ethernet traffic to a server using a Marvell/QLogic FastLinQ qede NIC can hit the vulnerable RX/TPA handlers.\nUI:N - Exploitation requires no victim interaction beyond normal network operation; packet reception, MSI-X interrupt handling, and NAPI polling process attacker-supplied frames automatically in kernel context.\nS:U - The flaw corrupts kernel heap metadata (DMA page refcounts and SLUB freelists) within the host kernel security boundary; it does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - BD ring desynchronization corrupts DMA page reference counts and can corrupt SLUB freelists; this class of kernel heap corruption is exploitable for arbitrary kernel memory reads and information disclosure beyond a simple crash.\nI:H - SLUB freelist corruption from mismatched BD ring consumption enables arbitrary kernel memory writes and control-flow hijacking primitives, supporting local privilege escalation or arbitrary code execution in kernel context.\nA:H - Reference-count and SLUB corruption from the desynchronized BD ring can cause kernel BUG/oops/panic or a wedged RX datapath, resulting in complete loss of host availability on affected systems."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72339","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72389","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation is via local RTNETLINK/ioctl to create a down bridge, enable kernel STP, enslave ports, and delete the bridge; remote STP BPDU handling is blocked when IFF_UP is clear, so the arming path that leaves timers active on a down bridge is local.\nAC:L - The public PoC uses a reliable, attacker-controlled netlink sequence (down bridge + kernel STP + port state progression + dellink) without winning races; per-port forward-delay timers deterministically reach br_topology_change_detection and arm topology_change_timer before deletion.\nPR:L - All reachable paths (RTM_NEWLINK/DELLINK, IFLA_BR_STP_STATE, enslaving ports) require CAP_NET_ADMIN, which unprivileged users can obtain in user/network namespaces (unshare -Urn, Kubernetes NET_ADMIN, LXC/libvirt network namespaces).\nUI:N - Triggering requires only programmatic bridge configuration by the attacker; no victim must click, mount, or open anything beyond the attacker's own netlink operations.\nS:U - Impact is kernel memory corruption and privilege escalation within the same kernel/host security domain; it does not cross a VM, container-to-host, or IOMMU boundary by itself.\nC:H - Use-after-free of the net_device/net_bridge kmalloc object lets an attacker reclaim freed slab memory and obtain arbitrary kernel read/disclosure primitives from corrupted timer and bridge structures.\nI:H - Disclosed analysis and PoC show the dangling timer callback can hijack control flow by reclaiming the freed object with attacker-controlled data, replacing the timer function pointer for arbitrary kernel code execution.\nA:H - Deleting the bridge with active STP timers queued causes the per-CPU timer wheel to invoke callbacks on freed memory, producing kernel BUG/oops/panics and denial of service even if full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72389","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74345","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit while processing attacker-supplied MPA/TCP data on an inbound SIW listener socket during connection establishment, which is a standard network protocol path analogous to other in-kernel TCP service handlers.\nAC:L - An attacker fully controls the TCP connection and malformed MPA request bytes that deterministically fail parsing and drive the endpoint teardown path where the refcount bug frees the cep before it is accessed again.\nPR:N - Exploitation requires only the ability to open a TCP connection to a host running an SIW RDMA listener; the MPA handshake is unauthenticated and occurs before any RDMA credentials or local privileges are established.\nUI:N - No end-user action is required at exploit time; the kernel processes the malicious inbound connection automatically once an administrator has started an RDMA listener service.\nS:U - Impact is confined to kernel memory corruption and potential host privilege escalation within the same kernel security authority, not a VM escape or cross-authority boundary such as guest-to-hypervisor.\nC:H - The vulnerability is a slab use-after-free on a freed siw_cep object; UAF on attacker-influenced connection teardown enables heap grooming and arbitrary kernel memory read primitives beyond a simple crash.\nI:H - Use-after-free of the connection endpoint structure in kernel heap can be leveraged for controlled writes and code execution via object reuse and function pointer/callback corruption, not merely data integrity of a single field.\nA:H - The bug was reproduced as a KASAN slab-use-after-free in siw_cm_work_handler during malformed MPA processing, which can cause kernel oops/panic and denial of service on the target host."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74345","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74377","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires mutating mmap'd receive WQEs through /dev/infiniband/uverbs; inbound RoCE packets (rxe_udp_encap_recv→rxe_rcv→rxe_receiver) only trigger processing and cannot alter WQE fields without local control of the userspace-mapped receive queue.\nAC:L - The attacker controls both sides of the TOCTOU—userspace threads racing num_sge/sge edits while posting recv WRs and driving inbound RoCE SEND/WRITE traffic—so out-of-bounds reads in rxe_resp_check_length() and copy_data() are reliably triggerable with retries.\nPR:L - uverbs_devnode() publishes /dev/infiniband/uverbsN as mode 0666, letting any local account create userspace QPs and mmap receive queues; rxe link setup needs CAP_NET_ADMIN obtainable in a user+network namespace via unshare -Urn, matching PR:L kernel guidance.\nUI:N - Exploitation is entirely self-driven from the attacker's own RDMA verbs client and concurrent userspace threads; no victim user action, mount, or file open is required.\nS:U - Impact is kernel memory corruption and local privilege escalation within the host kernel security authority, not a VM guest-to-host escape, IOMMU/DMA boundary bypass, or other cross-scope compromise.\nC:H - Inflating num_sge or rewriting sge entries during processing causes out-of-bounds reads in rxe_resp_check_length() and copy_data() beyond the allocated WQE slot, potentially into adjacent vmalloc/kernel memory, enabling arbitrary kernel information disclosure.\nI:H - copy_data() walks attacker-forged out-of-bounds sge entries and performs rxe_mr_copy writes of incoming RDMA payload into MR-backed memory; combined with queue overruns this yields controlled memory corruption exploitable for arbitrary write and code execution.\nA:H - Processing a WQE with an attacker-inflated num_sge causes the kernel to walk far past valid sge slots, dereferencing invalid pointers and corrupting memory, reliably producing kernel oops/panic and total loss of availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74377","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74378","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local process with mmap write access to the SRQ receive queue shared with the kernel; although incoming RoCE/UDP packets trigger get_srq_wqe(), a remote peer cannot modify num_sge in the victim's userspace-mapped WQE buffer, so the TOCTOU overflow cannot be achieved from the network alone.\nAC:L - The attacker controls both sides of the race: a userspace thread that repeatedly rewrites num_sge in the mmap'd SRQ entry and the thread/process that posts recv WQEs and receives the triggering RoCE Send/Write packet, making the TOCTOU window reliably winnable without external timing luck.\nPR:L - An unprivileged local user with access to /dev/infiniband/uverbs can create an SRQ (mmap'd queue), associate a QP, and post recv buffers via ibverbs; rxe device setup via \"rdma link add type rxe\" is reachable with CAP_NET_ADMIN inside a user namespace (unshare -Urn).\nUI:N - No victim user interaction is required; the attacker operates their own malicious RDMA userspace process and can self-trigger the vulnerable responder path with RoCE request packets once SRQ/QP resources are configured.\nS:U - The heap overflow corrupts kernel memory within the rxe_qp responder context on the same host kernel, enabling local privilege escalation rather than crossing a VM, container, or IOMMU security boundary to impact a different authority.\nC:H - The attacker-controlled memcpy size causes an out-of-bounds copy from the mmap'd SRQ ring buffer and overflows the fixed qp->resp.srq_wqe kernel buffer, enabling adjacent kernel heap data disclosure and providing primitives that can be developed into arbitrary kernel memory reads.\nI:H - Overflowing qp->resp.srq_wqe corrupts subsequent fields in rxe_resp_info/rxe_qp (e.g., responder resource pointers and state), giving a kernel heap buffer overflow that can be leveraged for arbitrary kernel memory writes and local privilege escalation.\nA:H - Corrupting responder state inside rxe_qp can cause kernel oops/panic or wedged RDMA processing during packet handling; even failed exploitation attempts can crash the kernel through use of corrupted function pointers and queue state."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74378","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74390","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl on /dev/infiniband/uverbs to register CQ/QP/SRQ memory via irdma_reg_user_mr; the bug is not reachable from remote iWARP/RoCE packet handling.\nAC:L - An attacker fully controls reg_type, cq_pages/sq_pages/rq_pages, and umem size; triggering lvl==0 with many DMA blocks is deterministic and needs no races or special memory layout.\nPR:L - Any unprivileged local user who can open the uverbs device (mode 0666) and use the RDMA NIC—typical on cloud/HPC RDMA nodes—can invoke the vulnerable MR registration path without real root.\nUI:N - No victim interaction is required; the attacker triggers the overflow directly through their own RDMA verbs memory registration calls.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel security boundary, not a cross-VM or cross-IOMMU sandbox escape.\nC:H - The out-of-bounds write of attacker-influenced DMA addresses into adjacent irdma_mr/iwpbl heap metadata can be leveraged for arbitrary kernel memory read primitives, not merely a bounded leak.\nI:H - Controlled out-of-bounds u64 writes past pgaddrmem[4] corrupt adjacent kernel heap structures and are suitable for control-flow or arbitrary kernel write exploitation.\nA:H - Heap corruption in a kzalloc'd irdma_mr can cause immediate kernel oops/panic during registration or on subsequent use of corrupted queue memory metadata."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74390","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74394","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - SRPT is an in-kernel SCSI RDMA target reached by remote initiators over InfiniBand/RoCE via RDMA/IB CM; malicious SRP_CMD IUs are delivered through `srpt_recv_done()` without any local syscall or physical access.\nAC:L - Once connected on an immediate-data SRPT target (use_srq=0), a malicious initiator deterministically sets `imm_buf->len=0xFFFFFFFF` to wrap `req_size` and bypass checks; no race or attacker-uncontrollable condition is required.\nPR:N - SRPT enables LIO demo mode (`srpt_check_true`), so any remote initiator that completes SRP login on an enabled target gets a dynamic ACL without target-local credentials, root, or CAP_NET_ADMIN on the victim host.\nUI:N - Exploitation requires only attacker-initiated RDMA connection, SRP login, and crafted SRP_CMD traffic; no administrator or other user must mount storage or perform any action on the target.\nS:U - The integer overflow corrupts kernel heap memory and SCSI-target processing within the host kernel's own security authority; it does not cross VM, IOMMU, or container sandbox boundaries.\nC:H - Passing a ~4GB length to `sg_init_one()` on a small receive buffer creates a massive out-of-bounds scatterlist; subsequent target-core DMA/map operations can read far beyond the buffer, enabling arbitrary kernel memory disclosure.\nI:H - The bogus scatterlist gives the block/SCSI target path an attacker-controlled ~4GB kernel memory write/read primitive over adjacent heap objects, exploitable for control-flow hijacking and privilege escalation.\nA:H - Out-of-bounds access from a ~4GB scatterlist on a kilobyte-scale receive buffer readily triggers kernel oops, KASAN faults, or panic, denying availability even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74394","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74488","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when the mwifiex driver processes attacker-supplied A-MSDU TDLS frames received over WiFi from a nearby peer, AP, or injector on the same wireless segment, which is an adjacent RF attack vector rather than remote Internet or local syscall access.\nAC:L - Once TDLS-capable mwifiex firmware receives an A-MSDU, the attacker fully controls subframe sizes and TDLS content to trigger either the skb use-after-free or the overstated-length out-of-bounds parse reliably without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation requires only the ability to deliver crafted 802.11 data frames to the victim radio; it does not require any local account, capability, or root access on the Linux host and is not gated by user-namespace privilege boundaries.\nUI:N - No victim user action beyond normal wireless operation is required; the driver parses malicious TDLS subframes automatically during receive and A-MSDU decomposition before forwarding traffic to the network stack.\nS:U - Impact is confined to kernel memory corruption and driver state within the host kernel security authority; it does not by itself cross a VM, container, or IOMMU boundary to affect a separate security domain.\nC:H - The skb use-after-free reads freed sk_buff metadata and the inflated length drives an out-of-bounds IE walk that reads kernel memory beyond the subframe, including attacker-positioned bytes from subsequent A-MSDU subframes, enabling substantial information disclosure.\nI:H - The same out-of-bounds parse copies attacker-controlled IE data from beyond the subframe into heap-allocated sta_node/tdls_cap structures via memcpy, providing a memory-corruption primitive that can be developed into arbitrary kernel write or code execution.\nA:H - Reading skb->len after the parent A-MSDU skb may already be freed can immediately fault or corrupt memory, and the out-of-bounds TDLS element parsing can provoke kernel oopses or panics even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74488","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74496","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is opened only via local FOU_CMD_ADD genetlink into fou_create(); remote UDP can race the dangling sk_user_data read in fou_udp_recv/gue_udp_recv but cannot alone reach the erroneous teardown path.\nAC:L - An attacker with CAP_NET_ADMIN controls both sides: issue a second FOU_CMD_ADD with port 0 to force -EALREADY on fou_add_to_port_list while concurrently sending UDP/GRO traffic to the just-bound ephemeral socket during the kfree window.\nPR:L - FOU_CMD_ADD is gated by GENL_ADMIN_PERM (CAP_NET_ADMIN); the fou genl family is netnsok, so a user with CAP_NET_ADMIN inside unshare -Urn can configure FOU and trigger the failing add path without init-namespace root.\nUI:N - Exploitation is fully programmatic via concurrent netlink FOU_CMD_ADD requests and attacker-controlled UDP packets; no victim mount, file open, or other interactive action is required.\nS:U - Impact is kernel heap corruption and privilege escalation within the same security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Concurrent readers call fou_from_sock() and dereference freed struct fou fields (family, protocol, flags); reclaimed slab contents give attacker-controlled reads and kernel pointer disclosure primitives typical of UAF.\nI:H - Freed struct fou is attacker-reclaimable kmalloc memory; fou_gro_receive indexes inet_offloads[fou->protocol] from the dangling pointer, enabling heap grooming for arbitrary writes and control-flow hijack.\nA:H - Use-after-free in UDP receive/GRO softirq reliably causes KASAN violations and, on production kernels, invalid pointer dereferences or panics when accessing the freed fou object during packet processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74496","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74516","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires triggering KVM nested SVM/AVIC paths via local /dev/kvm ioctls (KVM_CREATE_VM, KVM_CREATE_VCPU, KVM_RUN) from L1; there is no network, adjacent, or physical packet/device path to the vulnerable code.\nAC:L - An L1 attacker fully controls nested VM configuration (x2APIC, AVIC, L2 MSR bitmap, IRQ-window/ExtINT conditions) and can reliably reproduce AVIC inhibition while L2 is active without races or uncontrollable host state.\nPR:H - Reaching the bug requires running nested AMD KVM as L1 (nested virtualization enabled and control of a guest hypervisor), which is not available to an unprivileged host user or via user-namespace capabilities alone without delegated /dev/kvm access.\nUI:N - No victim interaction is required; exploitation is driven entirely by the attacker’s nested hypervisor configuration and KVM_RUN operations once nested virtualization is available.\nS:C - The flaw lets an L1 nested guest hypervisor access the host’s physical x2APIC MSRs, crossing the VM/host security boundary rather than staying within the guest’s own security scope.\nC:H - With x2APIC MSR intercepts left disabled, L1 can read most of the host APIC state (IDs, IRR/ISR, timers, ICR), leaking sensitive host interrupt-controller information beyond the guest boundary.\nI:H - L1 can write host x2APIC MSRs to send arbitrary IPIs, change task priority, and invoke host interrupt vectors (e.g. posted-interrupt wakeup), enabling host integrity compromise beyond mere guest-local effects.\nA:H - Host availability is trivially impacted by injecting spurious or high-priority interrupts to host CPUs; the fix commit demonstrates host kernel warnings and spurious interrupt storms causing denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74516","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74518","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local hugetlb reservation paths (mmap/memfd_create/fault syscalls into region_chg/region_add/region_del); no network protocol or remote packet handler invokes allocate_file_region_entries().\nAC:L - Exploitation needs a race while resv->lock is dropped during GFP_KERNEL allocation, but an attacker can spawn concurrent MAP_SHARED mappers/faulters on one hugetlb inode and controls both sides of that race.\nPR:L - Unprivileged local users can trigger this via memfd_create(MFD_HUGETLB) plus MAP_SHARED mmap/fault activity, or by mapping accessible shared hugetlbfs files, without init-namespace root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the needed concurrent syscalls and shared hugetlb mappings themselves to hit the corrupted list splice retry path.\nS:U - Impact is kernel hugetlb resv_map list/memory corruption on the host; it does not by itself cross a VM, IOMMU, or separate security-authority boundary even though KVM/DPDK hosts are a prime deployment.\nC:H - Without CONFIG_DEBUG_LIST, stale list_splice leaves a kernel-stack pointer in resv->region_cache, producing later use-after-free that can be turned into arbitrary kernel memory read/disclosure primitives.\nI:H - Corrupted region_cache pointers let subsequent region_add/region_del/cache operations write through attacker-influenced list links, enabling heap metadata corruption and potential arbitrary kernel write or code execution.\nA:H - Real host panics were reported on dense KVM hugetlb workloads; DEBUG_LIST kernels BUG on list_add corruption, and default builds can crash from UAF while walking the poisoned region_cache."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74518","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74537","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the Bluetooth ISO stack; iso_conn_ready runs from HCI connection-confirmation events (CIS/BIS/PA sync) driven by LE isochronous traffic from Bluetooth peers within radio range, which is an adjacent attack surface (phones, earbuds, automotive, embedded).\nAC:L - This is a use-after-free race between iso_conn_ready and iso_sock_release/iso_sock_kill; an attacker who controls both an ISO socket close and concurrent HCI completion (e.g., dual-thread connect/close or rapid adjacent CIS/BIS establish-teardown) can reliably trigger it without uncontrollable conditions.\nPR:N - Exploitation requires no elevated credentials on the victim: HCI events are processed for any Bluetooth-enabled device in range, and the racing socket close can occur from automatic stack/daemon teardown during connection setup without the victim performing privileged local actions.\nUI:N - No victim interaction is required when the OS Bluetooth stack (e.g., LE Audio on Android phones or bluetoothd on Linux) automatically manages ISO sockets during pairing, reconnection, or broadcast sync while processing peer-initiated CIS/BIS traffic.\nS:U - The UAF corrupts kernel socket memory and can enable local privilege escalation within the kernel; it does not cross a VM, container, or IOMMU security boundary, so scope remains unchanged.\nC:H - Use-after-free on struct sock after iso_sock_kill frees the socket lets an attacker dereference attacker-influenced freed heap memory, enabling arbitrary kernel memory disclosure via heap grooming and reuse of the sock object.\nI:H - The UAF touches sk->sk_state and sk->sk_state_change during iso_sock_ready on a freed sock, providing a standard kernel heap corruption primitive that can be leveraged for arbitrary write and control-flow hijack.\nA:H - Concurrent iso_sock_kill and iso_conn_ready can dereference freed socket memory, causing kernel oops/panic from invalid lock_sock/sk_state access; UAF in the Bluetooth ISO path is inherently a high-availability risk even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74537","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74556","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised iSCSI target delivers crafted SCSI Command Response PDUs over the established TCP iSCSI session; reception flows through iscsi_sw_tcp_recv/iscsi_tcp_recv_skb into iscsi_tcp_hdr_dissect without local access.\nAC:L - The attacker controls the target and can set DataSegmentLength between 8193 and negotiated max_recv_dlength (open-iscsi commonly 262144) on SCSI_CMD_RSP for any outstanding command ITT; no races or victim-specific heap layout are required.\nPR:N - No privileges on the victim host are needed; a remote attacker acting as or MITMing the iSCSI target sends malicious responses after session login, independent of victim user accounts or capabilities.\nUI:N - On systems with persistent iSCSI sessions (cloud VMs, SAN-boot hosts, Kubernetes iSCSI volumes), exploitation triggers automatically during normal SCSI I/O when command responses are received; no victim action is needed at attack time.\nS:U - Heap corruption is confined to the kernel iSCSI initiator on the affected host; successful exploitation yields kernel compromise or DoS within the same security authority, not a VM escape or cross-boundary scope change.\nC:H - iscsi_tcp_segment_recv memcpy writes up to max_recv_dlength bytes into an 8192-byte conn->data buffer, causing a large heap overflow whose controlled corruption can be leveraged for arbitrary kernel memory disclosure.\nI:H - Attacker-controlled response data is copied past the fixed conn->data allocation via iscsi_tcp_data_recv_prep/iscsi_segment_init_linear, enabling heap metadata/object corruption exploitable for arbitrary kernel write and privilege escalation.\nA:H - Overflowing the conn->data heap buffer can immediately corrupt adjacent kernel allocations and cause oops/panic; a malicious target can repeatedly trigger this on active sessions to deny storage availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74556","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74581","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - fib6_rule_suppress() runs on every IPv6 route lookup via fib6_rule_lookup(), including ip6_route_input() for received packets and icmp6/icmpv6 redirect handlers; WireGuard/VPN servers commonly deploy suppress_prefixlength rules (wg-quick), so remote IPv6 traffic to those hosts reaches the bug.\nAC:L - Once suppress_prefixlength IPv6 policy routing rules exist, any matching packet deterministically triggers fib6_rule_suppress() to release the route while leaving a stale res->rt6 pointer; no race or uncontrollable memory layout is required.\nPR:N - Remote exploitation needs only the ability to send IPv6 packets through a host whose operator already configured suppress rules (e.g., wg-quick); CAP_NET_ADMIN is an admin deployment prerequisite, not attacker privilege on the target.\nUI:N - No victim action is required beyond normal delivery of attacker-generated IPv6 traffic (or ICMPv6 redirect) to a host performing policy-route lookup.\nS:U - The stale rt6_info/dst_entry UAF corrupts kernel heap memory within the same host security boundary; it is not a VM escape or cross-authority sandbox break.\nC:H - Returning a released rt6_info leaves a dangling dst_entry in ip6_dst_cache; subsequent reads through ip6_dst_idev(), dst metrics, or error paths are classic slab UAF with attacker-influencable heap reuse via sustained IPv6 traffic.\nI:H - Double-free/imbalanced rcuref put and post-free use of rt6_info fields give heap corruption primitives; UAF on dst/route cache objects is routinely leveraged for kernel write and control-flow hijack.\nA:H - Commit explicitly reports rcuref_put_slowpath() WARN from dst_release() on the freed route; UAF and refcount corruption can oops/panic the kernel, fully denying availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74582","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb->data before skb->head, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74612","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":10,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Remote packets routed through container/host veth pairs reach veth_xdp_rcv_skb() after veth_xmit on the peer; cloud and edge nodes routinely forward Internet traffic across veth links with XDP attached, matching the reproduced UDP receive path.\nAC:L - The fix commit shows 10/10 reliable reproduction with a 60000-byte UDP datagram and XDP bpf_xdp_adjust_tail()/bpf_xdp_pull_data() fragment shrink; the attacker controls packet size, timing, and both veth ends without races or uncontrollable kernel state.\nPR:N - Exploitation only requires an XDP program using bpf_xdp_adjust_tail or bpf_xdp_pull_data to already be attached on a reachable veth peer; the remote packet sender needs no local account, capabilities, or authentication to trigger the bad skb length accounting.\nUI:N - No victim interaction is needed beyond normal always-on packet reception and socket delivery; corrupted payloads and leaked kernel metadata are produced automatically when a userspace process reads the affected datagram.\nS:C - veth links intentionally cross container/host network namespaces on multi-tenant servers, and skb_shared_info metadata plus kernel pointers leaked into a tenant userspace recv buffer exceed that tenant's authorized security boundary.\nC:H - Desynchronized skb->len makes skb_headlen() exceed the real linear tail, so __skb_datagram_iter() copies up to 1024 bytes past the skb into userspace, exposing nr_frags, xdp_frags_size, and a kernel pointer from skb_shinfo(skb)->frags[0].\nI:H - The same length mismatch inflates the linear region, displacing and truncating real datagram bytes in the delivered UDP buffer and corrupting application-visible data beyond intended packet bounds while compounding misuse of leaked kernel metadata.\nA:H - bpf_xdp_pull_data() can leave frags present while the old __skb_put() path hits SKB_LINEAR_ASSERT()/BUG_ON on nonlinear skbs; the commit reports deterministic kernel asserts and crashes in addition to datagram corruption."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74612","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74669","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74669","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74695","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug fires in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS when remotely sourced IPv4/IPv6 packets matching an offloaded flow are received on nftables flowtable-bound interfaces, not via netlink configuration APIs.\nAC:L - Once a flowtable ingress hook and offloaded TCP/UDP flow exist, an attacker can reliably send matching traffic that reaches FLOW_OFFLOAD_XMIT_NEIGH or the XFRM offload path with a ref-counted skb dst; syzbot reproduced this without uncontrollable races.\nPR:N - Exploitation requires only sending network traffic through an already deployed nftables flow-offload path on an ingress device; no local account, authentication, or CAP_NET_ADMIN on the victim is needed to trigger the leak.\nUI:N - No victim interaction is required beyond normal network delivery; packets are processed automatically in softirq on the netdev ingress netfilter hook without opening files or mounting filesystems.\nS:U - Impact is confined to kernel refcount imbalance and availability degradation on the affected host; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:N - The flaw leaks a dst_entry reference by overwriting skb->_skb_refdst without releasing the prior dst; it does not expose kernel memory or provide an arbitrary read primitive.\nI:N - No unauthorized data modification occurs; the skb is forwarded using the intended flowtable destination while the previous dst reference is orphaned, not corrupted into a controllable write primitive.\nA:H - Each matching packet leaks a dst_entry refcount on the flowtable fast path, enabling sustained unauthenticated remote memory exhaustion on high-volume routers; CONFIG_DEBUG_NET builds also emit WARN_ON_ONCE during the overwrite."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74695","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-80722","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - Malformed S1G TWT setup action frames reach mac80211 via normal WiFi RX (driver -> ieee80211_rx_h_action -> ieee80211_process_rx_twt_action -> ieee80211_s1g_rx_twt_setup); an adjacent attacker within radio range sends crafted 802.11 management frames to a vulnerable AP.\nAC:L - The attacker fully controls the TWT element length and payload; ieee80211_process_rx_twt_action() only validates two bytes of req_type before queueing, so a short individual agreement reliably reaches drv_add_twt_setup() without races or victim-specific timing.\nPR:N - No Linux privileges on the victim AP are required; exploitation needs only normal 802.11 association as a WiFi client to an S1G AP with twt_responder enabled and a driver implementing add_twt_setup (e.g. MediaTek mt7915/mt7996).\nUI:N - No deliberate victim action is needed beyond operating an S1G AP that accepts associated stations; the attacker directly injects the malformed TWT setup frame and mac80211 processes it automatically on receive.\nS:U - Impact is kernel/driver heap memory corruption on the AP host within the same security authority; it does not cross VM, IOMMU, or sandbox boundaries (standard kernel compromise scope).\nC:H - drv_add_twt_setup(), its tracepoint, and driver callbacks read the full ieee80211_twt_params (twt, min_twt_dur, mantissa, channel) beyond the validated skb bounds, causing out-of-bounds reads of adjacent skb/heap memory that can disclose kernel data.\nI:H - MediaTek add_twt_setup() handlers write twt_agrt fields (req_type, min_twt_dur, twt) past the undersized params block into skb tail/heap memory, providing out-of-bounds write primitives exploitable for further memory corruption or code execution.\nA:H - Out-of-bounds access in mac80211/driver TWT setup can kernel-oops the AP or hang/crash WiFi firmware when corrupted parameters are programmed into hardware TWT state from attacker-controlled short frames."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80722","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4369-1","advisory_id":"ddb2c304-0ccc-4573-96b3-606b178f0dff","event_types":["advisory"],"published_at":"2026-10-25T22:45:55.826745+00:00","technologies":["core-osv","kernel-64kb","kernel-default","kernel-default-base","kernel-docs","kernel-livepatch-sle15-sp6-update-31","kernel-obs-build","kernel-source","kernel-syms","kernel-zfcpdump"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:46:28+00:00","detail_url":"/events/71343"},"members":[{"id":71343,"cve_ids":["CVE-2024-44981","CVE-2024-57841","CVE-2025-38469","CVE-2025-40022","CVE-2025-68179","CVE-2025-68214","CVE-2025-71104","CVE-2026-23210","CVE-2026-23230","CVE-2026-23451","CVE-2026-23454","CVE-2026-31502","CVE-2026-43147","CVE-2026-43456","CVE-2026-45968","CVE-2026-52910","CVE-2026-52912","CVE-2026-52929","CVE-2026-52977","CVE-2026-52994","CVE-2026-53059","CVE-2026-53110","CVE-2026-53163","CVE-2026-53260","CVE-2026-53264","CVE-2026-53365","CVE-2026-53366","CVE-2026-53381","CVE-2026-63801","CVE-2026-63823","CVE-2026-63827","CVE-2026-63879","CVE-2026-63881","CVE-2026-63886","CVE-2026-63887","CVE-2026-63888","CVE-2026-63920","CVE-2026-63944","CVE-2026-63970","CVE-2026-63972","CVE-2026-63973","CVE-2026-63992","CVE-2026-64000","CVE-2026-64002","CVE-2026-64007","CVE-2026-64010","CVE-2026-64011","CVE-2026-64015","CVE-2026-64018","CVE-2026-64029","CVE-2026-64034","CVE-2026-64048","CVE-2026-64098","CVE-2026-64109","CVE-2026-64114","CVE-2026-64115","CVE-2026-64121","CVE-2026-64217","CVE-2026-64247","CVE-2026-64266","CVE-2026-64268","CVE-2026-64304","CVE-2026-64312","CVE-2026-64355","CVE-2026-64383","CVE-2026-64384","CVE-2026-64385","CVE-2026-64386","CVE-2026-64387","CVE-2026-64423","CVE-2026-64450","CVE-2026-64481","CVE-2026-64524","CVE-2026-64527","CVE-2026-64541","CVE-2026-64543","CVE-2026-64562","CVE-2026-64563","CVE-2026-64572","CVE-2026-64577","CVE-2026-64581","CVE-2026-64593","CVE-2026-68121","CVE-2026-68133","CVE-2026-68136","CVE-2026-68138","CVE-2026-68155","CVE-2026-68158","CVE-2026-68159","CVE-2026-68160","CVE-2026-68202","CVE-2026-68397","CVE-2026-68398","CVE-2026-68417","CVE-2026-68426","CVE-2026-68428","CVE-2026-68480","CVE-2026-72020","CVE-2026-72069","CVE-2026-72072","CVE-2026-72083","CVE-2026-72084","CVE-2026-72123","CVE-2026-72135","CVE-2026-72221","CVE-2026-72222","CVE-2026-72251","CVE-2026-72262","CVE-2026-72288","CVE-2026-72289","CVE-2026-72317","CVE-2026-72339","CVE-2026-72389","CVE-2026-74345","CVE-2026-74377","CVE-2026-74378","CVE-2026-74390","CVE-2026-74394","CVE-2026-74454","CVE-2026-74488","CVE-2026-74496","CVE-2026-74516","CVE-2026-74518","CVE-2026-74537","CVE-2026-74556","CVE-2026-74581","CVE-2026-74582","CVE-2026-74612","CVE-2026-74669","CVE-2026-74695","CVE-2026-80722"],"payload":{"kind":"advisory","title":"Security update for the Linux Kernel","summary":"The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2024-57841,CVE-2026-53260: net: fix memory leak in tcp_conn_request() (bsc#1235944 bsc#1269731). - CVE-2025-68214: timers: Fix NULL function pointer race in timer_shutdown_sync() (bsc#1255225). - CVE-2026-23451: bonding: prevent potential infinite loop in bond_header_parse() (bsc#1261604). - CVE-2026-31502: team: fix header_ops type confusion with non-Ethernet ports (bsc#1263072). - CVE-2026-43147: Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (bsc#1264642). - CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() (bsc#1264734). - CVE-2026-45968: cpuidle: Skip governor when only one idle state is available (bsc#1267023). - CVE-2026-52910: bpf: Free reuseport cBPF prog after RCU grace period (bsc#1268659). - CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued (bsc#1269000). - CVE-2026-52929: sctp: stream: fully roll back denied add-stream state (bsc#1269004). - CVE-2026-52977: futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (bsc#1269242). - CVE-2026-52994: vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (bsc#1269126). - CVE-2026-53059: dm log: fix out-of-bounds write due to region_count overflow (bsc#1269655). - CVE-2026-53110: selftests/bpf: Add ASSERT_OK_FD macro (bsc#1269985). - CVE-2026-53163: locking/rtmutex: Skip remove_waiter() when waiter is not enqu","evidence":"osv:SUSE-SU-2026:4369-1","products":[{"name":{"value":"kernel-default","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-livepatch-SLE15-SP6_Update_31","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1-150600.13.3.4","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-64kb","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1.150600.12.62.4","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-zfcpdump","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1.150600.12.62.4","evidence":"/affected/12/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/13/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/13/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/14/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/14/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/15/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/15/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/16/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.135.1","evidence":"/affected/16/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4369-1","aliases":["SUSE-SU-2026:4369-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.135.1","kernel-default-livepatch-devel":"6.4.0-150600.23.135.1","kernel-livepatch-6_4_0-150600_23_135-default":"1-150600.13.3.4"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.3.4"}]}],"package":{"name":"kernel-livepatch-SLE15-SP6_Update_31","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_31&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.135.1","kernel-default-livepatch-devel":"6.4.0-150600.23.135.1","kernel-livepatch-6_4_0-150600_23_135-default":"1-150600.13.3.4"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-64kb","purl":"pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-zfcpdump","purl":"pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.135.1","kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","kernel-zfcpdump":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","kernel-64kb-devel":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1.150600.12.62.4"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.135.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4369-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.135.1","kernel-syms":"6.4.0-150600.23.135.1","kernel-devel":"6.4.0-150600.23.135.1","kernel-macros":"6.4.0-150600.23.135.1","kernel-source":"6.4.0-150600.23.135.1","kernel-default":"6.4.0-150600.23.135.1","dlm-kmp-default":"6.4.0-150600.23.135.1","gfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-obs-build":"6.4.0-150600.23.135.1","ocfs2-kmp-default":"6.4.0-150600.23.135.1","kernel-default-base":"6.4.0-150600.23.135.1.150600.12.62.4","kernel-default-devel":"6.4.0-150600.23.135.1","reiserfs-kmp-default":"6.4.0-150600.23.135.1","cluster-md-kmp-default":"6.4.0-150600.23.135.1"}]}}],"modified":"2026-10-02T18:42:50.599983491Z","provider":"osv","upstream":["CVE-2024-44981","CVE-2024-57841","CVE-2025-38469","CVE-2025-40022","CVE-2025-68179","CVE-2025-68214","CVE-2025-71104","CVE-2026-23210","CVE-2026-23230","CVE-2026-23451","CVE-2026-23454","CVE-2026-31502","CVE-2026-43147","CVE-2026-43456","CVE-2026-45968","CVE-2026-52910","CVE-2026-52912","CVE-2026-52929","CVE-2026-52977","CVE-2026-52994","CVE-2026-53059","CVE-2026-53110","CVE-2026-53163","CVE-2026-53260","CVE-2026-53264","CVE-2026-53365","CVE-2026-53366","CVE-2026-53381","CVE-2026-63801","CVE-2026-63823","CVE-2026-63827","CVE-2026-63879","CVE-2026-63881","CVE-2026-63886","CVE-2026-63887","CVE-2026-63888","CVE-2026-63920","CVE-2026-63944","CVE-2026-63970","CVE-2026-63972","CVE-2026-63973","CVE-2026-63992","CVE-2026-64000","CVE-2026-64002","CVE-2026-64007","CVE-2026-64010","CVE-2026-64011","CVE-2026-64015","CVE-2026-64018","CVE-2026-64029","CVE-2026-64034","CVE-2026-64048","CVE-2026-64098","CVE-2026-64109","CVE-2026-64114","CVE-2026-64115","CVE-2026-64121","CVE-2026-64217","CVE-2026-64247","CVE-2026-64266","CVE-2026-64268","CVE-2026-64304","CVE-2026-64312","CVE-2026-64355","CVE-2026-64383","CVE-2026-64384","CVE-2026-64385","CVE-2026-64386","CVE-2026-64387","CVE-2026-64423","CVE-2026-64450","CVE-2026-64481","CVE-2026-64524","CVE-2026-64527","CVE-2026-64541","CVE-2026-64543","CVE-2026-64562","CVE-2026-64563","CVE-2026-64572","CVE-2026-64577","CVE-2026-64581","CVE-2026-64593","CVE-2026-68121","CVE-2026-68133","CVE-2026-68136","CVE-2026-68138","CVE-2026-68155","CVE-2026-68158","CVE-2026-68159","CVE-2026-68160","CVE-2026-68202","CVE-2026-68397","CVE-2026-68398","CVE-2026-68417","CVE-2026-68426","CVE-2026-68428","CVE-2026-68480","CVE-2026-72020","CVE-2026-72069","CVE-2026-72072","CVE-2026-72083","CVE-2026-72084","CVE-2026-72123","CVE-2026-72135","CVE-2026-72221","CVE-2026-72222","CVE-2026-72251","CVE-2026-72262","CVE-2026-72288","CVE-2026-72289","CVE-2026-72317","CVE-2026-72339","CVE-2026-72389","CVE-2026-74345","CVE-2026-74377","CVE-2026-74378","CVE-2026-74390","CVE-2026-74394","CVE-2026-74454","CVE-2026-74488","CVE-2026-74496","CVE-2026-74516","CVE-2026-74518","CVE-2026-74537","CVE-2026-74556","CVE-2026-74581","CVE-2026-74582","CVE-2026-74612","CVE-2026-74669","CVE-2026-74695","CVE-2026-80722"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264369-1/","https://bugzilla.suse.com/1230238","https://bugzilla.suse.com/1235944","https://bugzilla.suse.com/1247455","https://bugzilla.suse.com/1250748","https://bugzilla.suse.com/1252682","https://bugzilla.suse.com/1254306","https://bugzilla.suse.com/1255225","https://bugzilla.suse.com/1255250","https://bugzilla.suse.com/1256708","https://bugzilla.suse.com/1257154","https://bugzilla.suse.com/1258430","https://bugzilla.suse.com/1258517","https://bugzilla.suse.com/1260522","https://bugzilla.suse.com/1261604","https://bugzilla.suse.com/1261780","https://bugzilla.suse.com/1263072","https://bugzilla.suse.com/1264642","https://bugzilla.suse.com/1264734","https://bugzilla.suse.com/1265449","https://bugzilla.suse.com/1265928","https://bugzilla.suse.com/1266402","https://bugzilla.suse.com/1267023","https://bugzilla.suse.com/1268659","https://bugzilla.suse.com/1269000","https://bugzilla.suse.com/1269004","https://bugzilla.suse.com/1269126","https://bugzilla.suse.com/1269238","https://bugzilla.suse.com/1269242","https://bugzilla.suse.com/1269306","https://bugzilla.suse.com/1269655","https://bugzilla.suse.com/1269731","https://bugzilla.suse.com/1269792","https://bugzilla.suse.com/1269981","https://bugzilla.suse.com/1269985","https://bugzilla.suse.com/1271365","https://bugzilla.suse.com/1271366","https://bugzilla.suse.com/1271830","https://bugzilla.suse.com/1272179","https://bugzilla.suse.com/1272182","https://bugzilla.suse.com/1272230","https://bugzilla.suse.com/1272381","https://bugzilla.suse.com/1272385","https://bugzilla.suse.com/1272390","https://bugzilla.suse.com/1272569","https://bugzilla.suse.com/1272571","https://bugzilla.suse.com/1272662","https://bugzilla.suse.com/1272673","https://bugzilla.suse.com/1272680","https://bugzilla.suse.com/1272682","https://bugzilla.suse.com/1272756","https://bugzilla.suse.com/1272798","https://bugzilla.suse.com/1272868","https://bugzilla.suse.com/1272877","https://bugzilla.suse.com/1273030","https://bugzilla.suse.com/1273053","https://bugzilla.suse.com/1273054","https://bugzilla.suse.com/1273105","https://bugzilla.suse.com/1273276","https://bugzilla.suse.com/1273303","https://bugzilla.suse.com/1273311","https://bugzilla.suse.com/1273422","https://bugzilla.suse.com/1273426","https://bugzilla.suse.com/1273484","https://bugzilla.suse.com/1273488","https://bugzilla.suse.com/1273523","https://bugzilla.suse.com/1273555","https://bugzilla.suse.com/1273578","https://bugzilla.suse.com/1273742","https://bugzilla.suse.com/1273743","https://bugzilla.suse.com/1273745","https://bugzilla.suse.com/1273748","https://bugzilla.suse.com/1273762","https://bugzilla.suse.com/1273766","https://bugzilla.suse.com/1273774","https://bugzilla.suse.com/1273869","https://bugzilla.suse.com/1273882","https://bugzilla.suse.com/1273891","https://bugzilla.suse.com/1273903","https://bugzilla.suse.com/1273930","https://bugzilla.suse.com/1273944","https://bugzilla.suse.com/1273968","https://bugzilla.suse.com/1273995","https://bugzilla.suse.com/1274014","https://bugzilla.suse.com/1274031","https://bugzilla.suse.com/1274041","https://bugzilla.suse.com/1274208","https://bugzilla.suse.com/1274226","https://bugzilla.suse.com/1274274","https://bugzilla.suse.com/1274497","https://bugzilla.suse.com/1274539","https://bugzilla.suse.com/1274541","https://bugzilla.suse.com/1274543","https://bugzilla.suse.com/1274545","https://bugzilla.suse.com/1274547","https://bugzilla.suse.com/1274550","https://bugzilla.suse.com/1274620","https://bugzilla.suse.com/1274696","https://bugzilla.suse.com/1274699","https://bugzilla.suse.com/1274705","https://bugzilla.suse.com/1274752","https://bugzilla.suse.com/1274753","https://bugzilla.suse.com/1274754","https://bugzilla.suse.com/1274888","https://bugzilla.suse.com/1274898","https://bugzilla.suse.com/1274902","https://bugzilla.suse.com/1274908","https://bugzilla.suse.com/1274941","https://bugzilla.suse.com/1275161","https://bugzilla.suse.com/1275304","https://bugzilla.suse.com/1275307","https://bugzilla.suse.com/1275470","https://bugzilla.suse.com/1275472","https://bugzilla.suse.com/1275474","https://bugzilla.suse.com/1275506","https://bugzilla.suse.com/1275528","https://bugzilla.suse.com/1275535","https://bugzilla.suse.com/1275540","https://bugzilla.suse.com/1275555","https://bugzilla.suse.com/1275665","https://bugzilla.suse.com/1275669","https://bugzilla.suse.com/1275687","https://bugzilla.suse.com/1275696","https://bugzilla.suse.com/1275782","https://bugzilla.suse.com/1275784","https://bugzilla.suse.com/1275797","https://bugzilla.suse.com/1275798","https://bugzilla.suse.com/1275827","https://bugzilla.suse.com/1275867","https://bugzilla.suse.com/1275886","https://bugzilla.suse.com/1275905","https://bugzilla.suse.com/1275925","https://bugzilla.suse.com/1276006","https://bugzilla.suse.com/1276350","https://bugzilla.suse.com/1276665","https://bugzilla.suse.com/1276931","https://bugzilla.suse.com/1277073","https://bugzilla.suse.com/1277155","https://bugzilla.suse.com/1277254","https://bugzilla.suse.com/1277285","https://bugzilla.suse.com/1277391","https://bugzilla.suse.com/1277408","https://bugzilla.suse.com/1277505","https://bugzilla.suse.com/1277523","https://bugzilla.suse.com/1277571","https://bugzilla.suse.com/1277678","https://bugzilla.suse.com/1277860","https://bugzilla.suse.com/1278088","https://bugzilla.suse.com/1278233","https://bugzilla.suse.com/1278236","https://bugzilla.suse.com/1279813","https://www.suse.com/security/cve/CVE-2024-44981","https://www.suse.com/security/cve/CVE-2024-57841","https://www.suse.com/security/cve/CVE-2025-38469","https://www.suse.com/security/cve/CVE-2025-40022","https://www.suse.com/security/cve/CVE-2025-68179","https://www.suse.com/security/cve/CVE-2025-68214","https://www.suse.com/security/cve/CVE-2025-71104","https://www.suse.com/security/cve/CVE-2026-23210","https://www.suse.com/security/cve/CVE-2026-23230","https://www.suse.com/security/cve/CVE-2026-23451","https://www.suse.com/security/cve/CVE-2026-23454","https://www.suse.com/security/cve/CVE-2026-31502","https://www.suse.com/security/cve/CVE-2026-43147","https://www.suse.com/security/cve/CVE-2026-43456","https://www.suse.com/security/cve/CVE-2026-45968","https://www.suse.com/security/cve/CVE-2026-52910","https://www.suse.com/security/cve/CVE-2026-52912","https://www.suse.com/security/cve/CVE-2026-52929","https://www.suse.com/security/cve/CVE-2026-52977","https://www.suse.com/security/cve/CVE-2026-52994","https://www.suse.com/security/cve/CVE-2026-53059","https://www.suse.com/security/cve/CVE-2026-53110","https://www.suse.com/security/cve/CVE-2026-53163","https://www.suse.com/security/cve/CVE-2026-53260","https://www.suse.com/security/cve/CVE-2026-53264","https://www.suse.com/security/cve/CVE-2026-53365","https://www.suse.com/security/cve/CVE-2026-53366","https://www.suse.com/security/cve/CVE-2026-53381","https://www.suse.com/security/cve/CVE-2026-63801","https://www.suse.com/security/cve/CVE-2026-63823","https://www.suse.com/security/cve/CVE-2026-63827","https://www.suse.com/security/cve/CVE-2026-63879","https://www.suse.com/security/cve/CVE-2026-63881","https://www.suse.com/security/cve/CVE-2026-63886","https://www.suse.com/security/cve/CVE-2026-63887","https://www.suse.com/security/cve/CVE-2026-63888","https://www.suse.com/security/cve/CVE-2026-63920","https://www.suse.com/security/cve/CVE-2026-63944","https://www.suse.com/security/cve/CVE-2026-63970","https://www.suse.com/security/cve/CVE-2026-63972","https://www.suse.com/security/cve/CVE-2026-63973","https://www.suse.com/security/cve/CVE-2026-63992","https://www.suse.com/security/cve/CVE-2026-64000","https://www.suse.com/security/cve/CVE-2026-64002","https://www.suse.com/security/cve/CVE-2026-64007","https://www.suse.com/security/cve/CVE-2026-64010","https://www.suse.com/security/cve/CVE-2026-64011","https://www.suse.com/security/cve/CVE-2026-64015","https://www.suse.com/security/cve/CVE-2026-64018","https://www.suse.com/security/cve/CVE-2026-64029","https://www.suse.com/security/cve/CVE-2026-64034","https://www.suse.com/security/cve/CVE-2026-64048","https://www.suse.com/security/cve/CVE-2026-64098","https://www.suse.com/security/cve/CVE-2026-64109","https://www.suse.com/security/cve/CVE-2026-64114","https://www.suse.com/security/cve/CVE-2026-64115","https://www.suse.com/security/cve/CVE-2026-64121","https://www.suse.com/security/cve/CVE-2026-64217","https://www.suse.com/security/cve/CVE-2026-64247","https://www.suse.com/security/cve/CVE-2026-64266","https://www.suse.com/security/cve/CVE-2026-64268","https://www.suse.com/security/cve/CVE-2026-64304","https://www.suse.com/security/cve/CVE-2026-64312","https://www.suse.com/security/cve/CVE-2026-64355","https://www.suse.com/security/cve/CVE-2026-64383","https://www.suse.com/security/cve/CVE-2026-64384","https://www.suse.com/security/cve/CVE-2026-64385","https://www.suse.com/security/cve/CVE-2026-64386","https://www.suse.com/security/cve/CVE-2026-64387","https://www.suse.com/security/cve/CVE-2026-64423","https://www.suse.com/security/cve/CVE-2026-64450","https://www.suse.com/security/cve/CVE-2026-64481","https://www.suse.com/security/cve/CVE-2026-64524","https://www.suse.com/security/cve/CVE-2026-64527","https://www.suse.com/security/cve/CVE-2026-64541","https://www.suse.com/security/cve/CVE-2026-64543","https://www.suse.com/security/cve/CVE-2026-64562","https://www.suse.com/security/cve/CVE-2026-64563","https://www.suse.com/security/cve/CVE-2026-64572","https://www.suse.com/security/cve/CVE-2026-64577","https://www.suse.com/security/cve/CVE-2026-64581","https://www.suse.com/security/cve/CVE-2026-64593","https://www.suse.com/security/cve/CVE-2026-68121","https://www.suse.com/security/cve/CVE-2026-68133","https://www.suse.com/security/cve/CVE-2026-68136","https://www.suse.com/security/cve/CVE-2026-68138","https://www.suse.com/security/cve/CVE-2026-68155","https://www.suse.com/security/cve/CVE-2026-68158","https://www.suse.com/security/cve/CVE-2026-68159","https://www.suse.com/security/cve/CVE-2026-68160","https://www.suse.com/security/cve/CVE-2026-68202","https://www.suse.com/security/cve/CVE-2026-68397","https://www.suse.com/security/cve/CVE-2026-68398","https://www.suse.com/security/cve/CVE-2026-68417","https://www.suse.com/security/cve/CVE-2026-68426","https://www.suse.com/security/cve/CVE-2026-68428","https://www.suse.com/security/cve/CVE-2026-68480","https://www.suse.com/security/cve/CVE-2026-72020","https://www.suse.com/security/cve/CVE-2026-72069","https://www.suse.com/security/cve/CVE-2026-72072","https://www.suse.com/security/cve/CVE-2026-72083","https://www.suse.com/security/cve/CVE-2026-72084","https://www.suse.com/security/cve/CVE-2026-72123","https://www.suse.com/security/cve/CVE-2026-72135","https://www.suse.com/security/cve/CVE-2026-72221","https://www.suse.com/security/cve/CVE-2026-72222","https://www.suse.com/security/cve/CVE-2026-72251","https://www.suse.com/security/cve/CVE-2026-72262","https://www.suse.com/security/cve/CVE-2026-72288","https://www.suse.com/security/cve/CVE-2026-72289","https://www.suse.com/security/cve/CVE-2026-72317","https://www.suse.com/security/cve/CVE-2026-72339","https://www.suse.com/security/cve/CVE-2026-72389","https://www.suse.com/security/cve/CVE-2026-74345","https://www.suse.com/security/cve/CVE-2026-74377","https://www.suse.com/security/cve/CVE-2026-74378","https://www.suse.com/security/cve/CVE-2026-74390","https://www.suse.com/security/cve/CVE-2026-74394","https://www.suse.com/security/cve/CVE-2026-74454","https://www.suse.com/security/cve/CVE-2026-74488","https://www.suse.com/security/cve/CVE-2026-74496","https://www.suse.com/security/cve/CVE-2026-74516","https://www.suse.com/security/cve/CVE-2026-74518","https://www.suse.com/security/cve/CVE-2026-74537","https://www.suse.com/security/cve/CVE-2026-74556","https://www.suse.com/security/cve/CVE-2026-74581","https://www.suse.com/security/cve/CVE-2026-74582","https://www.suse.com/security/cve/CVE-2026-74612","https://www.suse.com/security/cve/CVE-2026-74669","https://www.suse.com/security/cve/CVE-2026-74695","https://www.suse.com/security/cve/CVE-2026-80722"]},"related_cves":[{"value":"CVE-2024-44981","evidence":"/upstream"},{"value":"CVE-2024-57841","evidence":"/upstream"},{"value":"CVE-2025-38469","evidence":"/upstream"},{"value":"CVE-2025-40022","evidence":"/upstream"},{"value":"CVE-2025-68179","evidence":"/upstream"},{"value":"CVE-2025-68214","evidence":"/upstream"},{"value":"CVE-2025-71104","evidence":"/upstream"},{"value":"CVE-2026-23210","evidence":"/upstream"},{"value":"CVE-2026-23230","evidence":"/upstream"},{"value":"CVE-2026-23451","evidence":"/upstream"},{"value":"CVE-2026-23454","evidence":"/upstream"},{"value":"CVE-2026-31502","evidence":"/upstream"},{"value":"CVE-2026-43147","evidence":"/upstream"},{"value":"CVE-2026-43456","evidence":"/upstream"},{"value":"CVE-2026-45968","evidence":"/upstream"},{"value":"CVE-2026-52910","evidence":"/upstream"},{"value":"CVE-2026-52912","evidence":"/upstream"},{"value":"CVE-2026-52929","evidence":"/upstream"},{"value":"CVE-2026-52977","evidence":"/upstream"},{"value":"CVE-2026-52994","evidence":"/upstream"},{"value":"CVE-2026-53059","evidence":"/upstream"},{"value":"CVE-2026-53110","evidence":"/upstream"},{"value":"CVE-2026-53163","evidence":"/upstream"},{"value":"CVE-2026-53260","evidence":"/upstream"},{"value":"CVE-2026-53264","evidence":"/upstream"},{"value":"CVE-2026-53365","evidence":"/upstream"},{"value":"CVE-2026-53366","evidence":"/upstream"},{"value":"CVE-2026-53381","evidence":"/upstream"},{"value":"CVE-2026-63801","evidence":"/upstream"},{"value":"CVE-2026-63823","evidence":"/upstream"},{"value":"CVE-2026-63827","evidence":"/upstream"},{"value":"CVE-2026-63879","evidence":"/upstream"},{"value":"CVE-2026-63881","evidence":"/upstream"},{"value":"CVE-2026-63886","evidence":"/upstream"},{"value":"CVE-2026-63887","evidence":"/upstream"},{"value":"CVE-2026-63888","evidence":"/upstream"},{"value":"CVE-2026-63920","evidence":"/upstream"},{"value":"CVE-2026-63944","evidence":"/upstream"},{"value":"CVE-2026-63970","evidence":"/upstream"},{"value":"CVE-2026-63972","evidence":"/upstream"},{"value":"CVE-2026-63973","evidence":"/upstream"},{"value":"CVE-2026-63992","evidence":"/upstream"},{"value":"CVE-2026-64000","evidence":"/upstream"},{"value":"CVE-2026-64002","evidence":"/upstream"},{"value":"CVE-2026-64007","evidence":"/upstream"},{"value":"CVE-2026-64010","evidence":"/upstream"},{"value":"CVE-2026-64011","evidence":"/upstream"},{"value":"CVE-2026-64015","evidence":"/upstream"},{"value":"CVE-2026-64018","evidence":"/upstream"},{"value":"CVE-2026-64029","evidence":"/upstream"},{"value":"CVE-2026-64034","evidence":"/upstream"},{"value":"CVE-2026-64048","evidence":"/upstream"},{"value":"CVE-2026-64098","evidence":"/upstream"},{"value":"CVE-2026-64109","evidence":"/upstream"},{"value":"CVE-2026-64114","evidence":"/upstream"},{"value":"CVE-2026-64115","evidence":"/upstream"},{"value":"CVE-2026-64121","evidence":"/upstream"},{"value":"CVE-2026-64217","evidence":"/upstream"},{"value":"CVE-2026-64247","evidence":"/upstream"},{"value":"CVE-2026-64266","evidence":"/upstream"},{"value":"CVE-2026-64268","evidence":"/upstream"},{"value":"CVE-2026-64304","evidence":"/upstream"},{"value":"CVE-2026-64312","evidence":"/upstream"},{"value":"CVE-2026-64355","evidence":"/upstream"},{"value":"CVE-2026-64383","evidence":"/upstream"},{"value":"CVE-2026-64384","evidence":"/upstream"},{"value":"CVE-2026-64385","evidence":"/upstream"},{"value":"CVE-2026-64386","evidence":"/upstream"},{"value":"CVE-2026-64387","evidence":"/upstream"},{"value":"CVE-2026-64423","evidence":"/upstream"},{"value":"CVE-2026-64450","evidence":"/upstream"},{"value":"CVE-2026-64481","evidence":"/upstream"},{"value":"CVE-2026-64524","evidence":"/upstream"},{"value":"CVE-2026-64527","evidence":"/upstream"},{"value":"CVE-2026-64541","evidence":"/upstream"},{"value":"CVE-2026-64543","evidence":"/upstream"},{"value":"CVE-2026-64562","evidence":"/upstream"},{"value":"CVE-2026-64563","evidence":"/upstream"},{"value":"CVE-2026-64572","evidence":"/upstream"},{"value":"CVE-2026-64577","evidence":"/upstream"},{"value":"CVE-2026-64581","evidence":"/upstream"},{"value":"CVE-2026-64593","evidence":"/upstream"},{"value":"CVE-2026-68121","evidence":"/upstream"},{"value":"CVE-2026-68133","evidence":"/upstream"},{"value":"CVE-2026-68136","evidence":"/upstream"},{"value":"CVE-2026-68138","evidence":"/upstream"},{"value":"CVE-2026-68155","evidence":"/upstream"},{"value":"CVE-2026-68158","evidence":"/upstream"},{"value":"CVE-2026-68159","evidence":"/upstream"},{"value":"CVE-2026-68160","evidence":"/upstream"},{"value":"CVE-2026-68202","evidence":"/upstream"},{"value":"CVE-2026-68397","evidence":"/upstream"},{"value":"CVE-2026-68398","evidence":"/upstream"},{"value":"CVE-2026-68417","evidence":"/upstream"},{"value":"CVE-2026-68426","evidence":"/upstream"},{"value":"CVE-2026-68428","evidence":"/upstream"},{"value":"CVE-2026-68480","evidence":"/upstream"},{"value":"CVE-2026-72020","evidence":"/upstream"},{"value":"CVE-2026-72069","evidence":"/upstream"},{"value":"CVE-2026-72072","evidence":"/upstream"},{"value":"CVE-2026-72083","evidence":"/upstream"},{"value":"CVE-2026-72084","evidence":"/upstream"},{"value":"CVE-2026-72123","evidence":"/upstream"},{"value":"CVE-2026-72135","evidence":"/upstream"},{"value":"CVE-2026-72221","evidence":"/upstream"},{"value":"CVE-2026-72222","evidence":"/upstream"},{"value":"CVE-2026-72251","evidence":"/upstream"},{"value":"CVE-2026-72262","evidence":"/upstream"},{"value":"CVE-2026-72288","evidence":"/upstream"},{"value":"CVE-2026-72289","evidence":"/upstream"},{"value":"CVE-2026-72317","evidence":"/upstream"},{"value":"CVE-2026-72339","evidence":"/upstream"},{"value":"CVE-2026-72389","evidence":"/upstream"},{"value":"CVE-2026-74345","evidence":"/upstream"},{"value":"CVE-2026-74377","evidence":"/upstream"},{"value":"CVE-2026-74378","evidence":"/upstream"},{"value":"CVE-2026-74390","evidence":"/upstream"},{"value":"CVE-2026-74394","evidence":"/upstream"},{"value":"CVE-2026-74454","evidence":"/upstream"},{"value":"CVE-2026-74488","evidence":"/upstream"},{"value":"CVE-2026-74496","evidence":"/upstream"},{"value":"CVE-2026-74516","evidence":"/upstream"},{"value":"CVE-2026-74518","evidence":"/upstream"},{"value":"CVE-2026-74537","evidence":"/upstream"},{"value":"CVE-2026-74556","evidence":"/upstream"},{"value":"CVE-2026-74581","evidence":"/upstream"},{"value":"CVE-2026-74582","evidence":"/upstream"},{"value":"CVE-2026-74612","evidence":"/upstream"},{"value":"CVE-2026-74669","evidence":"/upstream"},{"value":"CVE-2026-74695","evidence":"/upstream"},{"value":"CVE-2026-80722","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ddb2c304-0ccc-4573-96b3-606b178f0dff","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-23230","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerability is in the SMB client code (fs/smb/client/). The race is triggered between processing a server's create response (setting is_open) and the server sending a lease break notification. A malicious SMB server can trigger this remotely over the network.\nAC:L - The attacker (malicious SMB server) controls when lease breaks are sent and can time them immediately after the create response. The attacker can retry many times across many directory opens, and the RMW race window is inherent to every bitfield write, making it reliably triggerable.\nPR:N - The attacker is the SMB server, requiring no privileges on the victim system. The lease break is processed as part of normal SMB protocol handling with no additional authentication check beyond the existing session.\nUI:R - The victim must mount an SMB share from the attacker's server (or a compromised server), which requires explicit user or administrator action.\nS:U - The vulnerability impacts the kernel where the SMB client runs; it does not cross a security boundary such as a VM or sandbox.\nC:H - The race can restore has_lease after the lease reference was dropped, leading to reference count corruption and use-after-free. UAF on heap objects gives the attacker read primitives over arbitrary kernel memory through heap spraying.\nI:H - The use-after-free from reference count corruption allows the attacker to reclaim the freed cached_fid object with controlled data, enabling arbitrary kernel write primitives and potential code execution.\nA:H - The reference count corruption and list corruption caused by the restored stale flags will lead to double-free, use-after-free, or list corruption, all of which reliably cause kernel panics/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-23230","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-31502","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the vulnerable team header_ops path by locally creating/enslaving network devices through rtnetlink and then triggering dev_hard_header()/dev_parse_header() via local packet/socket or network-stack activity on the malformed team device. The required setup is a local kernel networking configuration path rather than an unauthenticated packet-processing path.\nAC:L - The vulnerable topology, such as GRE -> bond -> team, is fully attacker-controlled once the required namespace capabilities are available, and triggering the bad callback is deterministic. There is no race or external timing condition required.\nPR:L - Creating team/bond/GRE devices and enslaving them requires CAP_NET_ADMIN, and packet sockets require CAP_NET_RAW, but both are available to an unprivileged user inside a user and network namespace on systems permitting unprivileged user namespaces. This is therefore low privileges, not real init-namespace root.\nUI:N - No victim interaction is required after the attacker has local access and namespace capabilities. The attacker can configure the devices and trigger the callback directly.\nS:U - The impact is within the same kernel security authority. This is a kernel crash/type-confusion or privilege-impact issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a header_ops type confusion where callbacks interpret team private data as another subsystem's private structure, causing attacker-influenced kernel pointer dereferences and potential kernel memory exposure. Following the higher-severity rule for type confusion, confidentiality impact is high.\nI:H - Type confusion in kernel callback dispatch can lead to misinterpreted object pointers and potentially control-flow or write-primitive exploitation beyond the observed crash. Kernel type confusion is scored as high integrity impact.\nA:H - The reported and expected failure mode is a kernel oops/BUG/crash when the inherited callback uses the wrong net_device private layout. This gives high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31502","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43456","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local rtnetlink/AF_PACKET operations: creating/enslaving a non-Ethernet slave to a bond and then causing `dev_hard_header()` on the bond device. Remote packets are not sufficient without the vulnerable local device configuration.\nAC:L - No race or special external timing is required; the attacker can deterministically create the bond/GRE setup and trigger the confused header callback. Required modules/configuration are common and autoloadable through rtnetlink in normal deployments.\nPR:L - The setup requires `CAP_NET_ADMIN` and the AF_PACKET trigger requires `CAP_NET_RAW`, but both are obtainable by an unprivileged local user inside a user/network namespace. Therefore this is low privilege rather than real init-namespace root only.\nUI:N - Exploitation does not require a victim user to perform an action. The attacker can perform the setup and trigger locally.\nS:U - The impact is within the kernel security authority on the same system. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug is kernel type confusion where bonding private data is interpreted as another device's private structure, and the confused callback can read kernel data using the wrong layout. Following the required higher-severity rule for type confusion, confidentiality impact is High.\nI:H - The confused header callback uses bogus private-data fields to construct and push protocol headers into an skb, making this a kernel memory/type confusion condition rather than a pure NULL dereference. Type confusion is scored as High integrity impact.\nA:H - The reported failure is a kernel BUG/oops in `pskb_expand_head()` reachable through the confused `ipgre_header()` call. This provides a reliable local kernel crash/DoS."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43456","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52910","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable attach/detach operation is reached through local `setsockopt()` on an `SO_REUSEPORT` socket with `SO_ATTACH_REUSEPORT_CBPF` or `SO_DETACH_REUSEPORT_BPF`. Although packet receive executes the stale program, the attacker-controlled trigger for freeing/replacing it is a local socket API path.\nAC:L - The race is attacker-controlled: a local attacker can create the UDP reuseport group, replace/detach the cBPF program, and concurrently send packets to drive `reuseport_select_sock()`. No rare external condition is required.\nPR:L - A basic unprivileged local user can create UDP sockets on an unprivileged port, set `SO_REUSEPORT`, and attach a classic reuseport BPF filter; this path does not require `CAP_NET_ADMIN`. User namespaces are not needed to make the path reachable.\nUI:N - No victim user action is required once the attacker runs the local reproducer. The attacker controls the sockets, the filter replacement, and the packet generation.\nS:U - The bug is a kernel memory lifetime error used for local kernel compromise or crash within the same host security authority. It does not cross a VM, IOMMU, or similar security boundary.\nC:H - This is a use-after-free of a `bpf_prog` object that is dereferenced after reclamation while selecting a reuseport socket. Per kernel CVSS guidance, UAFs are treated as enabling high confidentiality impact through potential kernel memory disclosure.\nI:H - The stale freed `bpf_prog` can be reused while the receive path reads and runs through the program object, making control-flow or data corruption plausible. Per kernel CVSS guidance, UAF memory corruption warrants high integrity impact.\nA:H - The reported reproducer triggers a KASAN vmalloc out-of-bounds/use-after-free splat in the packet receive path. Such kernel memory corruption can reliably crash or destabilize the kernel."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52910","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52912","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local control of netfilter/NFQUEUE, bridge device lifecycle, and verdict reinjection through netlink/rtnetlink paths. Remote packets alone cannot force the needed bridge teardown and userspace verdict sequence.\nAC:L - A local attacker can deterministically create a namespace, bridge/veth setup, NFQUEUE rule, queued packet, bridge teardown, and reinjection. There is no race dependent on conditions outside attacker control.\nPR:L - The setup requires CAP_NET_ADMIN, but netfilter and bridge configuration are reachable with CAP_NET_ADMIN inside a user-created network namespace on systems allowing unprivileged user namespaces. This is Low, not High.\nUI:N - No victim action is required once the local attacker runs the exploit sequence. The attacker controls packet injection, queueing, device teardown, and verdict delivery.\nS:U - The impact is kernel memory corruption within the same host security authority. This is a standard local kernel privilege escalation/DoS scenario, not a VM or hardware boundary escape.\nC:H - The bug is a use-after-free of the bridge master net_device retained in skb->dev across NFQUEUE. Kernel UAFs can be leveraged for kernel memory disclosure, so confidentiality impact is High.\nI:H - The stale net_device pointer is dereferenced after free in the receive path and can plausibly be combined with heap reclaim/spraying for memory corruption or control-flow impact. As a kernel UAF, integrity impact is High.\nA:H - At minimum, reinjection can dereference freed net_device memory in netif_receive_skb and crash/oops the kernel. Repeated local triggering makes availability impact High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52912","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52929","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached while processing an SCTP RE-CONFIG response chunk received from a remote SCTP peer on an established association. A malicious peer can send a denied ADD_OUT_STREAMS response over the network once stream reconfiguration is negotiated.\nAC:L - The packet/state sequence is protocol-controlled and reproducible: negotiate SCTP RE-CONFIG, trigger an ADD_OUT_STREAMS request, deny it, then cause later reuse of the stale stream state. Although RE-CONFIG must be enabled by the application, there is no race or condition outside the attacker's reasonable influence in a deployment using this feature.\nPR:N - A remote SCTP peer does not need local kernel privileges or authenticated OS privileges to send the denial response. The path is gated by SCTP association state, verification tag, and matching outstanding request sequence, not by credentials.\nUI:N - No human user interaction is required once the SCTP service/association is operating with stream reconfiguration. The triggering input is network protocol traffic from the peer.\nS:U - The vulnerability affects kernel SCTP state within the same host security authority. It does not cross a VM, IOMMU, or other separate authorization boundary.\nC:N - The investigated failure mode is stale SCTP stream scheduler metadata leading to a NULL pointer dereference in scheduler value retrieval. I did not find evidence of an attacker-controlled memory read or information disclosure primitive.\nI:N - The bug leaves scheduler-private stream state inconsistent but the demonstrated impact is a NULL dereference/crash, not controlled data modification or code execution. No arbitrary write primitive was evident from the rollback path.\nA:H - The stale stream extension state can lead to a kernel NULL pointer dereference/oops in the SCTP scheduler path. A remotely reachable kernel crash is a high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52929","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53110","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached by locally loading or attaching BPF programs through the bpf() syscall and then executing the JITed program or generated trampoline. It is not directly reachable from remote network packets without prior local BPF program installation.\nAC:L - An attacker can craft BPF bytecode/attachments that exercise unsigned kfunc arguments or trampoline return values, and there is no race or external timing condition required. The bug is a deterministic ABI/JIT miscompilation on affected s390 systems.\nPR:L - Loading kfunc/tracing BPF normally requires BPF-related capabilities, but BPF token delegation can evaluate these in a non-init user namespace in delegated/containerized deployments. Following the higher-severity rule, this is scored as low privileges rather than requiring real init-namespace root.\nUI:N - No victim action is needed after the attacker can issue the relevant bpf() syscalls. The attacker loads/attaches and triggers the affected BPF program path directly.\nS:U - The vulnerability affects kernel execution in the same security authority as the vulnerable component. It is a local kernel compromise/DoS style issue, not a VM escape or separate security-scope boundary bypass.\nC:H - The missing zero-extension lets attacker-controlled high bits cross the verifier/native ABI boundary for kfunc calls and trampoline returns. This can plausibly turn verifier-assumed bounded values into unsafe kernel values, matching prior BPF JIT verifier-bypass classes with kernel memory disclosure potential.\nI:H - Incorrect unsigned argument or return extension can corrupt kernel control/data flow through kfuncs or BPF modify-return trampolines. Under the required higher-severity assumption, this is treated as exploitable for kernel memory modification or privilege escalation.\nA:H - At minimum, passing ABI-invalid kfunc arguments or malformed trampoline return values can trigger kernel oops/panic paths, as similar BPF JIT argument-extension bugs have done. The attacker can repeatedly load/trigger the crafted BPF program."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53110","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53260","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable TCP request-socket path is reached by unauthenticated IPv4 or IPv6 SYN packets delivered to a listening socket over the network. This occurs before any application-level authentication.\nAC:L - Although the bug is a PREEMPT_RT timing race, an attacker can repeatedly create request sockets and timer/drop races by driving TCP connection attempts; under the required higher-severity rule this is treated as attacker-controllable rather than an uncontrollable environmental condition.\nPR:N - No credentials, capabilities, or prior authentication are required to send SYN packets to an exposed TCP listener and reach `tcp_conn_request()` and `reqsk_queue_hash_req()`. The path is in the generic TCP receive stack.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform an interactive action. Network traffic alone can exercise the vulnerable path on an affected listening service.\nS:U - The impact is within the kernel/network stack security authority on the same host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The failure is explicitly reported as a refcount underflow/use-after-free in a kernel heap object. Per the required guidance, UAF-class lifetime corruption is scored as high confidentiality impact because it can potentially be shaped into memory disclosure.\nI:H - The corrupted request-socket lifetime can leave stale kernel objects reachable through ehash/timer paths. Per the required guidance, UAF-class kernel memory corruption is scored as high integrity impact because it may be exploitable for write or control-flow manipulation.\nA:H - The observed failure triggers a kernel refcount warning with use-after-free semantics in timer context and can destabilize networking or the kernel. Kernel warnings/oopses, hangs, or UAF-triggered crashes are high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53260","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53264","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local rtnetlink `RTM_NEWTFILTER`/`RTM_DELTFILTER` traffic-control netlink messages, not by remote packet input.\nAC:L - The race is attacker-controlled because the same local actor can issue concurrent filter creation and deletion operations against the same action index. No external victim timing or rare environmental condition is required.\nPR:L - The operations require `CAP_NET_ADMIN` for non-GET rtnetlink messages, but traffic control is reachable with `CAP_NET_ADMIN` inside a user-created network namespace. Under the provided kernel guidance, this is Low privileges rather than High.\nUI:N - No victim interaction is needed; exploitation consists of the attacker sending crafted concurrent rtnetlink requests.\nS:U - The impact is within the kernel security authority and is a standard local kernel memory-corruption/privilege-escalation class issue. It does not cross a VM, IOMMU, or separate authorization scope boundary.\nC:H - The bug is a use-after-free of a `tc_action` object during action lookup/refcounting. A kernel heap UAF can be shaped into disclosure primitives, so confidentiality impact is High.\nI:H - The stale freed action pointer can be reused after heap reallocation and then modified/dereferenced through refcount, bind count, ops, and action lifecycle fields. This is memory corruption that can plausibly support arbitrary write or code execution, so integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or mutate freed/reused kernel memory and can crash or oops the kernel. Availability impact is therefore High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53264","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53366","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached while a local process constructs outgoing IPv4 UDP/raw/ping datagrams through sendmsg/splice/sendfile-style socket paths. I did not find a defensible received-packet or unauthenticated remote path that supplies the required cork/MSG_MORE-style fraggap conditions.\nAC:L - The attacker can choose UDP socket options/flags, payload sizes, corking/MSG_MORE behavior, and splice/zerocopy-style paged sends to reach the fraggap paged-allocation path. There is no race or external timing condition required.\nPR:L - A normal unprivileged local user can create IPv4 UDP sockets and use UDP_CORK/MSG_MORE/splice or related paged send paths; raw sockets are CAP_NET_RAW-gated but are not needed for the strongest local trigger. This is therefore basic local user privilege, not real administrator privilege.\nUI:N - No victim interaction is required once the attacker can run the local send/splice sequence. The vulnerable skb construction happens synchronously in the attacker-driven socket send path.\nS:U - The impact is within the same kernel security authority as the vulnerable IPv4 networking code. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug under-allocates/accounting for the linear skb area and can copy attacker-controlled fraggap bytes past skb->end into trailing skb_shared_info metadata. Kernel memory corruption of this kind is reasonably capable of being developed into information disclosure, so the higher severity confidentiality value is appropriate.\nI:H - The copied fraggap bytes corrupt kernel skb metadata past the intended buffer boundary. This is an out-of-bounds write in kernel heap/networking structures and is scored as high integrity impact.\nA:H - The corrupted skb metadata can crash or destabilize the kernel networking stack, and related negative-copy accounting can also produce severe send-path failure behavior. Kernel crash or oops potential is high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53366","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53381","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local VFS operations (open/write/close) on a virtiofs mount with FUSE submounts; exploitation is in the guest FUSE client during file release and submount umount, not via remote network packets.\nAC:L - This is a use-after-free where the attacker controls file close (async FUSE RELEASE) and can drive or coincide with submount umount; Kata Containers reproduces it reliably with virtiofsd --announce-submounts (default).\nPR:L - An unprivileged local process with access to the virtiofs mount can trigger it; virtiofs defaults to allow_other and normal POSIX permissions, and no real root or init-namespace capabilities are required.\nUI:N - Exploitation needs no victim interaction beyond the attacker (or their container workload) performing normal filesystem I/O while submount teardown occurs during pod/container lifecycle.\nS:U - Impact stays within the guest kernel security boundary (crash or guest kernel compromise); it does not by itself cross a VM/host or IOMMU boundary.\nC:H - The flaw is a use-after-free in fuse_release_end() calling iput() on an inode after its superblock is destroyed, which can be turned into arbitrary kernel memory read via heap manipulation.\nI:H - Use-after-free on a struct inode in the kernel heap provides a standard path to controlled memory corruption, heap spraying, and arbitrary write or code execution in kernel context.\nA:H - Confirmed kernel general protection fault/oops in iput() from fuse_release_end during virtio_fs request completion, and UAF bugs inherently threaten kernel stability even without full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53381","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63801","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached from the TIPC packet receive path (UDP bearer on port 6118 or L2 bearer) when encrypted frames arrive from a remote peer; no local syscall is required to enter tipc_aead_decrypt().\nAC:L - The attacker can reliably win the race by flooding packets to queue async decrypt completions while repeatedly destroying the network namespace; the repro demonstrates full control of both sides of the timing window.\nPR:L - Reliable exploitation is demonstrated via unshare-created user/network namespaces where the attacker gains CAP_NET_ADMIN-equivalent control to configure TIPC crypto and cycle namespace teardown, which per kernel CNA guidance maps to Low rather than High.\nUI:N - Exploitation requires only sending network packets and namespace lifecycle manipulation; no victim user action such as opening a file or mounting a filesystem is needed.\nS:U - Impact is confined to kernel memory within the same security authority; this is a standard kernel UAF/privilege-escalation class bug, not a VM escape or cross-authority boundary bypass.\nC:H - The UAF reads freed slab memory including aead->crypto->stats, aead->crypto->net, and aead[] pointers in tipc_crypto_rcv_complete, enabling arbitrary kernel memory disclosure via controlled reuse of the freed tipc_crypto object.\nI:H - Use-after-free of tipc_crypto structures can be leveraged for heap spraying and arbitrary write primitives, and tipc_crypto_rcv_complete continues processing with freed pointers including key attachment and node table operations.\nA:H - KASAN confirmed slab-use-after-free in tipc_aead_decrypt_done on a workqueue thread; UAF on this path causes kernel oops/panic even when not fully exploited for code execution."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63801","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63823","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local `request_key()` and `keyctl()` syscalls (`KEYCTL_ASSUME_AUTHORITY`, `KEYCTL_INSTANTIATE`, `KEYCTL_INSTANTIATE_IOV`, `KEYCTL_REJECT`); there is no network, adjacent-radio, or physical-device entry path.\nAC:L - Exploitation is a race the attacker orchestrates by calling `request_key()` and concurrently driving `KEYCTL_INSTANTIATE_IOV` with a user buffer that page-faults during `copy_from_iter_full()`, while a second helper thread or completion path revokes/frees the auth payload.\nPR:L - Any unprivileged local user can invoke `request_key()` and the affected `keyctl` instantiate/reject operations in the spawned helper context; no real-root or non-userns capability is required.\nUI:N - Exploitation does not depend on a victim performing an action beyond the attacker’s own syscall activity and helper process setup.\nS:U - Impact is kernel memory corruption and local privilege escalation within the same kernel security domain, not a VM-guest-to-host or IOMMU boundary escape.\nC:H - This is a heap use-after-free of `struct request_key_auth`; after free the code dereferences `rka->target_key` and related fields, enabling attacker-controlled reuse and arbitrary kernel memory disclosure.\nI:H - The UAF corrupts trusted kernel pointers (`target_key`, `dest_keyring`) used in `key_instantiate_and_link()`, which can be turned into arbitrary kernel writes and local privilege escalation.\nA:H - Use-after-free of kernel heap objects can cause kernel oops/panic during post-fault dereferences, and is independently severe even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63823","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63879","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local AMDGPU DRM ioctls (e.g., AMDGPU_GEM_USERPTR, AMDGPU_CS) and KFD ioctls on /dev/kfd that call amdgpu_hmm_range_get_pages(); there is no network-facing entry point.\nAC:L - Exploitation requires a >2GB userptr/SVM mapping and a concurrent munmap/remap during the multi-chunk HMM walk, but the attacker controls both the ioctl thread and the address-space manipulation, so the race is attacker-driven rather than dependent on uncontrollable conditions.\nPR:L - Any unprivileged local user with access to the AMDGPU render node or /dev/kfd (typically render/video group membership) can create large userptr buffers and submit GPU work that triggers the vulnerable HMM path; root or init-namespace capabilities are not required.\nUI:N - Exploitation is fully attacker-driven through GPU memory registration and command submission ioctls and does not require any action from another user or administrator.\nS:U - The flaw corrupts or misuses kernel-tracked page metadata and enables standard local kernel memory safety impact and privilege escalation within the same kernel security domain, not a VM escape or IOMMU boundary bypass.\nC:H - Re-reading the MMU notifier sequence per 2GB chunk lets later validation pass while earlier PFNs may reference unmapped or freed pages, giving the GPU (and kernel DMA helpers) a stale-page/use-after-free primitive that can disclose arbitrary physical memory contents.\nI:H - Stale PFNs from invalidated mappings can be DMA-mapped and written by GPU operations, enabling arbitrary memory corruption and potential control-flow hijacking via repurposed physical pages rather than a bounded or crash-only effect.\nA:H - Operating on invalid struct page pointers during pinning/DMA mapping can trigger kernel oopses or panics, and the underlying use-after-free class of bug inherently threatens system availability even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63879","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63881","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local `ioctl()` on `/dev/kfd` via `AMDKFD_IOC_DBG_TRAP` with `KFD_IOC_DBG_TRAP_SUSPEND_QUEUES` or `KFD_IOC_DBG_TRAP_RESUME_QUEUES`; there is no network, adjacent-radio, or physical-access path to the vulnerable code.\nAC:L - On affected 32-bit `size_t` kernel builds, an attacker fully controls `num_queues` in the ioctl and can reliably force the multiply overflow (e.g. `num_queues >= 0x40000001`) to trigger undersized `memdup_user()` followed by unbounded kernel heap corruption.\nPR:L - A local unprivileged user with AMDGPU/KFD device access can open `/dev/kfd`, enable the debug runtime and debug trap on their own process (no ptrace or root required), then invoke suspend/resume with a malicious `num_queues` value.\nUI:N - Exploitation is achieved entirely through attacker-initiated ioctl calls in an established KFD debug session; no victim interaction is required.\nS:U - Impact is kernel heap corruption and potential local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - The integer overflow causes a heap buffer far smaller than `num_queues`, and subsequent `q_array_get_index()`/`copy_to_user()` operations perform out-of-bounds kernel reads that can disclose adjacent heap memory and be leveraged for arbitrary read primitives.\nI:H - `q_array_invalidate()` and per-queue status updates write attacker-influenced values (`KFD_DBG_QUEUE_INVALID_MASK`/`KFD_DBG_QUEUE_ERROR_MASK`) far beyond the allocated buffer, constituting an out-of-bounds heap write exploitable for control-flow hijacking and arbitrary kernel modification.\nA:H - Writing billions of 32-bit values past a 4-byte kmalloc object corrupts adjacent kernel heap metadata and objects, readily causing kernel oops/panic and complete loss of availability even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63881","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63886","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered by a remote iSCSI initiator sending crafted CHAP login PDUs over TCP to the in-kernel LIO iSCSI target during the network login/authentication handshake.\nAC:L - Once an iSCSI target with CHAP is reachable, an attacker can reliably trigger the overflow by sending CHAP_R with a 0b-prefixed base64 string up to 127 characters; no race or special memory layout is required.\nPR:N - The heap overflow occurs during the CHAP authentication handshake before the password hash comparison succeeds, so exploitation is reachable by an unauthenticated remote network attacker who knows a configured CHAP username.\nUI:N - Exploitation requires only the attacker initiating an iSCSI login connection and sending malicious CHAP PDUs; no action from a victim user is needed.\nS:U - Successful exploitation corrupts kernel heap memory within the same kernel security boundary, enabling denial of service or kernel privilege escalation, not a cross-boundary escape such as VM guest-to-host.\nC:H - The out-of-bounds heap write corrupts adjacent kmalloc objects and can be leveraged for arbitrary kernel memory disclosure through heap grooming, consistent with heap overflow impact guidance.\nI:H - A controlled kernel heap out-of-bounds write of up to 79 bytes past a digest-sized buffer can corrupt adjacent structures and be developed into arbitrary code execution or kernel privilege escalation.\nA:H - The overflow causes slab-out-of-bounds writes confirmed by KASAN and can crash or destabilize the kernel during login processing, constituting high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63886","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63887","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The Linux iSCSI target (LIO) is an in-kernel SCSI target that accepts remote TCP connections on the iSCSI portal (typically port 3260); crafted Login PDUs reach the vulnerable encoder via the normal network receive and login-negotiation path.\nAC:L - Once an iSCSI target portal is reachable, an attacker can reliably trigger the overflow by sending a single Login PDU packed with unknown key=value pairs; no races or victim-dependent timing are required.\nPR:N - The heap overflow occurs during login negotiation before iSCSI authentication completes; a discovery-session login requires only InitiatorName and SessionType with no credentials, initiator ACL, or local privileges.\nUI:N - Exploitation requires only network packets sent by the attacker; no action from a legitimate user or administrator is needed beyond the target already exposing its iSCSI portal.\nS:U - The corruption is confined to kernel heap memory in the iSCSI target/login context and does not cross a VM, container, or IOMMU security boundary by itself.\nC:H - A ~24 KiB out-of-bounds write into the kmalloc-8k slab can corrupt adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - The unbounded sprintf heap overrun is a large out-of-bounds write that can corrupt adjacent heap metadata or objects to achieve arbitrary kernel memory modification and potential code execution.\nA:H - Corrupting kmalloc-8k heap objects during login response encoding can cause kernel oops, BUG, or panic, and the attack can be repeated against an exposed iSCSI target."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63887","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63888","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the in-kernel LIO iSCSI target, reachable by sending iSCSI Text PDUs over TCP after connection setup on the network-facing iSCSI portal (typically port 3260), analogous to nfsd/ksmbd network exposure.\nAC:L - An attacker fully controls login parameter negotiation (DataDigest=CRC32C) and subsequent Text PDU content; the CRC overread fires deterministically on every qualifying Text PDU, and the double-free is reliably triggered by sending a bad DataDigest followed by another Text PDU on the same ITT when ERL>0.\nPR:N - No Linux OS privileges are required; the default discovery session permits unauthenticated login (AuthMethod=None, authentication disabled), after which SendTargets Text requests reach the vulnerable handler without any credentials.\nUI:N - Exploitation requires only crafted iSCSI protocol traffic from the attacker; no victim user action such as mounting a filesystem or clicking a link is needed.\nS:U - The vulnerability corrupts kernel heap memory within the iSCSI target subsystem on the host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The CRC path performs a slab out-of-bounds read past the text_in allocation, and the double-free is a use-after-free class bug that reads freed heap metadata; per kernel guidance both OOB reads and UAFs warrant High confidentiality impact.\nI:H - The double-free corrupts the slab freelist (triggering CONFIG_SLAB_FREELIST_HARDENED BUG() on hardened kernels), providing a classic heap corruption primitive that can be leveraged for arbitrary kernel memory writes and code execution.\nA:H - The double-free provably crashes the kernel (KASAN splat or SLAB_FREELIST_HARDENED BUG()), and the heap corruption can cause kernel panics; any UAF is scored as High availability impact per kernel guidance."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63888","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63920","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (nftables netlink to install a payload-set rule, setsockopt for IPV6_RECV* options, and recvmsg). Although the trigger packet is received over IPv6, the mandatory nftables corruption step is classified as Local per kernel guidance.\nAC:L - The attacker fully controls the nftables payload-set rule, the on-wire extension header, socket receive options, and the recvmsg call, making the slab out-of-bounds read reliably reproducible without races or external conditions.\nPR:L - An unprivileged local user can create a user+network namespace, obtain CAP_NET_ADMIN there, configure nftables, open a UDPv6/raw socket with extension-header cmsg options, and trigger the bug without real root in the initial namespace.\nUI:N - No victim interaction is required; the attacker can send the crafted IPv6 datagram and call recvmsg on their own socket to trigger the out-of-bounds read.\nS:U - Impact is confined to kernel memory disclosure and potential kernel instability within the same kernel security domain; it does not cross a VM/host or IOMMU boundary.\nC:H - put_cmsg() can copy up to 2040 bytes past the actual extension header into userspace ancillary data, leaking adjacent slab/kernel memory (confirmed by KASAN slab-out-of-bounds in put_cmsg).\nI:N - The bug is an out-of-bounds read that copies kernel data to userspace; it does not modify kernel memory, corrupt control structures, or provide a write primitive.\nA:H - The out-of-bounds slab read can provoke a KASAN fault/kernel oops during put_cmsg(), and repeated triggering can deny availability of the affected system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63920","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63944","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the Bluetooth HCI ISO/CIS path (`hci_le_create_cis_sync`), reachable only via the Bluetooth radio interface. Per kernel CVSS guidance, Bluetooth vulnerabilities are scored as Adjacent, including on phones and LE Audio devices in public spaces.\nAC:L - The UAF is a race between `hci_le_create_cis_sync` dropping locks and a concurrent `hci_conn_del`. An attacker who controls one side of the CIS setup (local ISO socket threads or a remote peer timing ACL/CIS teardown) can repeatedly trigger the race; success does not depend on uncontrollable conditions like kernel memory layout.\nPR:N - No local Unix privileges are required for the highest-impact scenario: a remote Bluetooth peer in range can provoke CIS teardown/disconnect events while the victim host is performing normal LE Audio CIS establishment (e.g., phone connecting to earbuds). Local exploitation via ISO sockets also requires no special capabilities at the kernel level.\nUI:N - Both sides of the race run inside the kernel's own HCI event handling: hci_le_create_cis_pending() queues the vulnerable work from hci_le_cis_established_evt(), hci_cs_le_create_cis(), hci_unbound_cis_failed() and iso_connect_cfm(), all driven by controller events and remote peer traffic, while the freeing side is a peer-initiated disconnect reaching hci_conn_del(). On an LE Audio host the CIS establishment happens by itself when the earbuds connect and the attacker supplies the disconnect, so nothing is asked of the person holding the device; the existing pairing is a precondition of the deployment, not an in-attack user step.\nS:U - Impact is confined to kernel memory corruption within the Bluetooth subsystem on the host; this is standard kernel compromise, not a cross-boundary escape (KVM guest-to-host, IOMMU bypass, or sandbox breakout).\nC:H - This is a slab use-after-free read of `conn->conn_timeout` on a freed `hci_conn` (kmalloc-8k object). UAF reads against attacker-influencable freed objects can disclose kernel heap contents and are scored as High per kernel CVSS guidance.\nI:H - Although the immediate bug is a post-unlock dereference of a freed `hci_conn`, UAF on large `hci_conn` kmalloc objects enables heap grooming and control of freed memory contents, which can be chained into arbitrary kernel writes or code execution; UAF class bugs are scored I:H.\nA:H - Use-after-free access to a freed connection object can cause kernel oops/panic (as demonstrated by the same bug class in the related `le_read_features_complete` fix found by syzkaller). Even without full exploitation, triggering the UAF reliably causes High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63944","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63970","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local AF_VSOCK transmission (syscall/io_uring send on a connected virtio vsock socket), not by processing remote network packets. Per kernel CVSS guidance, vsock is Local.\nAC:L - An attacker fully controls the trigger: SO_ZEROCOPY, io_uring IORING_OP_SEND_ZC with IORING_RECVSEND_FIXED_BUF and a vectored iov exceeding MAX_SKB_FRAGS (17), causing io_sg_from_iter() to return -EMSGSIZE on a deterministic error rollback path.\nPR:L - Exploitation requires only an unprivileged local process that can open a vsock connection and use io_uring zerocopy send; no CAP_NET_ADMIN or real root is needed beyond ordinary local user access in a virtio-vsock environment (KVM/Firecracker/cloud microVMs).\nUI:N - No victim interaction is required; the attacker triggers the bug directly through their own socket send/io_uring operation.\nS:U - Impact is kernel memory corruption and privilege escalation within the same security domain where the send occurs (guest kernel or host kernel). It is not a cross-boundary VM escape on the receive path; the flaw is in the sender's local skb teardown.\nC:H - Incorrect __skb_frag_unref() on SKBFL_MANAGED_FRAG_REFS pages without a bound uarg corrupts refcount/lifetime of io_uring registered buffer pages, yielding use-after-free and arbitrary kernel memory read primitives.\nI:H - The refcount corruption is a memory-safety bug in kernel heap/page management that can be leveraged for arbitrary write and control-flow hijacking, not merely a bounded data change.\nA:H - The erroneous frag unref on managed zerocopy pages can cause immediate kernel oops/panic from refcount underflow or use-after-free during skb teardown, independent of full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63970","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63992","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code runs on the VXLAN/GENEVE transmit path when processing remotely received UDP-encapsulated tunnel traffic (or L2 frames forwarded through a bridge port), which is reachable by sending crafted packets over the network to the victim VTEP.\nAC:L - The attacker fully controls the inner IPv4 header fields (DF bit, length, addresses) and can reliably craft oversized packets that exceed the tunnel-adjusted PMTU on bridge-port tunnel devices without depending on race timing or uncontrollable system state.\nPR:N - Exploitation requires only the ability to send network packets to a host with VXLAN/GENEVE bridged; no local account, authentication, or capabilities on the victim are needed.\nUI:N - No victim user action is required; the kernel processes attacker-supplied packets automatically through the tunnel receive, bridge forward, and re-encapsulation path.\nS:U - The out-of-bounds read and resulting kernel oops occur within the kernel network stack on the same host; there is no crossing of a VM, container, or IOMMU security boundary beyond standard kernel memory safety failure.\nC:H - Reading through `icmp_hdr(skb)` when `transport_header` is unset causes an out-of-bounds read at `skb->head + 65535`, potentially disclosing adjacent kernel memory beyond the skb buffer before any bounds checking occurs.\nI:N - The flaw is an out-of-bounds read of the ICMP type field; it does not directly modify or write kernel memory, though it may cause a kernel fault.\nA:H - The invalid pointer dereference at offset 65535 can trigger a kernel oops or panic when accessing unmapped memory, causing denial of service on the affected host."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63992","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64000","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code is reached when the kernel processes received Ethernet frames via the netdev RX handler in net/hsr, and a remote attacker on the HSR/PRP ring can deliver a crafted supervision frame without any local access to the victim host.\nAC:L - The attacker fully controls the malformed frame content and length; a precisely truncated supervision frame reliably passes existing TLV validation and triggers the out-of-bounds read with no races or attacker-uncontrollable conditions.\nPR:N - Exploitation requires only the ability to inject L2 HSR/PRP supervision frames onto the ring segment; no local account, capabilities, or authentication on the target kernel is needed.\nUI:N - No victim user action is required beyond normal operation of an HSR/PRP-configured node; the attacker triggers the bug solely by sending a malicious frame.\nS:U - Impact is confined to kernel memory safety within the same security authority; there is no VM escape, IOMMU bypass, or cross-security-boundary scope change.\nC:H - The bug is an out-of-bounds read of supervision TLV header fields past the skb tail, which can disclose adjacent kernel heap/skb memory and is not strictly bounded to a few attacker-uncontrolled bytes.\nI:H - Out-of-bounds access in kernel packet parsing can supply attacker-influenced TLV type/length values that drive further skb_pull arithmetic and extended parsing, creating a plausible path to memory corruption and control-flow hijacking.\nA:H - Reading beyond the skb buffer boundary during softirq packet processing can cause a kernel oops/panic, and the attacker can repeatedly trigger the condition with crafted frames."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64000","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64002","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls—network namespace teardown via unshare/setns/put_net, sysctl access to /proc/sys/net/ipv4/ip_local_reserved_ports, and/or local socket bind/connect—not remote packet delivery.\nAC:L - The attacker can control both sides of the race by concurrently tearing down a network namespace while hammering the sysctl or triggering socket port selection in that namespace.\nPR:L - An unprivileged local user can reach this via user namespaces (CAP_SYS_ADMIN within the user_ns for CLONE_NEWNET) and world-writable sysctl access (mode 0644) during namespace destruction.\nUI:N - No victim interaction is required beyond the attacker's own concurrent namespace teardown and sysctl or socket activity.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it is standard local kernel memory corruption, not a VM/hypervisor boundary escape.\nC:H - Freed 8 KiB bitmap memory remains reachable via sysctl reads (find_next_bit) and inet_is_local_reserved_port() (test_bit), enabling heap information disclosure through a use-after-free.\nI:H - Sysctl writes via proc_do_large_bitmap perform bitmap_copy/bitmap_or into the freed allocation, providing a heap write primitive exploitable for control-flow hijacking.\nA:H - Concurrent access to the freed bitmap can cause kernel oops/panic from invalid memory access, and UAF exploitation inherently threatens kernel availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64002","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64007","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered when remote TCP packets traverse SYNPROXY netfilter hooks (NF_INET_LOCAL_IN / NF_INET_POST_ROUTING) on a host with SYNPROXY configured, which is the standard internet-facing firewall/router deployment for this subsystem.\nAC:L - An attacker who controls a TCP session through SYNPROXY can reliably send timestamp-bearing packets to hit the vulnerable path; the stale-pointer UAF write occurs whenever skb_ensure_writable() must expand a cloned skb, which the attacker can influence by sustaining traffic on the proxied connection.\nPR:N - Exploitation requires only that the victim already runs SYNPROXY (normal for protected services); the remote attacker needs no credentials or local privileges on the target system to send the triggering TCP packets.\nUI:N - No victim user action is required beyond normal network operation; exploitation is fully automated via crafted or sustained TCP traffic through the SYNPROXY session.\nS:U - Impact is confined to kernel memory on the affected host running SYNPROXY; this is standard kernel privilege escalation/memory corruption, not a cross-VM or cross-security-boundary escape.\nC:H - The stale tcphdr pointer causes inet_proto_csum_replace4() to write into freed slab memory, a use-after-free class bug that can be leveraged for arbitrary kernel memory read via heap grooming techniques.\nI:H - The out-of-bounds write into freed slab memory via a stale tcphdr pointer is a use-after-free write primitive that can be developed into arbitrary kernel memory writes and local privilege escalation.\nA:H - Writing into freed slab memory can corrupt adjacent kernel objects and cause kernel oops, panic, or crash, and UAF conditions are inherently capable of destabilizing the system even during exploitation attempts."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64007","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64015","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through find_key_to_update() on the persistent keyring register, which is invoked from keyctl_get_persistent() via the keyctl(2) syscall. There is no network, adjacent-radio, or physical-device path to this code.\nAC:L - Exploitation is a race between assoc_array_find() and assoc_array_gc() on the .persistent_register keyring; the attacker controls both sides by repeatedly calling KEYCTL_GET_PERSISTENT (including from multiple threads) while driving key expiry/GC via keyctl timeouts or natural garbage collection. Per kernel guidance, attacker-controlled races are AC:L.\nPR:L - Any unprivileged local user who can invoke keyctl() can call KEYCTL_GET_PERSISTENT for their own UID (-1) with a writable destination keyring (e.g., session keyring). No real-root or CAP_SETUID capability is required for the vulnerable lookup path; this remains PR:L even inside user namespaces.\nUI:N - Exploitation requires only the attacker's own keyctl syscalls and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary on its own.\nC:H - assoc_array_find() is documented to require an RCU read lock, but the persistent-keyring path called it without one while assoc_array_gc() frees tree nodes via call_rcu(), yielding a use-after-free on assoc_array nodes/leaves. UAF on kernel heap objects can be turned into arbitrary kernel memory reads.\nI:H - The freed assoc_array nodes can be reallocated and corrupted through concurrent GC versus lookup, providing a standard kernel heap UAF primitive that can be developed into arbitrary write or code-execution primitives.\nA:H - Dereferencing RCU-freed assoc_array tree nodes during lookup can cause kernel oops/panic from invalid pointer access, and UAF exploitation commonly destabilizes or crashes the kernel even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64015","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64018","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached via MSI-driven hardware completion processing in the MANA HWC control path (not netdev packet receive), triggered when the Azure hypervisor/host tampers with guest-visible DMA-coherent WQE memory on the same physical compute node.\nAC:L - A malicious host or NIC firmware that can modify shared unencrypted DMA buffers controls both the forged sge->address and the timing of HWC RX completions, allowing reliable out-of-bounds indexing without winning a race or depending on guest state.\nPR:N - Exploitation requires no privileges on the victim guest VM; the attacker operates from the Azure hypervisor/host side by modifying DMA-coherent memory that the guest kernel trusts during HWC response handling.\nUI:N - No victim user action is required; exploitation occurs automatically when the driver processes a hardware completion event on the HWC receive queue.\nS:C - In Confidential VMs the guest relies on host isolation guarantees, but shared unencrypted DMA memory lets a hostile hypervisor cross that CVM security boundary to corrupt guest kernel memory and confidentiality.\nC:H - An out-of-bounds rx_req_idx yields a corrupted hwc_work_request whose buf_va is dereferenced and copied via memcpy in mana_hwc_handle_resp(), enabling arbitrary kernel memory disclosure.\nI:H - The out-of-bounds hwc_work_request supplies attacker-controlled pointers and SGE fields used to repost RX WQEs via mana_hwc_post_rx_wqe(), enabling kernel heap corruption and exploitable memory writes.\nA:H - Indexing reqs[] out of bounds with attacker-controlled values can dereference invalid kernel pointers and corrupt adjacent heap objects, causing kernel oops/panic and denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64018","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64029","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access via the ALSA sequencer device node (/dev/snd/seq) using write(2) and port-subscription ioctls; there is no network, Bluetooth, or physical-device attack surface on the vulnerable code path.\nAC:L - The race is between concurrent UMP event delivery and the last output-port unsubscribe/close path, and a local attacker can control both sides with parallel threads (flood write() while repeatedly subscribing/unsubscribing to the UMP port).\nPR:L - Any local unprivileged user who can open /dev/snd/seq (typically membership in the audio group on desktop/workstation systems where UMP MIDI hardware is present) can create sequencer clients, subscribe to UMP kernel ports, and trigger the bug without real root or init-namespace capabilities.\nUI:N - Exploitation is fully attacker-driven through sequencer writes and subscription management; no victim interaction such as opening files, mounting filesystems, or plugging in devices is required beyond the UMP endpoint already being present on the system.\nS:U - Impact is confined to kernel memory corruption and potential local privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary bypass.\nC:H - KASAN confirmed a slab use-after-free on freed substream runtime metadata in snd_rawmidi_kernel_write1(); UAF on kernel heap objects enables controlled reallocation and arbitrary kernel memory disclosure primitives.\nI:H - The UAF occurs inside snd_rawmidi_kernel_write1(), which performs memcpy() into runtime->buffer using attacker-supplied UMP event payload, providing a plausible path to arbitrary kernel memory corruption and code execution beyond a simple crash.\nA:H - The confirmed KASAN slab-use-after-free in kernel write path causes kernel oops/panic; even without full exploitation, the bug reliably threatens system availability through kernel crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64029","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64034","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a malicious hypervisor or host that can modify MANA HWC DMA-coherent response buffers between guest kernel loads; it is not reachable by sending network packets to the guest's data path.\nAC:L - The attacker controlling the hypervisor fully controls DMA buffer contents and can reliably flip hwc_msg_id between the validation read and the use in mana_hwc_handle_resp() on uncacheable coherent memory.\nPR:N - The attacking hypervisor needs no guest OS credentials or capabilities; exploitation targets the guest kernel through the virtual device DMA path while the MANA driver is active.\nUI:N - No victim user action is required beyond normal Azure VM operation with the MANA driver loaded and HWC receive buffers posted.\nS:C - The vulnerability crosses the VM/DMA security boundary by allowing a hostile hypervisor to corrupt guest kernel memory that the confidential-guest threat model assumes is protected from host tampering.\nC:H - Out-of-bounds indexing via bypassed hwc_msg_id validation enables reading adjacent kernel heap objects through misdirected caller_ctx access and test_bit() on the inflight bitmap.\nI:H - Host-controlled response data is copied with memcpy() to an out-of-bounds output_buf pointer, enabling arbitrary kernel memory corruption and potential control-flow hijacking.\nA:H - Out-of-bounds caller_ctx access and corrupted completion signaling can cause kernel oops, panic, or hang during HWC response handling."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64034","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64048","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The fault is triggered while processing a malicious CLC ACCEPT message received from a remote TCP peer during the SMC-D handshake; the attacker controls the server response over the network.\nAC:L - Once a victim with SMC-Dv2 hardware initiates an SMC connection, a malicious peer can reliably send `d1.chid == 0` in the CLC ACCEPT to match the empty reserved slot 0 without races or special timing.\nPR:N - No local privileges are required on the victim host; an unauthenticated remote attacker operating a malicious SMC server can crash connecting clients, and unprivileged users can create SMC sockets without capability checks.\nUI:N - Exploitation requires only that a victim application initiate a normal outbound SMC connection to the attacker's server, which occurs automatically in enterprise middleware without per-connection user action.\nS:U - The vulnerability causes a kernel crash on the victim host but does not cross a security boundary such as VM escape or sandbox breakout.\nC:N - The bug is a null pointer dereference when taking `ism_dev[0]->lgr_lock`; it causes an immediate kernel fault with no information disclosure.\nI:N - The attempted write at address 0x68 is a spinlock operation on a NULL `smcd_dev` pointer, not a controlled or arbitrary memory modification primitive.\nA:H - A successful trigger causes a kernel null pointer dereference (KASAN-reported oops/panic), crashing the affected system or at minimum the connecting process's kernel context."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64048","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64098","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through local DRM ioctl syscalls (DRM_IOCTL_MODE_CURSOR and DRM_MASTER modesetting ioctls) on /dev/dri/card0, not via any network-facing kernel service.\nAC:L - An attacker can reliably trigger the bug by signaling a thread blocked in dma_resv_lock_interruptible (-EINTR), forcing memory pressure for -ENOMEM, or running concurrent plane updates to race the unlocked fence-list mutation.\nPR:L - Exploitation requires DRM master on the virtio-gpu device, which a local user with standard DRI access (video/render group membership on typical virtio-gpu VMs) can obtain when no compositor holds master; this is not init-namespace root.\nUI:N - Triggering the bug requires only attacker-initiated DRM ioctl calls (cursor/plane updates); no action by another user or victim is needed.\nS:U - The corruption occurs within the same kernel security domain (guest or host) that issued the ioctl; virtio-gpu runs in the guest kernel and this does not cross a VM/hypervisor boundary to the host.\nC:H - Mutating the dma_resv fence list without holding the lock races with concurrent readers and can corrupt kernel heap metadata, which is reasonably leverageable for arbitrary memory disclosure.\nI:H - The same unlocked fence-list corruption can corrupt kernel pointers and synchronization state, providing a plausible path to arbitrary kernel writes or control-flow hijacking.\nA:H - The bug produces kernel WARN/oops under lockdep and fence-list corruption can cause kernel crashes, hangs, or panics during subsequent dma_resv operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64098","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64109","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local syscalls on AF_UNIX SOCK_STREAM sockets (recvmsg, splice_read, setsockopt SO_PEEK_OFF), not via any network protocol handler.\nAC:L - The attacker controls both racing threads on the same socket fd and can retry the peek/normal-recv interleaving; this is a self-induced race, not one dependent on uncontrollable kernel state.\nPR:L - Any unprivileged local user can create AF_UNIX socketpairs, set SO_PEEK_OFF, and run concurrent recv operations without capabilities, including from within user namespaces.\nUI:N - Exploitation requires no victim interaction; the attacker sets up and races their own socket endpoints programmatically.\nS:C - Successful kernel heap UAF exploitation from an unprivileged container, Android app sandbox, or user-namespace tenant crosses the sandbox boundary to compromise the host kernel.\nC:H - This is a slab use-after-free read of sk_buff->len on freed memory, which per UAF guidance enables arbitrary kernel memory disclosure and heap layout leaks.\nI:H - UAF on sk_buff objects in the kernel heap can be leveraged through heap grooming and spraying to obtain arbitrary write and kernel code execution primitives.\nA:H - The UAF read can trigger KASAN slab-use-after-free faults, kernel oops, or panic during the dereference, and repeated triggering causes denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64109","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64114","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (socket/sendmsg on a raw IP_HDRINCL socket); malformed packets are injected locally into the output path, not via remote network ingress which validates ihl >= 5.\nAC:L - The attacker fully controls the crafted header ihl value and can install the required xfrm AH policy and route via CAP_NET_ADMIN in their own network namespace, making exploitation reliable without conditions outside attacker control.\nPR:L - Triggering requires CAP_NET_RAW for raw sockets and CAP_NET_ADMIN to install xfrm AH policy, both obtainable by an unprivileged user via user+network namespaces or a container granted NET_ADMIN without init-namespace root.\nUI:N - No victim interaction is required; the attacker sends the malformed packet directly through their own raw socket and configured IPsec policy.\nS:U - Impact is kernel memory corruption and panic within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The integer underflow in ah_output() memcpy length produces an out-of-bounds read of near SIZE_MAX bytes, providing an arbitrary kernel memory read primitive beyond any bounded disclosure.\nI:H - The same memcpy with underflowed length causes a massive out-of-bounds write that can corrupt adjacent kernel heap memory and be leveraged for control-flow hijacking.\nA:H - The OOB memcpy reliably causes a kernel-mode fault and host panic, as reproduced with KASAN and in a rootless Docker container, denying all system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64114","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64115","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local AF_VSOCK syscalls (connect/close) to drive VMCI control packets; per kernel CVSS guidance, vsock is scored Local even when the peer is a VM guest reaching a host listener.\nAC:L - The attacker controls both sides of the handshake race by initiating a connection and aborting it with RST during TCP_SYN_SENT; KASAN testing showed 52/100 repro without conditions outside attacker control.\nPR:L - Any unprivileged local user inside a VM (or on the same host) can open AF_VSOCK sockets and connect to a listening peer without CAP_NET_ADMIN or other elevated privileges.\nUI:N - Exploitation requires only a victim service with a bound/listening vsock socket, which is normal background operation; no interactive victim action is needed.\nS:C - In the most severe reasonable VMware deployment, an unprivileged guest VM triggers kernel memory corruption on the hypervisor host via VMCI vsock, crossing the guest-to-host virtualisation security boundary analogous to KVM/Xen VM escape.\nC:H - The bug is a slab use-after-free on struct sock; UAF on kernel heap objects enables arbitrary memory read primitives through controlled reuse of the freed socket structure.\nI:H - The UAF involves a write to a freed object's refcount field and corrupts kernel heap metadata, providing a foundation for arbitrary write and kernel code execution via heap grooming.\nA:H - The vulnerability reliably triggers kernel UAF detected by KASAN (refcount write to freed memory on a kworker), which causes kernel oops/panic and denial of host availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64115","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64247","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggering requires a Hyper-V TLB-flush hypercall from an L2 vCPU under KVM, ultimately reached through the local KVM_RUN ioctl; no network path reaches it.\nAC:L - A malicious nested-virtualization tenant controls both the unchecked enlightened-VMCS/VMCB VP ID and the sparse-bank hypercall data, with no uncontrollable race required.\nPR:L - The attacker needs control of a KVM guest with nested virtualization, or ordinary /dev/kvm access to create one, but requires neither host root nor an init-namespace capability.\nUI:N - Once the crafted nested guest executes, no action by another user is required.\nS:C - The out-of-bounds access occurs in the host kernel from attacker-controlled guest state, crossing the KVM guest-to-host isolation boundary.\nC:H - The attacker-selected VP ID makes test_bit() query selectable bits far beyond the stack-resident 64-bit mask, and the resulting TLB-flush decision can provide an oracle for host kernel memory.\nI:N - The primitive performs reads only; a set result merely selects a legitimate L2 vCPU for an extra TLB flush, with no out-of-bounds write or unsafe mapping change.\nA:H - The selectable access can reach a VMAP_STACK guard or another unmapped page and oops the host; KASAN already detects the access as an eight-byte invalid read, which can become a host-wide denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64247","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64266","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - A local attacker reaches the flaw by serving a self-created FUSE mount and invoking splice() on its associated /dev/fuse descriptor.\nAC:L - The attacker controls writeback generation, splice processing, and concurrent connection abort, allowing repeated attempts at the race without an uncontrollable prerequisite.\nPR:L - FUSE supports user-namespace mounts, and an unprivileged mount owner can operate /dev/fuse and abort their own connection without init-namespace root.\nUI:N - The attacker can create and exercise their own FUSE connection without any victim action.\nS:U - Exploitation compromises the kernel within the same operating-system security authority and does not inherently cross a virtualization boundary.\nC:H - The freed argument and folio arrays are subsequently dereferenced, permitting attacker-influenced stale folio pointers and potential arbitrary kernel-memory disclosure through pipe buffers.\nI:H - Heap reclamation can replace the freed folio pointers and loop metadata, enabling attacker-directed memory or refcount operations that may support arbitrary writes and kernel code execution.\nA:H - The repeatable use-after-free and invalid folio operations can cause an oops, panic, or other complete system failure."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64266","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64268","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - siw carries iWARP over ordinary routable TCP, and the vulnerable receive callback processes crafted Read Response FPDUs from the remote endpoint of an established RDMA connection.\nAC:L - The peer learns the sink tag, address, and length from the RREAD and can deterministically send oversized continuation segments; no race or uncontrollable condition is required.\nPR:N - The MPA/siw data path performs no credential or capability check on the connected peer, and an unauthenticated RDMA service can accept the connection and issue attacker-induced RREADs.\nUI:N - The overflow is triggered through an automated RDMA protocol exchange and requires no human action.\nS:U - The corruption compromises resources within the affected host's kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The global DMA/KVA sink case exposes the sink address and permits attacker-controlled kernel memory corruption, which can enable control-flow hijacking and arbitrary kernel-memory disclosure.\nI:H - Attacker-chosen response bytes are written beyond the validated sink into adjacent kernel memory, providing an exploitable out-of-bounds write capable of modifying objects or achieving kernel code execution.\nA:H - The overwrite can corrupt critical kernel objects or reach invalid memory, causing an oops or panic; bounded FRWR sinks still permit connection-terminating denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64268","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64304","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An unprivileged local process can add a crafted PKCS#8 RSA private key to its own keyring and invoke KEYCTL_PKEY_QUERY, which selects qat-rsa and reaches the vulnerable key setup path.\nAC:L - With an active QAT asymmetric service and PKCS#8 parser, an oversized CRT integer deterministically causes unsigned offset underflow and an out-of-bounds memcpy. No race or attacker-uncontrollable condition is required.\nPR:L - An ordinary user can create, search, and use keys in a personal process, thread, or session keyring. No capability, administrator privilege, or user namespace is required.\nUI:N - The attacker directly performs the add_key and keyctl system calls without any victim action.\nS:U - The vulnerable QAT driver and the corrupted kernel resources share the same security authority. Ordinary kernel privilege escalation does not cross a CVSS scope boundary.\nC:H - The controlled kernel-memory overwrite can corrupt page tables, credentials, or control-flow objects and plausibly yield code execution with access to protected kernel memory.\nI:H - Attacker-controlled CRT bytes are written outside the coherent DMA allocation, potentially through multiple CRT components. This can provide powerful kernel-memory corruption and control-flow hijacking primitives.\nA:H - The invalid destination can cause an immediate kernel fault or corrupt unrelated kernel memory and subsequently panic or hang the system. The attack is repeatable."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64304","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64312","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - pcrypt is designed for network-facing IPsec use, and an inbound ESP packet can traverse xfrm_input(), esp_input(), crypto_aead_decrypt(), and pcrypt_aead_decrypt().\nAC:L - In load-responsive CPU-hotplug deployments, an attacker can flood qualifying ESP requests across repeated PADATA_RESET windows without precise timing or an uncontrollable memory-layout condition.\nPR:N - The ESP SPI is transmitted in clear, and the faulty path is reached before the child AEAD validates the integrity tag, so an unauthenticated on-path attacker needs no target-system privileges.\nUI:N - Packet delivery and asynchronous completion require no victim action.\nS:U - The failure affects the same kernel security authority processing the request and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The rejected request retains a zero padata->pd pointer, producing a NULL dereference without an out-of-bounds read or information disclosure.\nI:N - The callback writes only the completion status into its valid request context before dereferencing NULL; it provides no attacker-directed corruption or write primitive.\nA:H - padata_do_serial() dereferences the uninitialized padata->pd pointer, causing a kernel oops or panic that can terminate the system and can be retriggered."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64312","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64355","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A remote peer can send an oversized packet that a fragment-capable NIC represents as a multi-buffer XDP frame, reaching the vulnerable devmap broadcast clone path on a configured forwarding host.\nAC:L - No race or uncontrollable timing condition is required; fragmented packets reliably enter the faulty clone path and can be sent repeatedly.\nPR:N - Although initial-namespace CAP_BPF and CAP_NET_ADMIN are needed to configure the XDP deployment, the attacker sending packets through the already-configured unauthenticated data path needs no privileges.\nUI:N - Packet reception and XDP processing occur automatically without victim action.\nS:U - The corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other distinct boundary.\nC:H - Uninitialized fragment descriptors are consumed as page references and can be used by scatter-gather transmitters for unintended DMA mappings, potentially exposing arbitrary kernel memory.\nI:H - An uninitialized fragment count can overrun fixed-size driver arrays, while bogus page references can cause invalid refcount decrements, premature frees, and exploitable kernel memory corruption.\nA:H - Invalid fragment metadata can fault during DMA mapping, transmission, or frame return and cause a kernel oops or panic; an attacker can trigger this repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64355","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64383","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB server can trigger the flaw through crafted replayable responses and connection failures over the network.\nAC:L - The server controls both the replayable error and subsequent reconnect failure, allowing repeated triggering without an uncontrollable race.\nPR:N - The attacking SMB endpoint requires no privileges on the client system once an SMB session and file handle exist.\nUI:N - An automatically mounted share and routine service-generated fsync, truncate, timestamp, or seek operations can reach SMB2_flush() without human participation.\nS:U - The memory corruption compromises resources governed by the same host kernel security authority.\nC:H - The response-buffer double-free can create overlapping CIFS slab allocations and use-after-free primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and attacker-influenced overlapping network buffers can provide arbitrary-write or control-flow-hijacking primitives.\nA:H - The double-free can immediately trigger an allocator BUG, kernel oops, or panic and can be invoked repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64383","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64384","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious SMB server can return a replayable response and then force reconnect failure over the network, causing the client to free stale response state twice.\nAC:L - The peer controls both prerequisites by returning a status such as STATUS_RETRY and then disconnecting or refusing reconnection; repeated attempts make the scheduling window attacker-controllable.\nPR:N - The malicious SMB peer requires no account, capability, or other privilege on the vulnerable client; the established client session does not grant the attacker privileges on that host.\nUI:N - An ordinary automated CIFS workload can maintain an outstanding change-notify request, after which the remote peer completes the trigger without human involvement.\nS:U - Exploitation compromises the kernel and resources governed by the same host security authority, without crossing a separate virtualization or sandbox boundary.\nC:H - The double-free corrupts the CIFS response-buffer slab or mempool, permitting overlapping live objects and freelist manipulation that can support disclosure of arbitrary kernel memory.\nI:H - The heap corruption can provide attacker-influenced writes through aliased request and response buffers or freelist poisoning, potentially enabling kernel control-flow hijacking.\nA:H - Hardened allocators can immediately panic on the consecutive double-free, while unhardened allocators can crash later through freelist corruption."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64384","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64385","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - An attacker-controlled SMB server can deliver crafted SMB2 IOCTL responses over TCP, including through the kernel's periodic interface-query FSCTL on an existing SMB3 mount.\nAC:L - On a hard or retrans-enabled mount, the server controls replayable statuses, response contents, disconnects, reconnects, and repeated attempts, allowing it to drive both sides of the triggering sequence.\nPR:N - The malicious SMB server needs no account or privilege on the target; victim mounting authority and client authentication do not grant or require attacker-side target privileges.\nUI:N - Once the share is mounted, kernel delayed work can automatically issue the affected FSCTL when the server advertises multichannel support, requiring no user action during exploitation.\nS:U - The memory corruption compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, container, or IOMMU boundary.\nC:H - The response-buffer double-free can corrupt SLUB or mempool state and create dangling or overlapping live buffers, enabling use-after-free exploitation and kernel-memory disclosure.\nI:H - Attacker-controlled network data can overwrite aliased or freed buffers and poison allocator state, supporting arbitrary writes and control-flow hijacking.\nA:H - The duplicate free can trigger an allocator BUG or corrupt kernel heap state, causing an oops, panic, or complete system crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64385","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64386","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised SMB2/3 server can remotely return a response-bearing replayable error and manipulate the subsequent connection state, reaching the vulnerable client over TCP.\nAC:L - The server controls the error response, disconnect, and reconnection sequence and can repeat it until the stale free occurs. Replay-enabled hard or retrans-configured SMB mounts are a reasonable deployment.\nPR:N - The malicious SMB peer needs no privileges or credentials on the client; SMB session setup authenticates the client to the server, not the attacker to the victim kernel.\nUI:N - Once the share is mounted, ordinary or automated file and metadata operations issue query-info requests, and exploitation requires no human action during the crafted response and reconnect sequence.\nS:U - The corruption and resulting impacts occur within the same Linux kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:H - The double-free corrupts SMB response-buffer slab and mempool state, enabling aliased or use-after-free buffers that can be leveraged to expose kernel memory.\nI:H - Allocator freelist corruption and reuse of one buffer by concurrent SMB operations can provide attacker-controlled modification of live kernel memory and support control-flow hijacking.\nA:H - The repeated free can immediately cause allocator corruption, a BUG, kernel oops, or panic, and the malicious server can trigger the sequence repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64386","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64387","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious remote SMB server can trigger the flaw through crafted responses to SMB2 QUERY_DIRECTORY requests over the established network connection.\nAC:L - On a hard/retrans-enabled mount, the server controls the replayable error and can repeatedly induce disconnect/reconnect conditions before request reinitialization, without relying on an uncontrollable race.\nPR:N - The attacker needs no account or privilege on the client; the client authenticates to the attacker-controlled SMB server, and ordinary accessible-share enumeration reaches the code.\nUI:N - In a reasonable auto-mounted deployment, routine directory enumeration can be performed automatically by a daemon or application without human participation.\nS:U - The corruption occurs within the client kernel and compromises resources governed by that same kernel security authority.\nC:H - Double-freeing the attacker-influenced CIFS response object can poison the slab freelist or create overlapping allocations, providing UAF-style primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and aliased CIFS buffers can enable attacker-influenced writes and potentially control-flow hijacking or kernel code execution.\nA:H - The double-free can immediately trigger allocator diagnostics, an oops, or a kernel panic, and corrupted freelists can cause subsequent fatal faults."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64387","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64423","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An end-to-end attacker-controlled trigger requires local socket and netlink operations to create multicast memberships and concurrently destroy IPv4 device state; received multicast packets alone cannot initiate the necessary teardown. These operations are reachable inside an attacker-created user and network namespace.\nAC:L - The attacker can populate mc_hash, generate continuous multicast traffic, and repeatedly tear down IPv4 state, controlling both sides of the race. No victim-dependent timing or secret state is required.\nPR:L - Device teardown or invalid-MTU configuration requires CAP_NET_ADMIN in the target network namespace, while multicast joins and UDP sends are unprivileged. An ordinary user can obtain this namespace-scoped capability through unprivileged user and network namespaces.\nUI:N - Exploitation requires no action by another user once the attacker can execute locally and create the required namespace and traffic.\nS:U - The vulnerable code and resulting host-kernel compromise remain within the same security authority; this is conventional kernel privilege escalation rather than a guest-to-host escape.\nC:H - The stale kmalloc-256 ip_mc_list entry exposes reuse-controlled fields and pointers to kernel reads, making kernel-memory disclosure and broader read primitives plausible.\nI:H - Reallocation permits attacker-influenced object contents to drive spinlock writes and pointer traversal on freed memory, making heap corruption and control-flow hijacking defensible.\nA:H - The confirmed slab use-after-free can dereference corrupted hash pointers or operate on an invalid spinlock, causing a kernel oops, panic, general-protection fault, or hang."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64423","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64450","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - TIPC packets can arrive through an IP/UDP bearer from a routable remote source, and the receive callback does not restrict packets to configured remote addresses. An attacker can also establish or spoof the required TIPC neighbour state without credentials.\nAC:L - The attacker controls capability advertisement, link establishment, broadcast synchronization, and the malformed STATE message; one packet then reliably performs the out-of-bounds copy without a race or uncontrollable condition.\nPR:N - The packet-receive path performs no capability or user-credential check, and TIPC discovery and link negotiation are unauthenticated when optional cryptographic keys are not configured. The vulnerable broadcast processing also precedes normal STATE-session validation.\nUI:N - No victim action is required after the TIPC bearer is active; receipt of the crafted STATE message directly invokes the vulnerable code.\nS:U - The vulnerability compromises availability and potentially confidentiality within the receiving kernel's existing security authority, without crossing a VM, IOMMU, or comparable scope boundary.\nC:H - The attacker-controlled count makes the kernel copy up to 1,024 bytes from a much smaller skb, incorporating substantial adjacent slab contents rather than a strictly bounded few-byte read.\nI:N - The defect performs an out-of-bounds read into a correctly sized new allocation; investigation found no out-of-bounds write, arbitrary-write primitive, or control-flow corruption.\nA:H - The demonstrated 1,024-byte slab-out-of-bounds access produces a KASAN BUG and can panic or fault hardened kernels, and an unauthenticated attacker can trigger it repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64450","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64481","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the vulnerable callbacks through ALSA control ioctls on /dev/snd/controlC*. No network or physical protocol directly exposes this path.\nAC:L - After teardown, stale controls can repeatedly dereference the freed object or queue its embedded work item, so exploitation does not require winning a narrow race. A queued work_struct also remains directly usable after its containing allocation is freed.\nPR:L - An unprivileged user with ordinary audio-device access can invoke the control callbacks. The ioctl path contains no capability, namespace, or administrative privilege check.\nUI:N - Exploitation requires no victim to open content or perform an interactive action.\nS:U - The vulnerable driver and the affected kernel resources are governed by the same kernel security authority.\nC:H - The heap use-after-free permits attacker-influenced reuse and disclosure of freed kernel object contents, potentially supporting arbitrary kernel memory reads.\nI:H - The freed object embeds mutable workqueue list state and a function pointer that is subsequently invoked, making kernel memory corruption and control-flow hijacking defensible.\nA:H - Stale control accesses or corrupted queued work can cause a kernel oops, panic, or workqueue corruption, resulting in complete system unavailability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64481","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64524","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The malicious resolution response must originate from the local Hyper-V synthetic-video backend over VMBus; it is not reachable through a network protocol or guest userspace ioctl.\nAC:L - The backend can deterministically trigger the flaw by returning a resolution_count from 65 through 255 during the normal WIN10+ probe or resume exchange, without a race or unpredictable condition.\nPR:N - The guest accepts the VMBus response without authentication, capability checks, or guest credentials; a malicious or compromised backend requires no privileges within the vulnerable guest.\nUI:N - The response is processed automatically during device probing or resume, without any victim action.\nS:U - The vulnerable parser and the affected DRM and kernel resources are within the same guest-kernel security authority; this does not produce a guest-to-host escape.\nC:H - A count of 255 causes 191 additional four-byte entries to be read beyond the declared array, substantially exceeding a small bounded disclosure and allowing out-of-bounds kernel data to influence observable display state.\nI:N - The invalid accesses are reads, and their results are written only to the intended resolution fields; no out-of-bounds write, use-after-free, or control-flow corruption was found.\nA:H - Bounds-instrumented hardened kernels can oops when index 64 is reached, while a failed or malformed resolution probe can leave zero maximum dimensions and make every userspace framebuffer creation fail."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64524","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64541","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable handler is driven entirely by a CDC control message sent by the remote SMC-R peer over the RDMA link, with an attacker-chosen `token` field and no local syscall involvement. SMC-R runs over RoCEv2 (IP/UDP-routable, port 4791) with the CLC handshake over plain TCP, and SMC-Rv2 explicitly supports non-local/routed peers, so the attacker need not share an L2 segment.\nAC:L - The attacker controls both sides of the race: it chooses when to emit CDC messages and which connection to target (the alert token is disclosed to it in the CLC accept/confirm), and it can drive the teardown side itself via CDC close/abort flags into `smc_close_passive_work()` or a stale seqno with `failover_validation` into `abort_work` -> `smc_conn_kill()`. The race can be retried indefinitely across many connections in the same link group, and was reproduced in practice with soft-RoCE.\nPR:N - Establishing an SMC-R connection to a listening SMC socket requires no credentials — SMC has no authentication layer of its own, exactly like plain TCP. Everything after connection establishment (sending CDC messages with a chosen token, signalling close/abort) is available to an unauthenticated peer.\nUI:N - The CDC message is processed in a softirq tasklet from the RDMA completion queue with no involvement from any local user or application action. No victim interaction of any kind is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard in-kernel use-after-free.\nC:H - The freed `smc_sock` is reused type-safely as another live socket, so attacker-supplied cursors applied by `smc_cdc_msg_recv_action()` break the `0 <= bytes_to_rcv <= rmb_desc->len` invariant and make `smc_rx_recvmsg()` hand stale RMB contents to userspace, while the urgent-data path reads `*(base + conn->urg_curs.count - 1)` at an attacker-chosen offset. Once the slab page is reclaimed after the RCU grace period, reuse is unconstrained, giving a general kernel-memory read primitive.\nI:H - `sock_hold()` on an already-zero refcount followed by `sock_put()` re-enters `sk_free()`, yielding a double free, and the handler additionally writes `sk_err`/`sk_shutdown`, makes indirect calls through `sk_data_ready()`/`sk_write_space()`, and `queue_work()`s a freed `work_struct`. These are classic heap-spray and control-flow-hijack primitives leading to arbitrary kernel write.\nA:H - The reported symptom is `refcount_warn_saturate` from `smc_cdc_msg_recv()`, which is an immediate kernel panic on `panic_on_warn` systems, and dereferencing freed memory in softirq context otherwise oopses. The attacker can trigger it repeatedly without authentication."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64541","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64543","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The free side is only reachable through the local TIPCv2 generic-netlink `BEARER_DISABLE` command (or netns teardown); a remote peer can supply the discovery packet that performs the use-after-free access but cannot itself cause `bearer_disable()` to run, so the complete attack requires local access.\nAC:L - The attacker controls both sides of the race — one thread floods TIPC discovery packets at the bearer's UDP port while another disables the bearer — and `bearer_disable()` clears `b->up` and then `kfree()`s the discoverer with no synchronization whatsoever, leaving a wide window that a multi-CPU packet flood hits reliably (a working PoC exists).\nPR:L - `tipc_genl_family` is `.netnsok = true` and the bearer enable/disable ops carry no `GENL_ADMIN_PERM` or other capability check, so an unprivileged user can do everything inside `unshare -Urn` after autoloading tipc via `socket(AF_TIPC, ...)`.\nUI:N - The attacking process performs both the bearer disable and the packet injection itself; no victim action or cooperating user is involved.\nS:U - The corruption stays within the kernel's own security authority — no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - `d->net` is read from the freed slab object and dereferenced as a `struct net *`; after reclaiming the kmalloc-192 allocation with sprayed data the attacker gains a controlled-pointer dereference chain usable for arbitrary kernel memory disclosure.\nI:H - `msg_set_prevnode(buf_msg(d->skb), sugg_addr)` writes a wire-controlled 32-bit value through the dangling `d->skb` pointer, and `tipc_disc_add_dest()` takes a spinlock and increments a counter in freed memory — together a controlled-address/controlled-value write suitable for control-flow hijacking.\nA:H - The use-after-free reliably produces a KASAN slab-use-after-free in softirq context and, on production kernels, a corrupted-pointer dereference or spinlock manipulation on reclaimed memory leading to kernel panic."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64543","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64562","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through local KVM nested VMX: open /dev/kvm, run a nested guest, then tear down nested state (VMXOFF/handle_vmxoff or vmx_leave_nested). It is not reachable via network or adjacent-radio packets.\nAC:L - A KVM VMM attacker controls both sides of the race by driving nested teardown (VMXOFF/vcpu destroy) while forcing vCPU migration via thread affinity/scheduling so __loaded_vmcs_clear() VMCLEARs the dangling shadow VMCS pointer.\nPR:L - Exploitation needs permission to use /dev/kvm and nested VMX (commonly kvm-group or equivalent), not real init-namespace root; KVM create/run ioctls have no CAP_SYS_ADMIN gate on this path.\nUI:N - After the attacker has KVM/nested access, they trigger free_nested and migration themselves; no separate victim action is required.\nS:C - free_nested runs in host KVM while handling L1 nested VMX teardown, and the UAF corrupts host kernel memory, crossing the guest/hypervisor isolation boundary (guest-to-host escape class).\nC:H - The dangling shadow VMCS pointer lets VMCLEAR operate on a freed page that may be reused, yielding a host kernel use-after-free that can be leveraged for arbitrary information disclosure.\nI:H - VMCLEAR writes VMCS state into the freed page; with page reuse this is host heap corruption enabling write primitives and potential host code execution, consistent with UAF guidance.\nA:H - Use-after-free of the shadow VMCS page can oops/panic the host kernel when VMCLEAR or later accessors touch reallocated memory, fully denying host availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64562","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64563","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via local netlink sock_diag dumps (e.g. netlink_diag over NETLINK_SOCK_DIAG) and similar local dump walkers such as TIPC_NL_SOCK_GET; not reachable from remote packet processing.\nAC:L - Attacker controls both sides of the race by running a multi-fragment rhashtable dump while concurrently creating/destroying netlink (or TIPC) sockets to force table resize and free the walked object.\nPR:L - An unprivileged local user can open NETLINK_SOCK_DIAG and dump without CAP_NET_ADMIN; CAP_NET_ADMIN is only required for SOCK_DESTROY, and TIPC_NL_SOCK_GET likewise has no admin permission flag.\nUI:N - Exploitation requires only attacker-issued syscalls (netlink dump plus concurrent socket churn); no victim action is needed.\nS:U - Impact is memory corruption within the host kernel authority (local privilege escalation/crash), not a cross-boundary escape such as guest-to-host or IOMMU bypass.\nC:H - Use-after-free read of a freed hashed object (e.g. netlink_sock) can be reclaimed via heap spray, yielding an arbitrary read primitive through subsequent walk/diag use of the corrupted pointer.\nI:H - UAF on a reclaimable slab object enables heap spraying and fake-object injection into the walk path, which can be leveraged for arbitrary write or control-flow hijacking.\nA:H - The demonstrated KASAN slab-use-after-free in rhashtable_walk_next can oops/panic the kernel, and UAFs remain crashable even when not fully exploited."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64563","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64581","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Triggered via setsockopt(IP_XFRM_POLICY/IP_IPSEC_POLICY) on a local socket racing concurrent udp_sendmsg; entry is a local syscall path (do_ip_setsockopt -> xfrm_user_policy), not packet processing.\nAC:L - Attacker controls both sides of the race (one thread setsockopt to clear/apply per-socket xfrm policy, another sendmsg on the same connected UDP socket) and can create the obsolete xfrm_dst precondition in their netns, retrying until the double dst_release wins.\nPR:L - Path requires CAP_NET_ADMIN checked with sockopt_ns_capable(sock_net(sk)->user_ns), which an unprivileged user obtains via user+network namespaces; the fix commit explicitly states this reachability.\nUI:N - Exploitation uses only the attacker's own socket, threads, and setsockopt/sendmsg loops; no victim action or cooperation is required.\nS:U - Double-free/UAF of the socket's dst_entry/xfrm_dst is standard local kernel memory corruption within the host kernel authority, not a VM escape or other cross-boundary impact.\nC:H - Double dst_release frees the xfrm_dst slab object while still referenced, yielding a use-after-free that can be reclaimed/sprayed to disclose kernel memory via corrupted dst contents and ops.\nI:H - The UAF targets a dst_entry with function pointers (ops/input/output) used on transmit, enabling heap reuse for arbitrary write and control-flow hijack consistent with comparable sk_dst_cache races.\nA:H - The KASAN slab-use-after-free in dst_release demonstrates kernel memory corruption that can oops/panic, and the attacker can repeat the race freely."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68121","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in pppoe_sendmsg(), reached only via the local sendmsg() syscall on a PF_PPPOX/PPPoE socket; it is not triggered by remote packet reception or in-kernel PPP transmit paths such as __pppoe_xmit().\nAC:L - Exploitation requires a race between copy_from_user() blocking in sendmsg and changing team header_ops (e.g., adding the first non-Ethernet GRE port), which an attacker can drive with concurrent threads and retries rather than uncontrollable timing.\nPR:L - PPPoE sockets can be created without special privileges, and configuring the team/GRE topology needed to trigger dev_hard_header() head expansion is achievable with CAP_NET_ADMIN inside an unprivileged user/network namespace (unshare -Urn).\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through socket I/O and netlink/rtnl configuration of the team device.\nS:U - Impact is kernel heap corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - Writing PPPoE header fields through a stale pointer after pskb_expand_head() frees the old skb head is a slab use-after-free; freed kmalloc objects can be reclaimed for sensitive data, enabling arbitrary kernel memory disclosure.\nI:H - The post-dev_hard_header() memcpy/ph->length stores up to eight attacker-influenced bytes into freed skb head memory, providing a heap corruption primitive that can be developed into arbitrary kernel writes or code execution.\nA:H - Use-after-free writes into freed slab memory commonly cause kernel oops/panic and can be triggered repeatedly via sendmsg, yielding persistent denial of service even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68121","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68136","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached from the standard NAPI GRO receive path processing remotely originated TCP/IP packets (napi_gro_receive→dev_gro_receive→tcp_gro_receive→skb_gro_receive_list), including tethering/NAT/forwarding scenarios where packets re-enter GRO on a second netdev after driver LRO or prior GRO aggregation.\nAC:L - An attacker can reliably trigger the bug by crafting a TCP stream through a forwarding host with rx-gro-list enabled, without races or victim-specific timing; the commit documents a deterministic tethering/forwarding repro where flush-marked frag_list skbs are re-aggregated and later crash skb_segment.\nPR:N - No local privileges or authentication are required; any remote peer that can send TCP traffic through a vulnerable forwarding/tethering/NAT Linux host can reach the GRO fraglist merge path, which performs no capability or credential checks on the receive path.\nUI:N - Exploitation requires only network-delivered packets and normal kernel forwarding/GRO processing; the victim does not need to open files, mount filesystems, click links, or perform any deliberate action beyond routine network operation.\nS:U - Impact is confined to kernel memory corruption and panic within the same host kernel security domain during packet GRO aggregation and subsequent segmentation on transmit; it does not cross VM, container, or IOMMU boundaries to affect a separate security authority.\nC:H - Double aggregation corrupts the skb frag_list chain (loops, dangling references, NULL/corrupted list_skb pointers), constituting kernel heap memory corruption that can be read during skb_segment processing and is classifiable as a high-impact info-disclosure primitive beyond a simple crash.\nI:H - Re-aggregating flush-marked skbs with existing frag_list corrupts skb linked-list structure and reference relationships in kernel memory, enabling potential control of subsequent skb metadata and write/control-flow primitives during GSO segmentation, not merely integrity-preserving packet drops.\nA:H - Corrupted frag_list state causes skb_segment to dereference a NULL or invalid list_skb via skb_headlen(), producing a kernel panic/oops on the transmit path (sch_direct_xmit/qdisc_run), fully denying availability of the affected system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68136","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68138","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only via local RTM_NEWTFILTER rtnetlink messages (tc flower filter with police action) through rtnetlink_rcv_msg→tc_new_tfilter→fl_change→tcf_police_init→qdisc_get_rtab/qdisc_put_rtab; no remote packet or network protocol path exists.\nAC:L - cls_flower is TCF_PROTO_OPS_DOIT_UNLOCKED, so concurrent RTM_NEWTFILTER requests run without RTNL; the attacker controls both racing threads/CPUs and can repeatedly install flower filters with identical police rate tables to deterministically hit the global qdisc_rtab_list/refcnt race.\nPR:L - Non-GET rtnetlink handlers require netlink_net_capable(CAP_NET_ADMIN); this is namespace-scoped, so an unprivileged local user obtains CAP_NET_ADMIN via user namespaces (unshare -Urn), sets up clsact/ingress, and installs flower+police rules without init-namespace root.\nUI:N - Exploitation is fully self-contained: the attacker issues the concurrent tc/netlink commands from its own processes and needs no victim to mount filesystems, click links, or perform any other interactive action.\nS:U - Impact is heap corruption and UAF/double-free in kernel kmalloc-2k slabs within the same kernel security authority; although qdisc_rtab_list is global across netns, this is standard kernel memory corruption/privilege escalation, not a VM, IOMMU, or sandbox boundary escape.\nC:H - Concurrent non-atomic refcnt and list updates cause slab use-after-free/double-free of struct qdisc_rate_table (KASAN-confirmed in qdisc_put_rtab); freed 2KB objects are attacker-influenceable via kmalloc timing and are classically weaponizable for arbitrary kernel memory disclosure.\nI:H - The race corrupts a process-global singly linked list and can double-free a kmalloc-2k qdisc_rate_table, yielding classic heap metadata/object corruption primitives that can be developed into arbitrary kernel writes and local privilege escalation/code execution.\nA:H - Demonstrated KASAN slab-use-after-free in qdisc_put_rtab on the error/teardown path, and concurrent double-free of the same rate table can panic the kernel; the trigger is repeatable at will with concurrent netlink requests and causes task death or system-wide instability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68138","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68155","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when libceph decodes CEPH_MSG_MON_MAP from a remote Ceph monitor over the kernel client's established TCP/msgr2 session (mon_dispatch -> ceph_monc_handle_map -> ceph_monmap_decode), which is a network protocol attack surface on CephFS/RBD/cloud nodes.\nAC:L - An attacker who can send monitor protocol messages only needs to set num_mon=0 in the monmap; once accepted, any later session reopen (keepalive timeout, hunt, or connection fault) deterministically hits BUG_ON in pick_new_mon without races or special memory layout.\nPR:N - In the highest-impact scenario a malicious or compromised Ceph monitor (or equivalent authenticated cluster peer) sends the malformed monmap to already-connected kernel clients; the attacker needs no local privileges on the victim host.\nUI:N - After a Ceph client session exists, monmap updates are delivered and processed automatically by the kernel monitor client; no further mount, open, or other victim interaction is required to accept the bad map and later crash on reconnect.\nS:U - Exploitation causes a kernel BUG/panic within the same kernel security domain and does not cross VM, container, IOMMU, or other security boundaries.\nC:N - The failure mode is a BUG_ON assertion in pick_new_mon when num_mon is zero; there is no memory corruption, out-of-bounds access, or other information disclosure primitive on the vulnerable path.\nI:N - Accepting num_mon==0 only stores an empty monmap and later triggers a deliberate kernel BUG; attacker input does not corrupt or modify arbitrary kernel memory or enable code execution.\nA:H - BUG_ON(monc->monmap->num_mon < 1) in pick_new_mon during __open_session causes a kernel oops/panic, fully denying availability of the affected host until reboot."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68155","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68158","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Malformed incremental osdmap data is delivered in CEPH_MSG_OSD_MAP over TCP from a Ceph monitor (mon_dispatch) or OSD (osd_dispatch) to libceph clients (CephFS/RBD), and the overflow is triggered while decoding received network bytes in osdmap_apply_incremental().\nAC:L - A compromised or attacker-controlled monitor/OSD can publish an incremental osdmap with epoch N+1 and a crafted new_state length that wraps the multiply, reliably bypassing bounds checks without races or victim-specific memory layout.\nPR:N - Exploitation requires no privileges on the victim host; a malicious cluster peer or on-path attacker that can deliver forged osdmaps to an already-connected kernel Ceph client needs no local account, capabilities, or user-namespace tricks.\nUI:N - Once a host is a Ceph client, osdmap subscriptions and updates are applied automatically by the kernel; no additional mount, open, or interactive step is needed at exploit time beyond the existing client session.\nS:U - Impact is confined to kernel memory and libceph client state on the Ceph client host (info leak, map corruption, crash, or privilege escalation); it does not cross VM, IOMMU, or sandbox boundaries to another security authority.\nC:H - Integer-overflow bypass lets decode_new_up_state_weight() run bare ceph_decode_32/8 loops past the message end, performing out-of-bounds reads of adjacent kernel heap/slack memory that can disclose pointers and other sensitive data.\nI:H - Misaligned decoding also drives attacker-controlled osd/xorstate/weight values into map->osd_weight[], map->osd_state[], and map->osd_addr[] updates (including memset), corrupting kernel osdmap state in ways usable for further exploitation.\nA:H - Unbounded out-of-bounds reads while parsing osdmaps can fault on unmapped pages and trigger kernel oops/panic; map corruption can also cause persistent client failure, repeatable on each malicious incremental map."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68158","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68159","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Malicious pg_temp/pg_upmap data arrives in CEPH_MSG_OSD_MAP from a Ceph monitor or OSD over TCP, is decoded in libceph, and later triggers stack corruption in ceph_pg_to_up_acting_osds during RBD/CephFS/libceph client I/O.\nAC:L - A compromised or attacker-controlled monitor can publish osdmap entries with length >32 for chosen PGs; once the client subscribes, kernel I/O paths such as RBD mount/probe via calc_target deterministically invoke apply_upmap/get_temp_osds and overflow the stack buffer.\nPR:N - Exploitation requires no privileges on the victim host; any machine acting as a Ceph client that receives a forged osdmap from a cluster peer over the network can be attacked without local user capabilities or namespace tricks.\nUI:N - No victim user action is needed during exploitation beyond the host already being a Ceph client; forged osdmaps are applied automatically and the overflow fires on subsequent kernel client operations without interactive steps.\nS:U - Impact is confined to kernel memory on the Ceph client host (privilege escalation or crash); it does not cross VM, IOMMU, or sandbox boundaries to other security authorities.\nC:H - KASAN-confirmed stack out-of-bounds write in ceph_pg_to_up_acting_osds corrupts adjacent stack memory and can be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak.\nI:H - Unbounded copy loops in apply_upmap() and get_temp_osds() write attacker-controlled u32 OSD IDs past the fixed osds[CEPH_PG_MAX_SIZE] stack array, enabling control-flow hijack and arbitrary kernel writes.\nA:H - The reported reproducer triggers KASAN stack-out-of-bounds followed by kernel BUG in ceph_pg_to_up_acting_osds, demonstrating a reliable kernel oops or panic from malformed osdmap processing on Ceph clients."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68159","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68160","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - CEPH_MSG_CLIENT_CAPS is received over the kernel Ceph messenger TCP connection from an MDS peer; mds_dispatch() passes it directly to ceph_handle_caps(), so a malicious or compromised MDS (or on-path attacker on an unsigned msgr session) reaches the bug with network data alone.\nAC:L - The attacker fully controls msg->hdr.version and snap_trace_len in the caps header; setting version=1 bypasses all version-gated decoders and snap_trace_len=0xFFFFFFFF yields a fake end pointer that reliably defeats ceph_decode_need(), with no race or memory-layout dependency.\nPR:N - Exploitation requires only the ability to send crafted caps messages as the remote MDS peer on an established session; the attacker needs no account, mount privilege, or other credentials on the victim host beyond the client already being connected to that cluster.\nUI:N - Once CephFS is mounted and the MDS session is open, CEPH_CAP_OP_IMPORT caps messages are delivered and processed automatically during normal cap migration and MDS failover; no additional local user action is needed at exploit time beyond prior cluster connectivity.\nS:U - The out-of-bounds read and resulting snap-realm corruption affect only the kernel CephFS client’s internal state within the same kernel security authority; there is no VM escape, sandbox breakout, or cross-authority boundary crossing.\nC:H - ceph_update_snap_trace() decodes struct ceph_mds_snap_realm and snap arrays using an attacker-supplied fake end pointer, reading sizeof(*ri) and further attacker-influenced extents past the legitimate msg->front buffer into adjacent kernel memory without copying to userspace.\nI:H - Out-of-bounds kernel memory is interpreted as snap-realm metadata and copied via dup_array() into newly allocated kernel heap structures (realm->snaps, realm->prior_parent_snaps), corrupting authoritative snap state and providing a memory-corruption primitive that could be leveraged for further kernel compromise.\nA:H - Out-of-bounds reads can fault on unmapped pages causing a kernel oops; the ceph_update_snap_trace() error path issues WARN(1), fences I/O via CEPH_MOUNT_FENCE_IO, and can close all MDS sessions—effects an attacker can trigger repeatedly at will."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68160","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68202","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through ioctls on the local character device /dev/snd/seq (SNDRV_SEQ_IOCTL_CREATE_QUEUE/DELETE_QUEUE/SET_QUEUE_CLIENT); no network or adjacent-network path exists to the ALSA sequencer.\nAC:L - The attacker controls both sides of the race — one thread deletes the queue while another spins on SET_QUEUE_CLIENT holding a queueptr() reference — and can retry the loop indefinitely on a default kernel with CONFIG_SND_SEQUENCER, so the window is reliably hit.\nPR:L - Only an unprivileged local user able to open /dev/snd/seq is needed; snd_seq_queue_use() performs no owner or access check and no capability is required, as the fix commit states explicitly.\nUI:N - The attacker's own threads create, delete and re-use the queue and the global system timer fires on its own; no victim action is involved.\nS:U - The use-after-free corrupts kernel heap objects within the same kernel security authority, giving at most kernel privilege escalation rather than crossing a VM, IOMMU or sandbox boundary.\nC:H - The stale timer instance dereferences the freed snd_seq_queue and snd_seq_timer, reading tick/time fields and freed prioq pointers that can be reclaimed by attacker-sprayed objects, giving a route to disclose arbitrary kernel memory.\nI:H - snd_seq_timer_interrupt() writes cur_time, tick and last_update into the freed snd_seq_timer slab and snd_seq_check_queue() dispatches events through freed queue pointers, yielding a controllable write primitive on reclaimed heap memory suitable for privilege escalation.\nA:H - Even unexploited, the timer callback derefs freed memory and takes a spinlock in a freed object from interrupt context, causing oops, lock corruption or panic — a repeatable denial of service for any local user."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68202","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68397","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handler is registered via dev_add_pack() for ethertype ETH_P_AF_IUCV (0xFBFB) on every netdevice, so any peer LPAR/guest on the same HiperSockets internal LAN or any host on an attached Ethernet segment can drive afiucv_hs_rcv() with crafted frames; the frames are raw L2 and cannot be routed across an IP hop, so the vector is adjacent rather than network.\nAC:L - The attacker controls the packet side of the race outright (flooding 0xFBFB frames) and can drive the freeing side too, since SYN frames make a listener spawn and enqueue child sockets while FIN/SYN|FIN frames push sockets to IUCV_DISCONN and wake the application into close(), so the read_unlock()-to-handler window can be retried indefinitely until won.\nPR:N - afiucv_hs_rcv() runs from the netif RX softirq and processes any matching frame with no authentication, credential check, or capability test anywhere on the path; the attacker needs no account or privilege on the target s390 system.\nUI:N - No victim action is required: the attacker's own frames both create the AF_IUCV child sockets and trigger the state changes that lead to their teardown, and the packet handler runs unconditionally in softirq context.\nS:U - The freed struct sock and the resulting corruption stay inside the kernel of the affected LPAR or z/VM guest; no hypervisor, IOMMU, or container boundary is crossed.\nC:H - This is a use-after-free on a socket allocated from a generic kmalloc cache (iucv_proto is registered without its own slab), so an attacker who reclaims the object has the kernel read attacker-influenced or stale heap contents through sk fields, sk_filter()'s BPF program pointer, and the iucv backlog queues, yielding kernel memory disclosure.\nI:H - After the free the handlers perform indirect calls through the freed object (sk->sk_data_ready(), sk->sk_state_change(), sk_filter()) and writes into it (sk_state, atomic_sub on iucv->msg_sent, skb_queue_tail() list-pointer updates), giving control-flow hijack and write primitives once the slab object is reclaimed with attacker-controlled data.\nA:H - Dereferencing the freed socket from softirq context reliably produces an oops or \"Fatal exception in interrupt\" panic, and the attacker can repeat the frame flood at will, causing complete loss of availability of the IBM Z LPAR or guest."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68397","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68398","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The free side of the race is a local close() of the pppol2tp socket, which no remote peer can invoke; the full attack (create tunnel/session via AF_PPPOX socket, drive RX with loopback UDP datagrams, close concurrently) is performed entirely through local syscalls.\nAC:L - The attacker controls both sides of the race, feeding the UDP-encap RX softirq from one thread while closing the pppox socket on another, and can retry the loop indefinitely until the window is hit.\nPR:L - No capability check exists on this path: pppox_create()/pppol2tp_connect() and ppp_register_net_channel() need no CAP_NET_ADMIN, and PPPIOCGCHAN is handled by pppox_ioctl() on the socket itself, so /dev/ppp access is not required; the fix commit states the bug is reachable by an unprivileged user.\nUI:N - The attacker performs every step — socket creation, session setup, packet injection and close() — with no action by any other user or administrator.\nS:U - The use-after-free corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - After the channel is freed and its slab object reallocated, ppp_input() reads pch->bridge and pch->ppp from attacker-groomed memory and can route received frames to an arbitrary attacker-chosen structure, giving a path to disclosing kernel memory.\nI:H - skb_queue_tail(&pch->file.rq, skb) writes a linked-list insertion into the freed object and wake_up_interruptible(&pch->file.rwait) traverses a freed waitqueue, so heap grooming yields controlled writes and function-pointer traversal usable for privilege escalation.\nA:H - Dereferencing and writing to the kfree()d struct channel from softirq context reliably corrupts the slab and panics or oopses the kernel, and the race can be re-triggered at will."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68398","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68417","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access to the RDMA character devices (/dev/infiniband/uverbsN for create_qp and /dev/infiniband/rdma_cm for the QPN lookup); no network packet reaches the racing code path without a local trigger first.\nAC:L - The attacker controls both sides of the race: one thread issues create_qp while another issues rdma_connect/rdma_accept with an attacker-supplied qp_num, and QPNs from xa_alloc(XA_FLAGS_ALLOC1) are predictable. The post-publish failure can be made deterministic by passing a short udata->outlen, so the window is wide and repeatable at will.\nPR:L - Any unprivileged local user with access to the siw uverbs and rdma_cm character devices can create QPs and issue rdma_connect/rdma_accept with an arbitrary qp_num; no capability check gates siw_create_qp, siw_connect or siw_accept.\nUI:N - The attacker drives both the QP creation and the concurrent QPN lookup from its own threads; no action by any other user or administrator is needed.\nS:U - The corruption is confined to kernel memory managed by the same kernel security authority; there is no crossing of a VM, IOMMU or sandbox boundary.\nC:H - The siw_qp object can be kfree'd by the ib core error path while the CM thread still holds a reference, giving a use-after-free on a slab object the attacker can groom and read back through QP/CM state, enabling disclosure of arbitrary kernel memory.\nI:H - After the free, siw_free_qp() performs list_del(&qp->devq), vfree() of four pointer fields and siw_put_tx_cpu(qp->tx_cpu) using values read from reallocated attacker-controlled memory, yielding arbitrary-pointer free, list-unlink writes and out-of-range per-CPU decrements suitable for control-flow hijacking.\nA:H - Even without exploitation the race reliably causes kernel crashes: NULL sendq/recvq/scq/rcq dereferences, list_del on an uninitialized devq head, waits on an uninitialized qp_free completion, and use-after-free oopses."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68417","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-68426","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPsec transmit path (validate_xmit_xfrm) which processes any skb routed into an offloaded SA, including GRO-aggregated traffic forwarded from remote hosts on an IPsec gateway; xfrm_dev_offload_ok() has no socket/local-origin requirement, so a remote peer's packet stream drives the vulnerable GSO segmentation and async-crypto steal directly.\nAC:L - The attacker drives both preconditions with traffic alone: sustained large GSO flows keep the crypto engine backlogged so ->xmit() returns -EINPROGRESS routinely, and packet volume advances xo->seq.low toward the wrap that forces segmentation; each stolen trailing segment reproduces the stale skb->prev, and the subsequent tail->next write is deterministic once it occurs.\nPR:N - On an IPsec gateway the traffic that triggers the path is forwarded from remote, unauthenticated senders — no account, credentials, or capability on the target host is needed, since the SA and offload are pre-existing administrative configuration rather than something the attacker must set up.\nUI:N - No victim action is required; the vulnerable code runs automatically in softirq context on every qualifying transmit, driven purely by the attacker's packet stream.\nS:U - The corruption is of kernel sk_buff list state within the same host kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Writing through the stale ->prev is a use-after-free on an skb whose memory the attacker can influence via heap grooming with concurrent traffic; per kernel UAF guidance this yields a high-confidentiality primitive, and the corrupted list can splice engine-owned skbs into the transmit path, exposing freed/reused memory contents on the wire.\nI:H - tail->next = skb is an attacker-influenced pointer write into freed heap memory, and the resulting skb list corruption lets live and engine-owned skbs be chained together; this is classic heap corruption that can be shaped via spraying into an arbitrary write or control-flow hijack.\nA:H - Even without full exploitation the use-after-free write and the double-ownership of a stolen segment cause list corruption, double-free/oops and kernel panic in the softirq transmit path, taking down the gateway."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-68426","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72020","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when a host running the IPVS backup sync receiver processes forged UDP sync datagrams (default multicast 224.0.0.81:8848) in ip_vs_process_message(), which is a network packet receive path rather than a local-only ioctl/netlink interface.\nAC:L - Once IPVS backup sync is enabled, an attacker can reliably send IPVS v1 messages that set IP_VS_CONN_F_IN_SEQ/OUT_SEQ while omitting IPVS_OPT_SEQ_DATA; no race, heap grooming, or victim-specific state beyond matching syncid (often 0) is required.\nPR:N - The backup sync socket accepts unauthenticated UDP input with no capability checks; only an optional syncid filter (frequently left at 0) may drop messages, so the attacker needs no Linux privileges to inject the malformed sync records.\nUI:N - No end-user or administrator interaction is required at exploit time; the attacker directly delivers crafted sync messages to the listening backup daemon without victims opening files, clicking links, or changing settings.\nS:U - Exploitation stays within the IPVS load balancer kernel/network authority and affects connections it forwards; it does not constitute a VM escape, sandbox breakout, or cross-security-authority boundary such as guest-to-host.\nC:H - Uninitialized ip_vs_seq init_seq and previous_delta fields retain stale slab data that vs_fix_seq()/vs_fix_ack_seq() apply when rewriting forwarded TCP seq/ack numbers, leaking kernel heap bytes onto the network to clients or backend servers.\nI:H - Those same uninitialized sequence-adjustment fields cause incorrect TCP sequence/ack rewriting in NAT/application-helper paths (ip_vs_app_pkt_in/out), corrupting load-balanced TCP flows and enabling attacker-driven manipulation of forwarded traffic integrity.\nA:H - Corrupted TCP sequence handling breaks or resets connections on the virtual service and can be triggered repeatedly via additional forged sync messages, causing sustained denial of service to load-balanced traffic on the affected backup node."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72020","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72069","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On CONFIG_PREEMPT_RT, every spin_unlock() is substituted by rt_spin_unlock(); network subsystems such as netfilter xt_hashlimit process inbound packets through hashlimit_mt_common(), spin_lock/unlock on RCU-protected dsthash_ent objects concurrently freed via call_rcu by GC—the exact embedded-spinlock UAF pattern from the fix.\nAC:L - The bug is a cross-CPU race where rt_spin_unlock() calls rcu_read_unlock() before releasing the rtmutex, ending the RCU grace period while still dereferencing the lock; syzbot triggered this reliably on PREEMPT_RT via concurrent unlinkat and dentry teardown, and attackers control both sides with parallel syscalls or packet/GC load.\nPR:N - Remote attackers need no account, capability, or authentication to send packets that hit deployed hashlimit rules on internet-facing PREEMPT_RT gateways; the proven syzbot unlinkat path needs only directory write permission (PR:L), but PR:N reflects the highest-severity unauthenticated network packet scenario.\nUI:N - No victim interaction is required; the attacker drives the race through their own concurrent filesystem syscalls (syzbot: unlinkat racing __fput/dentry_kill) or sustained inbound traffic overlapping netfilter GC, without needing another user to open files or mount filesystems.\nS:U - The UAF corrupts kernel slab memory containing embedded spinlock/rtmutex fields and enables privilege escalation within the same kernel security authority; it does not inherently cross VM/guest, container sandbox, or IOMMU hardware isolation boundaries.\nC:H - Syzbot reported KASAN slab-use-after-free Read in rt_mutex_slowunlock during spin_unlock on a freed dentry in shrink_dcache_tree; the systemic UAF lets attackers read freed objects (dentry, dsthash_ent, etc.) after premature RCU grace-period completion, enabling kernel pointer and memory disclosure.\nI:H - UAF on embedded rtmutex fields inside freed slab objects (dentry->d_lock per syzbot) permits heap grooming and reallocation of attacker-controlled data, providing standard kernel heap corruption primitives for arbitrary write and control-flow hijack beyond the immediate crash.\nA:H - Syzbot hit KASAN slab-use-after-free causing kernel fault in shrink_dcache_tree via rt_spin_unlock on PREEMPT_RT; the bug can oops/panic any RT kernel whenever spin_unlock races RCU-deferred free of the containing object, enabling repeatable denial of service via concurrent VFS or netfilter operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72069","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72072","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is reached by racing MACSEC_CMD_DEL_RXSC/ADD_RXSC netlink configuration (GENL_ADMIN_PERM) against mlx5e MACsec RX processing; the privileged genlink/rtnl control path is required to trigger the bug, not remote packets alone.\nAC:L - An attacker with CAP_NET_ADMIN can drive both sides by looping RX SC add/delete while flooding MACsec-offloaded RX traffic on the mlx5e netdev, reliably winning the RCU race between xa_load/dst_hold and metadata_dst_free.\nPR:L - MACsec offload mutations require GENL_ADMIN_PERM (CAP_NET_ADMIN); on Mellanox ConnectX/BlueField systems this is reachable by cloud tenants with SR-IOV VFs, containers, or user/network namespaces without init-namespace root.\nUI:N - No victim user action is needed; automated concurrent netlink MACsec operations and incoming MACsec-offloaded frames on an active mlx5e interface suffice once MACsec offload is configured.\nS:U - Impact is kernel heap use-after-free and memory corruption within the host kernel on the mlx5 NIC; it enables local privilege escalation but does not by itself cross VM, IOMMU, or hypervisor security boundaries.\nC:H - The race calls dst_hold() and skb_dst_set() on a freed metadata_dst, a classic slab UAF that can disclose kernel memory through subsequent dst_entry and MACsec skb metadata handling.\nI:H - Freed metadata_dst objects can be reallocated via heap spraying while the RX datapath still references them, enabling refcount corruption and arbitrary kernel memory writes or control-flow hijack beyond a mere crash.\nA:H - Concurrent use of freed md_dst during mlx5e MACsec RX processing can cause immediate kernel oops, BUG, or panic on datacenter/cloud hosts using mlx5 hardware MACsec offload, fully denying system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72072","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72083","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On LIO/iSCSI storage servers and appliances, a remote initiator sends PERSISTENT_RESERVE_OUT with REGISTER AND MOVE over TCP (port 3260); iscsit_process_scsi_cmd()→target_execute_cmd()→target_scsi3_emulate_pr_out()→core_scsi3_emulate_pro_register_and_move() with no local access required.\nAC:L - The attacker fully controls the PR-OUT parameter list length (>4096 to force vmap/vunmap), iSCSI TransportID format 01b with ISID, and can establish prerequisite PR registration and reservation via prior SCSI commands on the same session; no uncontrollable race or layout dependency exists.\nPR:N - Exploitation requires only the ability to act as a network SCSI/iSCSI client with LUN access to an exported target; no Linux UID, capability, or init-namespace root on the storage server is needed—only standard iSCSI initiator connectivity (CHAP/ACL when configured).\nUI:N - Triggering is fully automated once an iSCSI session exists: the attacker issues scripted REGISTER, RESERVE, then REGISTER AND MOVE commands with a crafted >4 KiB parameter list; no victim mount, click, or other interactive action is required.\nS:U - The UAF corrupts kernel heap state inside the target-core PR handler on the storage host; impact stays within that kernel security domain and does not inherently cross VM, container, or IOMMU boundaries (standard host compromise, not escape).\nC:H - After vunmap(), iport_ptr aliases freed kernel virtual address space and is dereferenced in strcmp(), __core_scsi3_locate_pr_reg(), and snprintf() into pr_reg_isid; per kernel CVSS guidance, UAF reads enable arbitrary kernel memory disclosure when uncertain.\nI:H - UAF reads of attacker-influenced unmapped PR-OUT data drive strcmp-based registration matching and snprintf copies into persistent kernel pr_reg structures; memory corruption/UAF is scored High for integrity because it can be leveraged for control-flow or state manipulation.\nA:H - Dereferencing iport_ptr after transport_kunmap_data_sg() vunmap() on multi-page buffers causes immediate invalid kernel virtual address accesses (oops/panic) on every qualifying REGISTER AND MOVE; UAF availability impact is High per kernel guidance even before full exploit development."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72083","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72084","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is triggered by a PERSISTENT RESERVE OUT SCSI command delivered over the LIO iSCSI target fabric (TCP/3260); remote initiators reach `iscsi_parse_pr_out_transport_id()` after login and normal SCSI command processing, and the fix commit notes the same path via vhost-scsi-backed exports.\nAC:L - An attacker fully controls the PR-OUT parameter list and can reliably supply a FORMAT CODE 01b iSCSI TransportID without a \",i,0x\" separator or NUL terminator and size it past one page so `strstr()` over-reads into the vmalloc guard page; no races or victim-specific memory layout are required.\nPR:N - Exploitation requires only completing iSCSI login to an exported LUN as any initiator client, not host administrator privileges; LIO demo mode auto-provisions initiator ACLs and many storage appliances expose iSCSI targets to the network without mapping this to elevated OS credentials.\nUI:N - No end-user or administrator action beyond normal automated iSCSI target operation is needed; a remote initiator can send the malicious PR OUT command directly once a session to the LUN exists.\nS:U - The flaw corrupts or reads kernel memory and crashes the target host kernel within the same kernel security boundary; it does not by itself cross a VM, container, or IOMMU isolation boundary to another authority.\nC:H - Unbounded `strstr()` and an unbounded `%s` on the error path perform out-of-bounds reads past the received PR-OUT buffer, potentially disclosing adjacent kernel memory before the fault, matching CVSS guidance for out-of-bounds reads beyond a few bytes.\nI:H - A malformed TransportID can leave the ISID pointer one byte past the descriptor so subsequent registration code dereferences out of bounds, and the ISID normalization loop can write with `tolower()` beyond the buffer, giving a memory-corruption primitive in kernel context.\nA:H - The over-read into a multi-page vmalloc mapping hits the guard page and triggers a KASAN vmalloc-out-of-bounds fault and kernel oops, remotely denying service to the host and all consumers of the iSCSI target."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72123","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local BCM socket syscalls (sendmsg with RX_SETUP/SETTIMER/ival2 throttling and RX_DELETE); CAN frames can be injected locally via loopback without physical bus access.\nAC:L - The attacker controls both sides of the race by concurrently issuing RX_DELETE teardown and delivering matching CAN frames (e.g., via threads or paired BCM/RAW sockets), making the thrtimer re-arm UAF reliably triggerable.\nPR:L - No kernel capability check gates AF_CAN/CAN_BCM socket creation or bcm_sendmsg opcodes; any unprivileged local user with socket access (including via user namespaces with vcan) can reach the vulnerable path.\nUI:N - No victim interaction is required; the attacker self-triggers the race through their own BCM socket operations and locally injected CAN traffic.\nS:U - Impact is confined to kernel memory corruption and local privilege escalation within the same kernel security boundary, not a cross-boundary escape such as VM or IOMMU bypass.\nC:H - The thrtimer UAF dereferences freed bcm_op fields (locks, frame buffers, op->sk) in bcm_rx_thr_handler/bcm_send_to_user, enabling attacker-controlled heap reuse and arbitrary kernel memory disclosure.\nI:H - UAF on the bcm_op slab object allows heap spraying to corrupt function pointers, timers, and sock structures, providing a standard path to arbitrary kernel writes and local privilege escalation.\nA:H - The freed-op dereference in the hrtimer softirq path causes kernel oops/panic under normal exploitation attempts, and successful memory corruption can crash or hang the system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72123","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72135","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local pread()/write() syscalls on /dev/tpm0 or /dev/tpmrm0 character devices; there is no network, Bluetooth, or physical-bus code path to the vulnerable tpm_common_read() handler.\nAC:L - An attacker who can open the device reliably triggers the bug by writing any TPM command to create a pending response, then calling pread() with a large offset; no races or special memory layout are required.\nPR:L - Upstream tpm2-tss udev rules grant non-root users in the tss group read/write access to /dev/tpmrm0 (mode 0660), which is the standard TPM2 user-space interface on laptops and servers with TPM hardware.\nUI:N - No victim interaction is required; the attacker opens the TPM device, submits a command, and issues the malicious pread() themselves without relying on another user to mount, click, or configure anything.\nS:U - The vulnerability corrupts kernel heap memory in the TPM driver on the same host; it does not by itself cross a VM, container, or IOMMU security boundary to affect a different trust domain.\nC:H - Unchecked pread offsets cause copy_to_user() to read beyond the 4096-byte data_buffer into adjacent kmalloc slab memory (including tpm_space pointers), leaking kernel heap contents to userspace.\nI:H - A successful out-of-bounds pread also executes memset() past data_buffer, zeroing adjacent heap objects such as tpm_space session/context pointers and enabling further memory corruption or control-flow manipulation.\nA:H - KASAN reports slab-out-of-bounds faults on both the copy_to_user read and memset write; corrupting adjacent heap structures can oops or panic the kernel during subsequent TPM operations."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72135","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72221","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Reachable over TCP by any remote peer of an in-kernel NFS/RPC server (nfsd) via the pre-auth RPC_AUTH_TLS NULL-procedure STARTTLS path that invokes svc_tcp_handshake() on the accepted SUNRPC transport.\nAC:L - The attacker controls both sides of the race by timing TLS client handshake messages against the fixed 5-second SVC_HANDSHAKE_TO and opening many parallel connections to reliably hit the cancel-lost window.\nPR:N - No credentials or export authorization are required; svcauth_tls_accept() accepts empty AUTH_TLS on RPC NULL from any TCP client, and svcauth_unix_set_client() skips IP export checks when rq_proc==0.\nUI:N - Exploitation requires only scripted network connections and TLS client traffic to nfsd; no victim user interaction such as mounting a filesystem or opening a file is needed.\nS:U - Memory corruption occurs in nfsd kernel worker context on the same host; impact is kernel privilege compromise within the server security authority, not a VM escape or IOMMU boundary bypass.\nC:H - A second svc_tcp_handshake() can call init_completion() while svc_tcp_handshake_done() concurrently calls complete_all(), corrupting the embedded swait_queue in heap-allocated svc_sock and enabling arbitrary kernel memory disclosure.\nI:H - Corrupting completion wait-queue metadata in the svc_sock heap object can be leveraged for arbitrary kernel writes and control-flow hijacking to achieve local privilege escalation on the NFS server.\nA:H - The swait_queue corruption can trigger kernel oops/panic, and the alternate race path tears down connections whose TLS handshake is about to succeed, enabling repeatable remote denial-of-service against nfsd."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72221","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72222","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in nfsd's server-side SUNRPC/TCP TLS handshake (net/sunrpc/svcsock.c), reached when a remote peer connects to port 2049 and sends a pre-authentication AUTH_TLS NULL STARTTLS probe that triggers svc_tcp_handshake() via svcauth_tls_accept().\nAC:L - The attacker controls both sides of the race by initiating AUTH_TLS handshakes and concurrently resetting/closing TCP or waiting for SVC_HANDSHAKE_TO while tlshd delivers completion; repeated parallel connections make the overlap window reliably reachable.\nPR:N - AUTH_TLS is processed on RPC procedure 0 before credentials are verified, so an unauthenticated remote client can reach svc_tcp_handshake() and the asynchronous callback without any account, export access, or kernel capability.\nUI:N - nfsd worker threads automatically accept the TCP connection, process the STARTTLS probe, run the TLS handshake, and handle teardown/completion callbacks without any local user or administrator action.\nS:U - Exploitation corrupts kernel memory on the NFS server host itself and does not cross a VM-guest/host, sandbox, or IOMMU security boundary; impact stays within the kernel's security authority.\nC:H - svc_tcp_handshake_done() use-after-frees svc_sock and performs set_bit/clear_bit RMW on freed xpt_flags plus complete_all() on freed sk_handshake_done, a slab-corruption UAF that can disclose arbitrary kernel memory.\nI:H - The same UAF delivers attacker-timed writes into reclaimed slab slots through atomic bit operations and wait-queue list updates, enabling heap grooming and further kernel memory corruption for arbitrary modification or code execution.\nA:H - Slab corruption and UAF during handshake completion can cause kernel oops/panic, and unauthenticated remote peers can trigger the fault repeatedly by overlapping TLS handshake completion with connection close."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72222","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72251","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit in nf_nat_sip() from sip_help_udp/tcp() during nf_confirm() on POST_ROUTING/LOCAL_IN while processing attacker-supplied SIP/UDP or SIP/TCP packets traversing a netfilter NAT gateway, so exploitation is via remote network traffic rather than local syscalls or physical access.\nAC:L - Once nf_conntrack_sip and nf_nat_sip are active on a NATed SIP flow, a remote peer can set forced_dport with a crafted Via header and drive the reply-path skb_ensure_writable() reallocation on cloned skbs without races or rare layout luck.\nPR:N - Exploitation needs no privileges on the victim kernel; a remote SIP endpoint only has to send malicious SIP through an already-configured SIP conntrack/NAT helper, with no authentication or local access to the firewall or router.\nUI:N - No victim user action is required beyond normal automated packet forwarding; the SIP helper parses and NAT-rewrites attacker-supplied SIP data in softirq during connection-tracking confirmation without opening files, clicking links, or mounting filesystems.\nS:U - Impact stays within kernel netfilter/conntrack memory on the same security authority (for example a NAT firewall, SBC, or VoIP gateway). This is standard kernel memory corruption, not a VM escape, sandbox breakout, or cross-tenant boundary violation.\nC:H - skb_ensure_writable() can free the old linear buffer while *dptr still points into it; sip_help_tcp() then continues parsing with that stale pointer, giving a use-after-free read of freed skb data and enabling disclosure of adjacent kernel heap contents.\nI:H - The stale dptr UAF and, on TCP flows, mistaken nf_nat_mangle_udp_packet() header rewriting corrupt kernel packet-buffer memory; such heap corruption is exploitable with grooming for arbitrary writes, control-flow hijacking, and kernel code execution.\nA:H - Use-after-free and mis-mangled L4 headers during softirq SIP NAT processing can trigger kernel oops/panic or reliably drop or corrupt in-flight VoIP signaling, causing high availability impact on internet-facing NAT/SBC systems handling SIP."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72251","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72262","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl on /dev/snd/controlC* (SNDRV_CTL_IOCTL_TLV_WRITE/READ) through the ALSA control device; there is no network, adjacent-radio, or physical-bus attack surface for this SOF IPC3 kcontrol path.\nAC:L - On affected SOF IPC3 systems with topology bytes_ext controls, an attacker can deterministically trigger the bug by issuing TLV writes with header.length equal to max_size, causing copy_from_user/memcpy to overrun the kzalloc(max_size) buffer by sizeof(struct sof_ipc_ctrl_data).\nPR:L - The fix commit states the overflow is reachable from unprivileged userspace via ALSA TLV kcontrols; any local user who can open the sound control device (typically membership in the audio group on Linux, or an app with audio access on Android/ChromeOS) can reach the vulnerable code without real root.\nUI:N - Exploitation is performed entirely by the attacker issuing ALSA TLV ioctls against an existing bytes_ext kcontrol; no victim click, mount, or other interactive action beyond the attacker's own access to the sound control interface is required.\nS:U - The vulnerability corrupts kernel heap memory from a local userspace context and enables standard kernel privilege escalation or denial of service; it does not cross a VM, container, or IOMMU security boundary into a separate authority.\nC:H - The get path can copy_to_user up to sizeof(struct sof_ipc_ctrl_data) bytes beyond the allocated ipc_control_data buffer, leaking adjacent kernel heap contents; combined with the controllable overflow, this is an out-of-bounds read/memory corruption primitive consistent with arbitrary disclosure potential.\nI:H - The put path performs an out-of-bounds heap write of up to sizeof(struct sof_ipc_ctrl_data) bytes past the kzalloc(max_size) allocation (including via the err_restore memcpy), enabling heap metadata/object corruption that can be developed into arbitrary kernel write or code execution.\nA:H - Heap out-of-bounds writes of roughly 96 bytes into adjacent slab objects can corrupt kernel structures and trigger oops/panic or wedged audio/subsystem state; repeated TLV operations make denial of service reliably achievable even without full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72262","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72288","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is reached only from KVM guest MMIO traps on GICv3 redistributor GICR_CTLR LPI-disable writes, ITS MOVI affinity changes, and vCPU-exit paths into vgic_prune_ap_list(); no network-facing host protocol is involved.\nAC:L - A guest controls all three racing vCPUs by pinning threads to concurrently issue ITS MOVI, cross-vCPU GICR_CTLR LPI-disable writes, and vCPU exits that invoke vgic_prune_ap_list(); the attacker creates and wins the race rather than depending on uncontrollable host timing.\nPR:N - No host privileges are required beyond running code in an assigned KVM guest (e.g. a cloud VM tenant on arm64); exploitation needs guest-kernel access to GIC/ITS MMIO, not host root or capabilities in the init namespace.\nUI:N - Exploitation is fully attacker-driven from within a multi-vCPU guest VM and does not require any victim user or administrator action on the host.\nS:C - The use-after-free corrupts host-kernel heap memory (struct vgic_irq) from guest-controlled VGIC operations, crossing the guest-to-host virtualization security boundary with VM-escape impact.\nC:H - vgic_flush_pending_lpis() can free the LPI vgic_irq while vgic_prune_ap_list() still dereferences it after reacquiring dropped locks, yielding a kernel heap use-after-free exploitable for arbitrary host memory disclosure via heap grooming.\nI:H - The dangling vgic_irq pointer permits attacker-influenced writes through irq_lock, list_head, vcpu, and target_vcpu fields during ap_list migration, enabling host control-flow or data corruption primitives.\nA:H - The race frees live kernel objects still referenced by the ap_list migration path, causing host kernel oops, panic, or hang during list_del, lock operations, or subsequent LPI delivery on arm64 KVM hosts."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72288","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72289","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only from KVM guest execution paths—GICv3 redistributor GICR_CTLR LPI-disable MMIO traps into vgic_flush_pending_lpis() and vCPU exit/sync paths into vgic_prune_ap_list()—not from any remote network, adjacent-radio, or physical-device interface on the host.\nAC:L - A malicious multi-vCPU guest controls both racing sides by pinning threads, changing LPI affinity via ITS so an interrupt must migrate off one vCPU's ap_list, and concurrently disabling LPIS on that redistributor; the attacker creates the window rather than depending on uncontrollable host timing or memory layout.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant on arm64 KVM who needs no host privileges beyond code already running inside the assigned guest; exploitation uses guest-kernel GIC MMIO/ITS operations, not host root, CAP_SYS_ADMIN in the init namespace, or additional /dev/kvm access beyond having a VM.\nUI:N - Exploitation is fully attacker-driven from within the guest VM through deliberate LPI setup, affinity changes, and timed GICR_CTLR writes; no victim user or administrator action on the host is required beyond normal VM operation.\nS:C - Double list_del()/list_add_tail() on host-kernel ap_list linkages corrupts KVM VGIC state from guest-controlled interrupt operations, crossing the guest-to-host virtualization security boundary with VM-escape-class impact rather than confining damage to the attacker's VM.\nC:H - Corrupting detached ap_list pointers and inserting them into another vCPU's ap_list_head enables out-of-bounds kernel linked-list traversal and disclosure of adjacent kmalloc slab memory (struct vgic_irq and neighboring objects); per kernel guidance, this list corruption is leverageable for arbitrary host memory read primitives.\nI:H - The vulnerable path performs list_del() on an already removed entry and may follow with list_add_tail() onto another vCPU's ap_list, letting a guest steer kernel list pointers and overwrite adjacent vgic_irq/host heap metadata for control-flow or data corruption on the hypervisor.\nA:H - Re-running list_del() on an entry already removed by vgic_flush_pending_lpis() dereferences poisoned list pointers and corrupts live ap_list_heads, causing immediate host kernel BUG/oops/panic or persistent interrupt-delivery failure during subsequent VGIC processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72289","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72317","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The flaw is in the SUNRPC TCP-with-TLS client connect_worker processing a remote NFS server's TLS handshake; a malicious or misconfigured server can induce fatal handshake failure over the network before the delayed worker runs, matching network-reachable kTLS/RPC-with-TLS client paths.\nAC:L - An attacker operating a reachable NFS endpoint can reliably cause fatal TLS handshake failure (e.g., reject mTLS client certificates or send TLS alerts) and influence reconnect timing/backoff so client teardown frees rpc_clnt before the queued connect_worker executes.\nPR:N - Exploitation requires no privileges on the victim host; a remote peer only needs the client kernel to initiate or re-establish an NFS RPC-with-TLS connection, and TLS handshake processing occurs before NFS authentication completes.\nUI:N - No further victim action is needed once an NFS xprtsec=tls/mtls mount exists because automatic reconnect after server-induced disconnect or handshake failure can trigger the race without additional user interaction.\nS:U - Impact is confined to kernel memory corruption and privilege boundaries within the same host; this is standard local kernel compromise rather than crossing VM, container, or IOMMU security scopes.\nC:H - This is a kernel heap use-after-free where xs_tcp_tls_setup_socket reads multiple fields from a freed rpc_clnt (including cl_cred and cl_program), enabling information disclosure and further exploitation beyond a simple crash.\nI:H - Use-after-free of rpc_clnt permits corrupting allocator metadata and adjacent kernel objects; freed-object reuse can yield arbitrary write or control-flow hijack primitives, not merely authenticated data alteration.\nA:H - Accessing the freed rpc_clnt produces a refcount_t underflow and kernel oops/panic; even unsuccessful exploitation typically crashes or hangs the system, and repeated reconnect attempts can deny availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72317","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72339","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the qede NIC RX fastpath reached when remote Ethernet frames are received, hardware posts completion queue entries, and NAPI runs qede_poll() -> qede_rx_int() -> qede_rx_process_cqe()/qede_tpa_start() into qede_rx_build_skb() or qede_tpa_rx_build_skb().\nAC:L - An attacker can reliably trigger build_skb() NULL returns by flooding the interface with frames larger than rx_copybreak (256 bytes) to exhaust GFP_ATOMIC skb slab allocations, then the off-by-one BD consumption desynchronizes the ring without races or victim-specific state.\nPR:N - No local account, capability, or authentication is required; any unauthenticated remote host that can send IP/Ethernet traffic to a server using a Marvell/QLogic FastLinQ qede NIC can hit the vulnerable RX/TPA handlers.\nUI:N - Exploitation requires no victim interaction beyond normal network operation; packet reception, MSI-X interrupt handling, and NAPI polling process attacker-supplied frames automatically in kernel context.\nS:U - The flaw corrupts kernel heap metadata (DMA page refcounts and SLUB freelists) within the host kernel security boundary; it does not by itself cross VM, container, or IOMMU isolation boundaries.\nC:H - BD ring desynchronization corrupts DMA page reference counts and can corrupt SLUB freelists; this class of kernel heap corruption is exploitable for arbitrary kernel memory reads and information disclosure beyond a simple crash.\nI:H - SLUB freelist corruption from mismatched BD ring consumption enables arbitrary kernel memory writes and control-flow hijacking primitives, supporting local privilege escalation or arbitrary code execution in kernel context.\nA:H - Reference-count and SLUB corruption from the desynchronized BD ring can cause kernel BUG/oops/panic or a wedged RX datapath, resulting in complete loss of host availability on affected systems."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72339","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-72389","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation is via local RTNETLINK/ioctl to create a down bridge, enable kernel STP, enslave ports, and delete the bridge; remote STP BPDU handling is blocked when IFF_UP is clear, so the arming path that leaves timers active on a down bridge is local.\nAC:L - The public PoC uses a reliable, attacker-controlled netlink sequence (down bridge + kernel STP + port state progression + dellink) without winning races; per-port forward-delay timers deterministically reach br_topology_change_detection and arm topology_change_timer before deletion.\nPR:L - All reachable paths (RTM_NEWLINK/DELLINK, IFLA_BR_STP_STATE, enslaving ports) require CAP_NET_ADMIN, which unprivileged users can obtain in user/network namespaces (unshare -Urn, Kubernetes NET_ADMIN, LXC/libvirt network namespaces).\nUI:N - Triggering requires only programmatic bridge configuration by the attacker; no victim must click, mount, or open anything beyond the attacker's own netlink operations.\nS:U - Impact is kernel memory corruption and privilege escalation within the same kernel/host security domain; it does not cross a VM, container-to-host, or IOMMU boundary by itself.\nC:H - Use-after-free of the net_device/net_bridge kmalloc object lets an attacker reclaim freed slab memory and obtain arbitrary kernel read/disclosure primitives from corrupted timer and bridge structures.\nI:H - Disclosed analysis and PoC show the dangling timer callback can hijack control flow by reclaiming the freed object with attacker-controlled data, replacing the timer function pointer for arbitrary kernel code execution.\nA:H - Deleting the bridge with active STP timers queued causes the per-CPU timer wheel to invoke callbacks on freed memory, producing kernel BUG/oops/panics and denial of service even if full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-72389","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74345","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit while processing attacker-supplied MPA/TCP data on an inbound SIW listener socket during connection establishment, which is a standard network protocol path analogous to other in-kernel TCP service handlers.\nAC:L - An attacker fully controls the TCP connection and malformed MPA request bytes that deterministically fail parsing and drive the endpoint teardown path where the refcount bug frees the cep before it is accessed again.\nPR:N - Exploitation requires only the ability to open a TCP connection to a host running an SIW RDMA listener; the MPA handshake is unauthenticated and occurs before any RDMA credentials or local privileges are established.\nUI:N - No end-user action is required at exploit time; the kernel processes the malicious inbound connection automatically once an administrator has started an RDMA listener service.\nS:U - Impact is confined to kernel memory corruption and potential host privilege escalation within the same kernel security authority, not a VM escape or cross-authority boundary such as guest-to-hypervisor.\nC:H - The vulnerability is a slab use-after-free on a freed siw_cep object; UAF on attacker-influenced connection teardown enables heap grooming and arbitrary kernel memory read primitives beyond a simple crash.\nI:H - Use-after-free of the connection endpoint structure in kernel heap can be leveraged for controlled writes and code execution via object reuse and function pointer/callback corruption, not merely data integrity of a single field.\nA:H - The bug was reproduced as a KASAN slab-use-after-free in siw_cm_work_handler during malformed MPA processing, which can cause kernel oops/panic and denial of service on the target host."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74345","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74377","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires mutating mmap'd receive WQEs through /dev/infiniband/uverbs; inbound RoCE packets (rxe_udp_encap_recv→rxe_rcv→rxe_receiver) only trigger processing and cannot alter WQE fields without local control of the userspace-mapped receive queue.\nAC:L - The attacker controls both sides of the TOCTOU—userspace threads racing num_sge/sge edits while posting recv WRs and driving inbound RoCE SEND/WRITE traffic—so out-of-bounds reads in rxe_resp_check_length() and copy_data() are reliably triggerable with retries.\nPR:L - uverbs_devnode() publishes /dev/infiniband/uverbsN as mode 0666, letting any local account create userspace QPs and mmap receive queues; rxe link setup needs CAP_NET_ADMIN obtainable in a user+network namespace via unshare -Urn, matching PR:L kernel guidance.\nUI:N - Exploitation is entirely self-driven from the attacker's own RDMA verbs client and concurrent userspace threads; no victim user action, mount, or file open is required.\nS:U - Impact is kernel memory corruption and local privilege escalation within the host kernel security authority, not a VM guest-to-host escape, IOMMU/DMA boundary bypass, or other cross-scope compromise.\nC:H - Inflating num_sge or rewriting sge entries during processing causes out-of-bounds reads in rxe_resp_check_length() and copy_data() beyond the allocated WQE slot, potentially into adjacent vmalloc/kernel memory, enabling arbitrary kernel information disclosure.\nI:H - copy_data() walks attacker-forged out-of-bounds sge entries and performs rxe_mr_copy writes of incoming RDMA payload into MR-backed memory; combined with queue overruns this yields controlled memory corruption exploitable for arbitrary write and code execution.\nA:H - Processing a WQE with an attacker-inflated num_sge causes the kernel to walk far past valid sge slots, dereferencing invalid pointers and corrupting memory, reliably producing kernel oops/panic and total loss of availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74377","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74378","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local process with mmap write access to the SRQ receive queue shared with the kernel; although incoming RoCE/UDP packets trigger get_srq_wqe(), a remote peer cannot modify num_sge in the victim's userspace-mapped WQE buffer, so the TOCTOU overflow cannot be achieved from the network alone.\nAC:L - The attacker controls both sides of the race: a userspace thread that repeatedly rewrites num_sge in the mmap'd SRQ entry and the thread/process that posts recv WQEs and receives the triggering RoCE Send/Write packet, making the TOCTOU window reliably winnable without external timing luck.\nPR:L - An unprivileged local user with access to /dev/infiniband/uverbs can create an SRQ (mmap'd queue), associate a QP, and post recv buffers via ibverbs; rxe device setup via \"rdma link add type rxe\" is reachable with CAP_NET_ADMIN inside a user namespace (unshare -Urn).\nUI:N - No victim user interaction is required; the attacker operates their own malicious RDMA userspace process and can self-trigger the vulnerable responder path with RoCE request packets once SRQ/QP resources are configured.\nS:U - The heap overflow corrupts kernel memory within the rxe_qp responder context on the same host kernel, enabling local privilege escalation rather than crossing a VM, container, or IOMMU security boundary to impact a different authority.\nC:H - The attacker-controlled memcpy size causes an out-of-bounds copy from the mmap'd SRQ ring buffer and overflows the fixed qp->resp.srq_wqe kernel buffer, enabling adjacent kernel heap data disclosure and providing primitives that can be developed into arbitrary kernel memory reads.\nI:H - Overflowing qp->resp.srq_wqe corrupts subsequent fields in rxe_resp_info/rxe_qp (e.g., responder resource pointers and state), giving a kernel heap buffer overflow that can be leveraged for arbitrary kernel memory writes and local privilege escalation.\nA:H - Corrupting responder state inside rxe_qp can cause kernel oops/panic or wedged RDMA processing during packet handling; even failed exploitation attempts can crash the kernel through use of corrupted function pointers and queue state."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74378","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74390","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl on /dev/infiniband/uverbs to register CQ/QP/SRQ memory via irdma_reg_user_mr; the bug is not reachable from remote iWARP/RoCE packet handling.\nAC:L - An attacker fully controls reg_type, cq_pages/sq_pages/rq_pages, and umem size; triggering lvl==0 with many DMA blocks is deterministic and needs no races or special memory layout.\nPR:L - Any unprivileged local user who can open the uverbs device (mode 0666) and use the RDMA NIC—typical on cloud/HPC RDMA nodes—can invoke the vulnerable MR registration path without real root.\nUI:N - No victim interaction is required; the attacker triggers the overflow directly through their own RDMA verbs memory registration calls.\nS:U - Impact is kernel heap corruption and privilege escalation within the host kernel security boundary, not a cross-VM or cross-IOMMU sandbox escape.\nC:H - The out-of-bounds write of attacker-influenced DMA addresses into adjacent irdma_mr/iwpbl heap metadata can be leveraged for arbitrary kernel memory read primitives, not merely a bounded leak.\nI:H - Controlled out-of-bounds u64 writes past pgaddrmem[4] corrupt adjacent kernel heap structures and are suitable for control-flow or arbitrary kernel write exploitation.\nA:H - Heap corruption in a kzalloc'd irdma_mr can cause immediate kernel oops/panic during registration or on subsequent use of corrupted queue memory metadata."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74390","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74394","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - SRPT is an in-kernel SCSI RDMA target reached by remote initiators over InfiniBand/RoCE via RDMA/IB CM; malicious SRP_CMD IUs are delivered through `srpt_recv_done()` without any local syscall or physical access.\nAC:L - Once connected on an immediate-data SRPT target (use_srq=0), a malicious initiator deterministically sets `imm_buf->len=0xFFFFFFFF` to wrap `req_size` and bypass checks; no race or attacker-uncontrollable condition is required.\nPR:N - SRPT enables LIO demo mode (`srpt_check_true`), so any remote initiator that completes SRP login on an enabled target gets a dynamic ACL without target-local credentials, root, or CAP_NET_ADMIN on the victim host.\nUI:N - Exploitation requires only attacker-initiated RDMA connection, SRP login, and crafted SRP_CMD traffic; no administrator or other user must mount storage or perform any action on the target.\nS:U - The integer overflow corrupts kernel heap memory and SCSI-target processing within the host kernel's own security authority; it does not cross VM, IOMMU, or container sandbox boundaries.\nC:H - Passing a ~4GB length to `sg_init_one()` on a small receive buffer creates a massive out-of-bounds scatterlist; subsequent target-core DMA/map operations can read far beyond the buffer, enabling arbitrary kernel memory disclosure.\nI:H - The bogus scatterlist gives the block/SCSI target path an attacker-controlled ~4GB kernel memory write/read primitive over adjacent heap objects, exploitable for control-flow hijacking and privilege escalation.\nA:H - Out-of-bounds access from a ~4GB scatterlist on a kilobyte-scale receive buffer readily triggers kernel oops, KASAN faults, or panic, denying availability even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74394","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74488","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when the mwifiex driver processes attacker-supplied A-MSDU TDLS frames received over WiFi from a nearby peer, AP, or injector on the same wireless segment, which is an adjacent RF attack vector rather than remote Internet or local syscall access.\nAC:L - Once TDLS-capable mwifiex firmware receives an A-MSDU, the attacker fully controls subframe sizes and TDLS content to trigger either the skb use-after-free or the overstated-length out-of-bounds parse reliably without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation requires only the ability to deliver crafted 802.11 data frames to the victim radio; it does not require any local account, capability, or root access on the Linux host and is not gated by user-namespace privilege boundaries.\nUI:N - No victim user action beyond normal wireless operation is required; the driver parses malicious TDLS subframes automatically during receive and A-MSDU decomposition before forwarding traffic to the network stack.\nS:U - Impact is confined to kernel memory corruption and driver state within the host kernel security authority; it does not by itself cross a VM, container, or IOMMU boundary to affect a separate security domain.\nC:H - The skb use-after-free reads freed sk_buff metadata and the inflated length drives an out-of-bounds IE walk that reads kernel memory beyond the subframe, including attacker-positioned bytes from subsequent A-MSDU subframes, enabling substantial information disclosure.\nI:H - The same out-of-bounds parse copies attacker-controlled IE data from beyond the subframe into heap-allocated sta_node/tdls_cap structures via memcpy, providing a memory-corruption primitive that can be developed into arbitrary kernel write or code execution.\nA:H - Reading skb->len after the parent A-MSDU skb may already be freed can immediately fault or corrupt memory, and the out-of-bounds TDLS element parsing can provoke kernel oopses or panics even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74488","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74496","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is opened only via local FOU_CMD_ADD genetlink into fou_create(); remote UDP can race the dangling sk_user_data read in fou_udp_recv/gue_udp_recv but cannot alone reach the erroneous teardown path.\nAC:L - An attacker with CAP_NET_ADMIN controls both sides: issue a second FOU_CMD_ADD with port 0 to force -EALREADY on fou_add_to_port_list while concurrently sending UDP/GRO traffic to the just-bound ephemeral socket during the kfree window.\nPR:L - FOU_CMD_ADD is gated by GENL_ADMIN_PERM (CAP_NET_ADMIN); the fou genl family is netnsok, so a user with CAP_NET_ADMIN inside unshare -Urn can configure FOU and trigger the failing add path without init-namespace root.\nUI:N - Exploitation is fully programmatic via concurrent netlink FOU_CMD_ADD requests and attacker-controlled UDP packets; no victim mount, file open, or other interactive action is required.\nS:U - Impact is kernel heap corruption and privilege escalation within the same security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - Concurrent readers call fou_from_sock() and dereference freed struct fou fields (family, protocol, flags); reclaimed slab contents give attacker-controlled reads and kernel pointer disclosure primitives typical of UAF.\nI:H - Freed struct fou is attacker-reclaimable kmalloc memory; fou_gro_receive indexes inet_offloads[fou->protocol] from the dangling pointer, enabling heap grooming for arbitrary writes and control-flow hijack.\nA:H - Use-after-free in UDP receive/GRO softirq reliably causes KASAN violations and, on production kernels, invalid pointer dereferences or panics when accessing the freed fou object during packet processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74496","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74516","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires triggering KVM nested SVM/AVIC paths via local /dev/kvm ioctls (KVM_CREATE_VM, KVM_CREATE_VCPU, KVM_RUN) from L1; there is no network, adjacent, or physical packet/device path to the vulnerable code.\nAC:L - An L1 attacker fully controls nested VM configuration (x2APIC, AVIC, L2 MSR bitmap, IRQ-window/ExtINT conditions) and can reliably reproduce AVIC inhibition while L2 is active without races or uncontrollable host state.\nPR:H - Reaching the bug requires running nested AMD KVM as L1 (nested virtualization enabled and control of a guest hypervisor), which is not available to an unprivileged host user or via user-namespace capabilities alone without delegated /dev/kvm access.\nUI:N - No victim interaction is required; exploitation is driven entirely by the attacker’s nested hypervisor configuration and KVM_RUN operations once nested virtualization is available.\nS:C - The flaw lets an L1 nested guest hypervisor access the host’s physical x2APIC MSRs, crossing the VM/host security boundary rather than staying within the guest’s own security scope.\nC:H - With x2APIC MSR intercepts left disabled, L1 can read most of the host APIC state (IDs, IRR/ISR, timers, ICR), leaking sensitive host interrupt-controller information beyond the guest boundary.\nI:H - L1 can write host x2APIC MSRs to send arbitrary IPIs, change task priority, and invoke host interrupt vectors (e.g. posted-interrupt wakeup), enabling host integrity compromise beyond mere guest-local effects.\nA:H - Host availability is trivially impacted by injecting spurious or high-priority interrupts to host CPUs; the fix commit demonstrates host kernel warnings and spurious interrupt storms causing denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74516","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74518","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local hugetlb reservation paths (mmap/memfd_create/fault syscalls into region_chg/region_add/region_del); no network protocol or remote packet handler invokes allocate_file_region_entries().\nAC:L - Exploitation needs a race while resv->lock is dropped during GFP_KERNEL allocation, but an attacker can spawn concurrent MAP_SHARED mappers/faulters on one hugetlb inode and controls both sides of that race.\nPR:L - Unprivileged local users can trigger this via memfd_create(MFD_HUGETLB) plus MAP_SHARED mmap/fault activity, or by mapping accessible shared hugetlbfs files, without init-namespace root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the needed concurrent syscalls and shared hugetlb mappings themselves to hit the corrupted list splice retry path.\nS:U - Impact is kernel hugetlb resv_map list/memory corruption on the host; it does not by itself cross a VM, IOMMU, or separate security-authority boundary even though KVM/DPDK hosts are a prime deployment.\nC:H - Without CONFIG_DEBUG_LIST, stale list_splice leaves a kernel-stack pointer in resv->region_cache, producing later use-after-free that can be turned into arbitrary kernel memory read/disclosure primitives.\nI:H - Corrupted region_cache pointers let subsequent region_add/region_del/cache operations write through attacker-influenced list links, enabling heap metadata corruption and potential arbitrary kernel write or code execution.\nA:H - Real host panics were reported on dense KVM hugetlb workloads; DEBUG_LIST kernels BUG on list_add corruption, and default builds can crash from UAF while walking the poisoned region_cache."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74518","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74537","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is in the Bluetooth ISO stack; iso_conn_ready runs from HCI connection-confirmation events (CIS/BIS/PA sync) driven by LE isochronous traffic from Bluetooth peers within radio range, which is an adjacent attack surface (phones, earbuds, automotive, embedded).\nAC:L - This is a use-after-free race between iso_conn_ready and iso_sock_release/iso_sock_kill; an attacker who controls both an ISO socket close and concurrent HCI completion (e.g., dual-thread connect/close or rapid adjacent CIS/BIS establish-teardown) can reliably trigger it without uncontrollable conditions.\nPR:N - Exploitation requires no elevated credentials on the victim: HCI events are processed for any Bluetooth-enabled device in range, and the racing socket close can occur from automatic stack/daemon teardown during connection setup without the victim performing privileged local actions.\nUI:N - No victim interaction is required when the OS Bluetooth stack (e.g., LE Audio on Android phones or bluetoothd on Linux) automatically manages ISO sockets during pairing, reconnection, or broadcast sync while processing peer-initiated CIS/BIS traffic.\nS:U - The UAF corrupts kernel socket memory and can enable local privilege escalation within the kernel; it does not cross a VM, container, or IOMMU security boundary, so scope remains unchanged.\nC:H - Use-after-free on struct sock after iso_sock_kill frees the socket lets an attacker dereference attacker-influenced freed heap memory, enabling arbitrary kernel memory disclosure via heap grooming and reuse of the sock object.\nI:H - The UAF touches sk->sk_state and sk->sk_state_change during iso_sock_ready on a freed sock, providing a standard kernel heap corruption primitive that can be leveraged for arbitrary write and control-flow hijack.\nA:H - Concurrent iso_sock_kill and iso_conn_ready can dereference freed socket memory, causing kernel oops/panic from invalid lock_sock/sk_state access; UAF in the Bluetooth ISO path is inherently a high-availability risk even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74537","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74556","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - A malicious or compromised iSCSI target delivers crafted SCSI Command Response PDUs over the established TCP iSCSI session; reception flows through iscsi_sw_tcp_recv/iscsi_tcp_recv_skb into iscsi_tcp_hdr_dissect without local access.\nAC:L - The attacker controls the target and can set DataSegmentLength between 8193 and negotiated max_recv_dlength (open-iscsi commonly 262144) on SCSI_CMD_RSP for any outstanding command ITT; no races or victim-specific heap layout are required.\nPR:N - No privileges on the victim host are needed; a remote attacker acting as or MITMing the iSCSI target sends malicious responses after session login, independent of victim user accounts or capabilities.\nUI:N - On systems with persistent iSCSI sessions (cloud VMs, SAN-boot hosts, Kubernetes iSCSI volumes), exploitation triggers automatically during normal SCSI I/O when command responses are received; no victim action is needed at attack time.\nS:U - Heap corruption is confined to the kernel iSCSI initiator on the affected host; successful exploitation yields kernel compromise or DoS within the same security authority, not a VM escape or cross-boundary scope change.\nC:H - iscsi_tcp_segment_recv memcpy writes up to max_recv_dlength bytes into an 8192-byte conn->data buffer, causing a large heap overflow whose controlled corruption can be leveraged for arbitrary kernel memory disclosure.\nI:H - Attacker-controlled response data is copied past the fixed conn->data allocation via iscsi_tcp_data_recv_prep/iscsi_segment_init_linear, enabling heap metadata/object corruption exploitable for arbitrary kernel write and privilege escalation.\nA:H - Overflowing the conn->data heap buffer can immediately corrupt adjacent kernel allocations and cause oops/panic; a malicious target can repeatedly trigger this on active sessions to deny storage availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74556","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74581","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - fib6_rule_suppress() runs on every IPv6 route lookup via fib6_rule_lookup(), including ip6_route_input() for received packets and icmp6/icmpv6 redirect handlers; WireGuard/VPN servers commonly deploy suppress_prefixlength rules (wg-quick), so remote IPv6 traffic to those hosts reaches the bug.\nAC:L - Once suppress_prefixlength IPv6 policy routing rules exist, any matching packet deterministically triggers fib6_rule_suppress() to release the route while leaving a stale res->rt6 pointer; no race or uncontrollable memory layout is required.\nPR:N - Remote exploitation needs only the ability to send IPv6 packets through a host whose operator already configured suppress rules (e.g., wg-quick); CAP_NET_ADMIN is an admin deployment prerequisite, not attacker privilege on the target.\nUI:N - No victim action is required beyond normal delivery of attacker-generated IPv6 traffic (or ICMPv6 redirect) to a host performing policy-route lookup.\nS:U - The stale rt6_info/dst_entry UAF corrupts kernel heap memory within the same host security boundary; it is not a VM escape or cross-authority sandbox break.\nC:H - Returning a released rt6_info leaves a dangling dst_entry in ip6_dst_cache; subsequent reads through ip6_dst_idev(), dst metrics, or error paths are classic slab UAF with attacker-influencable heap reuse via sustained IPv6 traffic.\nI:H - Double-free/imbalanced rcuref put and post-free use of rt6_info fields give heap corruption primitives; UAF on dst/route cache objects is routinely leveraged for kernel write and control-flow hijack.\nA:H - Commit explicitly reports rcuref_put_slowpath() WARN from dst_release() on the freed route; UAF and refcount corruption can oops/panic the kernel, fully denying availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74582","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in packet_snd() and packet_sendmsg_spkt() on the local AF_PACKET sendmsg() transmit path; it is not triggered by processing remotely received network traffic or pre-authentication network services.\nAC:L - An attacker in a user+network namespace can open an AF_PACKET SOCK_RAW socket and concurrently reconfigure the bound netdev (bonding/VLAN/macvlan/team) to change hard_header_len, controlling both sides of the race without external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket sendmsg calls and concurrent netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can place skb->data before skb->head, and skb_copy_datagram_from_iter/memcpy_from_msg then writes attacker-controlled data outside the skb buffer, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and header adjustment causes out-of-bounds kernel heap writes of attacker-controlled packet data, yielding corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds skb buffer writes corrupt kmalloc metadata and can trigger kernel oops/panic, causing reliable denial of service even when full exploitation is not completed."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74582","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74612","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":10,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Remote packets routed through container/host veth pairs reach veth_xdp_rcv_skb() after veth_xmit on the peer; cloud and edge nodes routinely forward Internet traffic across veth links with XDP attached, matching the reproduced UDP receive path.\nAC:L - The fix commit shows 10/10 reliable reproduction with a 60000-byte UDP datagram and XDP bpf_xdp_adjust_tail()/bpf_xdp_pull_data() fragment shrink; the attacker controls packet size, timing, and both veth ends without races or uncontrollable kernel state.\nPR:N - Exploitation only requires an XDP program using bpf_xdp_adjust_tail or bpf_xdp_pull_data to already be attached on a reachable veth peer; the remote packet sender needs no local account, capabilities, or authentication to trigger the bad skb length accounting.\nUI:N - No victim interaction is needed beyond normal always-on packet reception and socket delivery; corrupted payloads and leaked kernel metadata are produced automatically when a userspace process reads the affected datagram.\nS:C - veth links intentionally cross container/host network namespaces on multi-tenant servers, and skb_shared_info metadata plus kernel pointers leaked into a tenant userspace recv buffer exceed that tenant's authorized security boundary.\nC:H - Desynchronized skb->len makes skb_headlen() exceed the real linear tail, so __skb_datagram_iter() copies up to 1024 bytes past the skb into userspace, exposing nr_frags, xdp_frags_size, and a kernel pointer from skb_shinfo(skb)->frags[0].\nI:H - The same length mismatch inflates the linear region, displacing and truncating real datagram bytes in the delivered UDP buffer and corrupting application-visible data beyond intended packet bounds while compounding misuse of leaked kernel metadata.\nA:H - bpf_xdp_pull_data() can leave frags present while the old __skb_put() path hits SKB_LINEAR_ASSERT()/BUG_ON on nonlinear skbs; the commit reports deterministic kernel asserts and crashes in addition to datagram corruption."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74612","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74669","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74669","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-74695","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug fires in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS when remotely sourced IPv4/IPv6 packets matching an offloaded flow are received on nftables flowtable-bound interfaces, not via netlink configuration APIs.\nAC:L - Once a flowtable ingress hook and offloaded TCP/UDP flow exist, an attacker can reliably send matching traffic that reaches FLOW_OFFLOAD_XMIT_NEIGH or the XFRM offload path with a ref-counted skb dst; syzbot reproduced this without uncontrollable races.\nPR:N - Exploitation requires only sending network traffic through an already deployed nftables flow-offload path on an ingress device; no local account, authentication, or CAP_NET_ADMIN on the victim is needed to trigger the leak.\nUI:N - No victim interaction is required beyond normal network delivery; packets are processed automatically in softirq on the netdev ingress netfilter hook without opening files or mounting filesystems.\nS:U - Impact is confined to kernel refcount imbalance and availability degradation on the affected host; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:N - The flaw leaks a dst_entry reference by overwriting skb->_skb_refdst without releasing the prior dst; it does not expose kernel memory or provide an arbitrary read primitive.\nI:N - No unauthorized data modification occurs; the skb is forwarded using the intended flowtable destination while the previous dst reference is orphaned, not corrupted into a controllable write primitive.\nA:H - Each matching packet leaks a dst_entry refcount on the flowtable fast path, enabling sustained unauthenticated remote memory exhaustion on high-volume routers; CONFIG_DEBUG_NET builds also emit WARN_ON_ONCE during the overwrite."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74695","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-80722","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - Malformed S1G TWT setup action frames reach mac80211 via normal WiFi RX (driver -> ieee80211_rx_h_action -> ieee80211_process_rx_twt_action -> ieee80211_s1g_rx_twt_setup); an adjacent attacker within radio range sends crafted 802.11 management frames to a vulnerable AP.\nAC:L - The attacker fully controls the TWT element length and payload; ieee80211_process_rx_twt_action() only validates two bytes of req_type before queueing, so a short individual agreement reliably reaches drv_add_twt_setup() without races or victim-specific timing.\nPR:N - No Linux privileges on the victim AP are required; exploitation needs only normal 802.11 association as a WiFi client to an S1G AP with twt_responder enabled and a driver implementing add_twt_setup (e.g. MediaTek mt7915/mt7996).\nUI:N - No deliberate victim action is needed beyond operating an S1G AP that accepts associated stations; the attacker directly injects the malformed TWT setup frame and mac80211 processes it automatically on receive.\nS:U - Impact is kernel/driver heap memory corruption on the AP host within the same security authority; it does not cross VM, IOMMU, or sandbox boundaries (standard kernel compromise scope).\nC:H - drv_add_twt_setup(), its tracepoint, and driver callbacks read the full ieee80211_twt_params (twt, min_twt_dur, mantissa, channel) beyond the validated skb bounds, causing out-of-bounds reads of adjacent skb/heap memory that can disclose kernel data.\nI:H - MediaTek add_twt_setup() handlers write twt_agrt fields (req_type, min_twt_dur, twt) past the undersized params block into skb tail/heap memory, providing out-of-bounds write primitives exploitable for further memory corruption or code execution.\nA:H - Out-of-bounds access in mac80211/driver TWT setup can kernel-oops the AP or hang/crash WiFi firmware when corrupted parameters are programmed into hardware TWT state from attacker-controlled short frames."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80722","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4369-1","advisory_id":"ddb2c304-0ccc-4573-96b3-606b178f0dff","event_types":["advisory"],"published_at":"2026-10-25T22:45:55.826745+00:00","technologies":["core-osv","kernel-64kb","kernel-default","kernel-default-base","kernel-docs","kernel-livepatch-sle15-sp6-update-31","kernel-obs-build","kernel-source","kernel-syms","kernel-zfcpdump"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T12:46:28+00:00","detail_url":"/events/71343"}]}},{"id":70967,"cve_ids":["CVE-2026-31482","CVE-2026-31483","CVE-2026-31542","CVE-2026-31598","CVE-2026-31628","CVE-2026-43033","CVE-2026-43046","CVE-2026-43056","CVE-2026-43276","CVE-2026-43440","CVE-2026-43475","CVE-2026-45904","CVE-2026-46056","CVE-2026-46080","CVE-2026-46084","CVE-2026-46109","CVE-2026-46117","CVE-2026-46126","CVE-2026-46144","CVE-2026-46145","CVE-2026-46174","CVE-2026-46193","CVE-2026-46243","CVE-2026-46323","CVE-2026-46324","CVE-2026-46333","CVE-2026-52967","CVE-2026-52986","CVE-2026-53050","CVE-2026-53129","CVE-2026-53131","CVE-2026-53177","CVE-2026-53224","CVE-2026-53246","CVE-2026-53250","CVE-2026-53262","CVE-2026-53267","CVE-2026-53297","CVE-2026-53324","CVE-2026-53354","CVE-2026-53375","CVE-2026-53388","CVE-2026-53391","CVE-2026-53402","CVE-2026-63794","CVE-2026-63802","CVE-2026-63806","CVE-2026-63807","CVE-2026-63824","CVE-2026-63826","CVE-2026-63829","CVE-2026-63884","CVE-2026-63893","CVE-2026-63912","CVE-2026-63917","CVE-2026-63919","CVE-2026-63921","CVE-2026-63922","CVE-2026-63924","CVE-2026-63946","CVE-2026-63952","CVE-2026-63968","CVE-2026-63971","CVE-2026-63975","CVE-2026-63984","CVE-2026-63994","CVE-2026-64106","CVE-2026-64189","CVE-2026-64530","CVE-2026-64560","CVE-2026-64561","CVE-2026-64564","CVE-2026-64600"],"payload":{"kind":"advisory","title":"Security update for the Linux Kernel","summary":"The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435). - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656). - CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995). - CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181). - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289). - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188). - CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633). - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773). - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997). - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988). - CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808). - CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000). - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577). - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230). - CVE-2026-53375: drm/amdgpu/vce: ","evidence":"osv:SUSE-SU-2026:3602-1","products":[{"name":{"value":"kernel-default","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-livepatch-SLE15-SP6_Update_30","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1-150600.13.5.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-64kb","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1.150600.12.60.3","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-zfcpdump","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1.150600.12.60.3","evidence":"/affected/12/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/13/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/13/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/14/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/14/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/15/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/15/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/16/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/16/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:3602-1","aliases":["SUSE-SU-2026:3602-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.130.1","kernel-default-livepatch-devel":"6.4.0-150600.23.130.1","kernel-livepatch-6_4_0-150600_23_130-default":"1-150600.13.5.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.5.1"}]}],"package":{"name":"kernel-livepatch-SLE15-SP6_Update_30","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_30&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.130.1","kernel-default-livepatch-devel":"6.4.0-150600.23.130.1","kernel-livepatch-6_4_0-150600_23_130-default":"1-150600.13.5.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-64kb","purl":"pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1.150600.12.60.3"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-zfcpdump","purl":"pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1.150600.12.60.3"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}}],"modified":"2026-10-02T18:42:47.946147883Z","provider":"osv","upstream":["CVE-2026-31482","CVE-2026-31483","CVE-2026-31542","CVE-2026-31598","CVE-2026-31628","CVE-2026-43033","CVE-2026-43046","CVE-2026-43056","CVE-2026-43276","CVE-2026-43440","CVE-2026-43475","CVE-2026-45904","CVE-2026-46056","CVE-2026-46080","CVE-2026-46084","CVE-2026-46109","CVE-2026-46117","CVE-2026-46126","CVE-2026-46144","CVE-2026-46145","CVE-2026-46174","CVE-2026-46193","CVE-2026-46243","CVE-2026-46323","CVE-2026-46324","CVE-2026-46333","CVE-2026-52967","CVE-2026-52986","CVE-2026-53050","CVE-2026-53129","CVE-2026-53131","CVE-2026-53177","CVE-2026-53224","CVE-2026-53246","CVE-2026-53250","CVE-2026-53262","CVE-2026-53267","CVE-2026-53297","CVE-2026-53324","CVE-2026-53354","CVE-2026-53375","CVE-2026-53388","CVE-2026-53391","CVE-2026-53402","CVE-2026-63794","CVE-2026-63802","CVE-2026-63806","CVE-2026-63807","CVE-2026-63824","CVE-2026-63826","CVE-2026-63829","CVE-2026-63884","CVE-2026-63893","CVE-2026-63912","CVE-2026-63917","CVE-2026-63919","CVE-2026-63921","CVE-2026-63922","CVE-2026-63924","CVE-2026-63946","CVE-2026-63952","CVE-2026-63968","CVE-2026-63971","CVE-2026-63975","CVE-2026-63984","CVE-2026-63994","CVE-2026-64106","CVE-2026-64189","CVE-2026-64530","CVE-2026-64560","CVE-2026-64561","CVE-2026-64564","CVE-2026-64600"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20263602-1/","https://bugzilla.suse.com/1185845","https://bugzilla.suse.com/1253262","https://bugzilla.suse.com/1258718","https://bugzilla.suse.com/1260347","https://bugzilla.suse.com/1262745","https://bugzilla.suse.com/1262771","https://bugzilla.suse.com/1263010","https://bugzilla.suse.com/1263068","https://bugzilla.suse.com/1263718","https://bugzilla.suse.com/1263788","https://bugzilla.suse.com/1264053","https://bugzilla.suse.com/1264089","https://bugzilla.suse.com/1264090","https://bugzilla.suse.com/1264558","https://bugzilla.suse.com/1264779","https://bugzilla.suse.com/1264795","https://bugzilla.suse.com/1265308","https://bugzilla.suse.com/1266238","https://bugzilla.suse.com/1266758","https://bugzilla.suse.com/1266850","https://bugzilla.suse.com/1266890","https://bugzilla.suse.com/1266913","https://bugzilla.suse.com/1267375","https://bugzilla.suse.com/1267384","https://bugzilla.suse.com/1267435","https://bugzilla.suse.com/1267584","https://bugzilla.suse.com/1267596","https://bugzilla.suse.com/1267656","https://bugzilla.suse.com/1267682","https://bugzilla.suse.com/1267715","https://bugzilla.suse.com/1267995","https://bugzilla.suse.com/1268029","https://bugzilla.suse.com/1268307","https://bugzilla.suse.com/1269181","https://bugzilla.suse.com/1269188","https://bugzilla.suse.com/1269289","https://bugzilla.suse.com/1269383","https://bugzilla.suse.com/1269512","https://bugzilla.suse.com/1269513","https://bugzilla.suse.com/1269577","https://bugzilla.suse.com/1269633","https://bugzilla.suse.com/1269773","https://bugzilla.suse.com/1269808","https://bugzilla.suse.com/1269981","https://bugzilla.suse.com/1269988","https://bugzilla.suse.com/1269997","https://bugzilla.suse.com/1270000","https://bugzilla.suse.com/1270230","https://bugzilla.suse.com/1271349","https://bugzilla.suse.com/1271368","https://bugzilla.suse.com/1271526","https://bugzilla.suse.com/1271825","https://bugzilla.suse.com/1271866","https://bugzilla.suse.com/1271899","https://bugzilla.suse.com/1271904","https://bugzilla.suse.com/1271908","https://bugzilla.suse.com/1271912","https://bugzilla.suse.com/1271964","https://bugzilla.suse.com/1272176","https://bugzilla.suse.com/1272180","https://bugzilla.suse.com/1272183","https://bugzilla.suse.com/1272207","https://bugzilla.suse.com/1272242","https://bugzilla.suse.com/1272263","https://bugzilla.suse.com/1272268","https://bugzilla.suse.com/1272282","https://bugzilla.suse.com/1272466","https://bugzilla.suse.com/1272468","https://bugzilla.suse.com/1272573","https://bugzilla.suse.com/1272607","https://bugzilla.suse.com/1272665","https://bugzilla.suse.com/1272678","https://bugzilla.suse.com/1272693","https://bugzilla.suse.com/1272694","https://bugzilla.suse.com/1272836","https://bugzilla.suse.com/1272855","https://bugzilla.suse.com/1272865","https://bugzilla.suse.com/1272904","https://bugzilla.suse.com/1272907","https://bugzilla.suse.com/1272918","https://bugzilla.suse.com/1273004","https://bugzilla.suse.com/1273035","https://bugzilla.suse.com/1273231","https://bugzilla.suse.com/1274072","https://www.suse.com/security/cve/CVE-2026-31482","https://www.suse.com/security/cve/CVE-2026-31483","https://www.suse.com/security/cve/CVE-2026-31542","https://www.suse.com/security/cve/CVE-2026-31598","https://www.suse.com/security/cve/CVE-2026-31628","https://www.suse.com/security/cve/CVE-2026-43033","https://www.suse.com/security/cve/CVE-2026-43046","https://www.suse.com/security/cve/CVE-2026-43056","https://www.suse.com/security/cve/CVE-2026-43276","https://www.suse.com/security/cve/CVE-2026-43440","https://www.suse.com/security/cve/CVE-2026-43475","https://www.suse.com/security/cve/CVE-2026-45904","https://www.suse.com/security/cve/CVE-2026-46056","https://www.suse.com/security/cve/CVE-2026-46080","https://www.suse.com/security/cve/CVE-2026-46084","https://www.suse.com/security/cve/CVE-2026-46109","https://www.suse.com/security/cve/CVE-2026-46117","https://www.suse.com/security/cve/CVE-2026-46126","https://www.suse.com/security/cve/CVE-2026-46144","https://www.suse.com/security/cve/CVE-2026-46145","https://www.suse.com/security/cve/CVE-2026-46174","https://www.suse.com/security/cve/CVE-2026-46193","https://www.suse.com/security/cve/CVE-2026-46243","https://www.suse.com/security/cve/CVE-2026-46323","https://www.suse.com/security/cve/CVE-2026-46324","https://www.suse.com/security/cve/CVE-2026-46333","https://www.suse.com/security/cve/CVE-2026-52967","https://www.suse.com/security/cve/CVE-2026-52986","https://www.suse.com/security/cve/CVE-2026-53050","https://www.suse.com/security/cve/CVE-2026-53129","https://www.suse.com/security/cve/CVE-2026-53131","https://www.suse.com/security/cve/CVE-2026-53177","https://www.suse.com/security/cve/CVE-2026-53224","https://www.suse.com/security/cve/CVE-2026-53246","https://www.suse.com/security/cve/CVE-2026-53250","https://www.suse.com/security/cve/CVE-2026-53262","https://www.suse.com/security/cve/CVE-2026-53267","https://www.suse.com/security/cve/CVE-2026-53297","https://www.suse.com/security/cve/CVE-2026-53324","https://www.suse.com/security/cve/CVE-2026-53354","https://www.suse.com/security/cve/CVE-2026-53375","https://www.suse.com/security/cve/CVE-2026-53388","https://www.suse.com/security/cve/CVE-2026-53391","https://www.suse.com/security/cve/CVE-2026-53402","https://www.suse.com/security/cve/CVE-2026-63794","https://www.suse.com/security/cve/CVE-2026-63802","https://www.suse.com/security/cve/CVE-2026-63806","https://www.suse.com/security/cve/CVE-2026-63807","https://www.suse.com/security/cve/CVE-2026-63824","https://www.suse.com/security/cve/CVE-2026-63826","https://www.suse.com/security/cve/CVE-2026-63829","https://www.suse.com/security/cve/CVE-2026-63884","https://www.suse.com/security/cve/CVE-2026-63893","https://www.suse.com/security/cve/CVE-2026-63912","https://www.suse.com/security/cve/CVE-2026-63917","https://www.suse.com/security/cve/CVE-2026-63919","https://www.suse.com/security/cve/CVE-2026-63921","https://www.suse.com/security/cve/CVE-2026-63922","https://www.suse.com/security/cve/CVE-2026-63924","https://www.suse.com/security/cve/CVE-2026-63946","https://www.suse.com/security/cve/CVE-2026-63952","https://www.suse.com/security/cve/CVE-2026-63968","https://www.suse.com/security/cve/CVE-2026-63971","https://www.suse.com/security/cve/CVE-2026-63975","https://www.suse.com/security/cve/CVE-2026-63984","https://www.suse.com/security/cve/CVE-2026-63994","https://www.suse.com/security/cve/CVE-2026-64106","https://www.suse.com/security/cve/CVE-2026-64189","https://www.suse.com/security/cve/CVE-2026-64530","https://www.suse.com/security/cve/CVE-2026-64560","https://www.suse.com/security/cve/CVE-2026-64561","https://www.suse.com/security/cve/CVE-2026-64564","https://www.suse.com/security/cve/CVE-2026-64600"]},"related_cves":[{"value":"CVE-2026-31482","evidence":"/upstream"},{"value":"CVE-2026-31483","evidence":"/upstream"},{"value":"CVE-2026-31542","evidence":"/upstream"},{"value":"CVE-2026-31598","evidence":"/upstream"},{"value":"CVE-2026-31628","evidence":"/upstream"},{"value":"CVE-2026-43033","evidence":"/upstream"},{"value":"CVE-2026-43046","evidence":"/upstream"},{"value":"CVE-2026-43056","evidence":"/upstream"},{"value":"CVE-2026-43276","evidence":"/upstream"},{"value":"CVE-2026-43440","evidence":"/upstream"},{"value":"CVE-2026-43475","evidence":"/upstream"},{"value":"CVE-2026-45904","evidence":"/upstream"},{"value":"CVE-2026-46056","evidence":"/upstream"},{"value":"CVE-2026-46080","evidence":"/upstream"},{"value":"CVE-2026-46084","evidence":"/upstream"},{"value":"CVE-2026-46109","evidence":"/upstream"},{"value":"CVE-2026-46117","evidence":"/upstream"},{"value":"CVE-2026-46126","evidence":"/upstream"},{"value":"CVE-2026-46144","evidence":"/upstream"},{"value":"CVE-2026-46145","evidence":"/upstream"},{"value":"CVE-2026-46174","evidence":"/upstream"},{"value":"CVE-2026-46193","evidence":"/upstream"},{"value":"CVE-2026-46243","evidence":"/upstream"},{"value":"CVE-2026-46323","evidence":"/upstream"},{"value":"CVE-2026-46324","evidence":"/upstream"},{"value":"CVE-2026-46333","evidence":"/upstream"},{"value":"CVE-2026-52967","evidence":"/upstream"},{"value":"CVE-2026-52986","evidence":"/upstream"},{"value":"CVE-2026-53050","evidence":"/upstream"},{"value":"CVE-2026-53129","evidence":"/upstream"},{"value":"CVE-2026-53131","evidence":"/upstream"},{"value":"CVE-2026-53177","evidence":"/upstream"},{"value":"CVE-2026-53224","evidence":"/upstream"},{"value":"CVE-2026-53246","evidence":"/upstream"},{"value":"CVE-2026-53250","evidence":"/upstream"},{"value":"CVE-2026-53262","evidence":"/upstream"},{"value":"CVE-2026-53267","evidence":"/upstream"},{"value":"CVE-2026-53297","evidence":"/upstream"},{"value":"CVE-2026-53324","evidence":"/upstream"},{"value":"CVE-2026-53354","evidence":"/upstream"},{"value":"CVE-2026-53375","evidence":"/upstream"},{"value":"CVE-2026-53388","evidence":"/upstream"},{"value":"CVE-2026-53391","evidence":"/upstream"},{"value":"CVE-2026-53402","evidence":"/upstream"},{"value":"CVE-2026-63794","evidence":"/upstream"},{"value":"CVE-2026-63802","evidence":"/upstream"},{"value":"CVE-2026-63806","evidence":"/upstream"},{"value":"CVE-2026-63807","evidence":"/upstream"},{"value":"CVE-2026-63824","evidence":"/upstream"},{"value":"CVE-2026-63826","evidence":"/upstream"},{"value":"CVE-2026-63829","evidence":"/upstream"},{"value":"CVE-2026-63884","evidence":"/upstream"},{"value":"CVE-2026-63893","evidence":"/upstream"},{"value":"CVE-2026-63912","evidence":"/upstream"},{"value":"CVE-2026-63917","evidence":"/upstream"},{"value":"CVE-2026-63919","evidence":"/upstream"},{"value":"CVE-2026-63921","evidence":"/upstream"},{"value":"CVE-2026-63922","evidence":"/upstream"},{"value":"CVE-2026-63924","evidence":"/upstream"},{"value":"CVE-2026-63946","evidence":"/upstream"},{"value":"CVE-2026-63952","evidence":"/upstream"},{"value":"CVE-2026-63968","evidence":"/upstream"},{"value":"CVE-2026-63971","evidence":"/upstream"},{"value":"CVE-2026-63975","evidence":"/upstream"},{"value":"CVE-2026-63984","evidence":"/upstream"},{"value":"CVE-2026-63994","evidence":"/upstream"},{"value":"CVE-2026-64106","evidence":"/upstream"},{"value":"CVE-2026-64189","evidence":"/upstream"},{"value":"CVE-2026-64530","evidence":"/upstream"},{"value":"CVE-2026-64560","evidence":"/upstream"},{"value":"CVE-2026-64561","evidence":"/upstream"},{"value":"CVE-2026-64564","evidence":"/upstream"},{"value":"CVE-2026-64600","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:130b8b86-0b9f-4b76-b8c0-96bf6997a30c","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-31598","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Although the core bug is in ocfs2 filesystem code, ocfs2 is exportable and nfsd can issue direct writes with IOCB_DIRECT while remote REMOVE operations reach vfs_unlink, making the vulnerable lock chains reachable over the network on a writable exported ocfs2 volume.\nAC:L - The bug is an ABBA deadlock where the attacker can drive both sides with concurrent extending direct writes and unlink/remove operations. Once the target deployment exposes those operations, winning the race is attacker-controlled.\nPR:N - A remote NFS client can trigger the operations through an exported writable share without kernel capabilities on the target. In permissive or anonymous export scenarios, no prior authenticated privileges are required.\nUI:N - No victim user action is required after the vulnerable service/filesystem is available. The attacker can send the write and remove operations directly.\nS:U - The impact remains within the same kernel/filesystem security authority. There is no VM escape, sandbox boundary crossing, or separate security scope.\nC:N - The issue is a lock-ordering deadlock, not memory corruption or information disclosure. It does not provide a read primitive or leak data.\nI:N - The vulnerable behavior does not corrupt memory or allow unauthorized data modification. It only causes threads to block on locks.\nA:H - The deadlock can permanently hang ocfs2 operations and affected kernel worker/syscall contexts. A kernel/filesystem hang is a high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31598","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43033","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable out-of-place AEAD decrypt path is reachable by a local process through AF_ALG sockets using authencesn, while normal inbound ESP uses in-place src==dst. This requires local syscall access rather than remote packets directly reaching the bad branch.\nAC:L - The attacker controls the AF_ALG request buffers, associated-data length, operation type, key, and authsize, and no race or hard-to-influence state is required. The fault occurs before ICV verification, so a valid packet/tag is not needed.\nPR:L - AF_ALG socket creation, bind, key setup, and AEAD decrypt do not require CAP_NET_ADMIN or CAP_SYS_ADMIN, but the attacker needs local unprivileged code execution. XFRM state management is privileged, but the lower-privilege AF_ALG path reaches the bug.\nUI:N - No victim action is required once the local attacker runs the AF_ALG syscall sequence. The attacker supplies both input and output buffers directly.\nS:U - The vulnerability is in kernel crypto processing and impacts the same kernel security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:H - The bug is a kernel memory-corruption condition from writing ESN high sequence bytes past the intended out-of-place destination; successful exploitation of such corruption could expose arbitrary kernel memory. Under the required uncertainty rule, this is scored as high confidentiality impact.\nI:H - The vulnerable code performs an attacker-influenced out-of-bounds write of four bytes before authentication succeeds. Kernel out-of-bounds writes are scored as high integrity impact because they can plausibly be shaped into control-flow or data corruption.\nA:H - At minimum, the AF_ALG path can drive scatterwalk past the end of the destination scatterlist and crash the kernel. A local attacker can repeat the trigger without authentication, causing high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43033","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43056","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable `add_adev()` error path is reached during MANA PCI driver probe/resume/recovery or auxiliary RDMA service handling, not by processing received network packets. The highest defensible attacker path is local influence over driver/device lifecycle or resource-failure conditions.\nAC:L - Once `auxiliary_device_add()` fails, the UAF is deterministic because `auxiliary_device_uninit()` releases the embedded object and the cleanup path immediately reads `adev->id`. No attacker-uncontrolled race is required beyond reaching that failure path.\nPR:L - The path is not exposed to unauthenticated remote peers, but a local attacker can plausibly influence resource exhaustion/failure conditions around driver lifecycle events. Direct sysfs/module lifecycle control is privileged, but Low is the higher-severity defensible choice under the conservative scoring rule.\nUI:N - No separate victim action is required once the attacker can exercise or influence the local driver lifecycle/failure path. Probe, resume, and service-event handling run in kernel context.\nS:U - The affected component and impacts are within the Linux kernel security scope. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel use-after-free of an auxiliary-device container object after its release callback frees it. Under conservative kernel UAF scoring, freed slab reuse can support information disclosure, so confidentiality is High.\nI:H - The UAF lets stale object contents influence cleanup through `mana_adev_idx_free()`, and kernel UAFs are conservatively treated as potentially exploitable memory corruption. Integrity is therefore High.\nA:H - At minimum, the stale access can trigger a kernel UAF report, invalid IDA cleanup, oops, or panic during probe/resume error unwinding. Availability impact is High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43056","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46056","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handlers process HCI Secure Simple Pairing events (User Passkey Notify / Keypress Notify) driven by a remote Bluetooth peer during SSP pairing, so the attacker must be within Bluetooth radio range (adjacent), matching kernel guidance that Bluetooth = Adjacent.\nAC:L - This is a use-after-free where a remote peer drives the passkey/keypress events while connection teardown frees the conn from a concurrent context; the attacker influences both sides of the race and can retry, and UAF bugs are scored AC:L unless the race is uncontrollable.\nPR:N - The code path is reached by a remote Bluetooth device participating in the SSP pairing handshake, requiring no credentials or privileges on the target system.\nUI:N - The handlers execute automatically when the controller forwards the SSP passkey/keypress HCI events during the pairing protocol exchange; no local user action is required to reach the vulnerable code.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The use-after-free reads fields (dst, type, dst_type, passkey) from a freed and potentially reallocated hci_conn object, which can disclose attacker-controlled or sensitive kernel heap contents.\nI:H - The handlers write to the freed object (passkey_notify and passkey_entered fields), giving a UAF write into reallocated heap memory that can be leveraged for heap grooming and control-flow corruption.\nA:H - A use-after-free on the hci_conn structure readily causes kernel oops/panic, yielding high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46056","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46117","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through the RDMA userspace verbs interface (/dev/infiniband/uverbs<N>) by issuing a create-QP command locally; it is not exposed to network peers.\nAC:L - The condition is created entirely by the attacker (building an RWQ indirection table whose WQs share one CQ) and is deterministically triggered on the second loop iteration; there is no race or uncontrolled state.\nPR:L - Triggering only requires an unprivileged local process with access to the RDMA verbs device — the normal configuration on RDMA-enabled hosts — and no CAP_* check exists on the create-QP path.\nUI:N - The attacker performs all steps via its own verbs calls; no action by another user is required.\nS:U - The corruption stays within the kernel's own memory/security authority and does not cross a VM/IOMMU/sandbox boundary.\nC:H - The overwrite leaks/dangles objects in cq_table[], and a use-after-free on these IRQ-dispatched structures can be leveraged to read kernel memory contents.\nI:H - The driver \"goes on to corrupt the kernel,\" leaving dangling function-pointer/context entries in a table called from interrupt context, providing a write/control-flow corruption primitive.\nA:H - The user-triggerable WARN_ON panics the system when panic_on_warn is set, and the subsequent kernel state corruption causes oopses/crashes regardless."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46117","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46145","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only by issuing RDMA verbs to the local /dev/infiniband/uverbs* character device; `rx_hash_key_len` arrives via `ib_copy_from_udata` from a local process, with no remote network path.\nAC:L - The attacker directly controls `rx_hash_key_len` in the uAPI struct and can set it arbitrarily large to trigger the overflow on every call; there is no race or condition outside the attacker's control.\nPR:L - Reaching the raw-packet QP path requires CAP_NET_RAW, but that is a narrow, non-root capability (not the \"real root/admin\" bar for High) and is routinely granted to unprivileged networking/RDMA applications such as DPDK workloads.\nUI:N - The overflow is triggered entirely by the attacker's own QP-creation request; no action by any other user is required.\nS:U - The corruption is of the kernel's own heap allocation within the same kernel security authority; no crossing into a separate scope (VM/IOMMU) occurs.\nC:H - The memcpy over-reads the 40-byte stack source by an unbounded amount and the heap overflow can be leveraged to disclose adjacent kernel memory, so confidentiality impact is High.\nI:H - An attacker-controlled-length memcpy writes past a 40-byte heap field, giving a heap out-of-bounds write that corrupts adjacent kernel objects and is exploitable toward arbitrary write/control-flow hijack.\nA:H - A large `rx_hash_key_len` corrupts the kernel heap and/or faults reading unmapped stack/heap pages, reliably causing a kernel panic/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46145","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46174","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in the CPU's op cache and requires executing instructions on the affected core to drive improper resource sharing; it is not reachable over a network. Triggering it needs local code execution on the machine.\nAC:L - An attacker who can co-schedule code on SMT siblings of an affected Zen2 core controls both sides of the shared op-cache contention and can reliably drive the improper-isolation condition. Following the higher-severity rule, this is Low.\nPR:L - Triggering the op-cache resource sharing only requires the ability to run code (an unprivileged local user or a guest VM tenant); no root or admin capability is needed. It does, however, require at least some local execution access, so not None.\nUI:N - The attacker's own executing code populates and contends for the op cache; no victim action is required.\nS:C - The bug is an isolation failure of a microarchitectural resource shared across SMT threads, so instruction corruption can cross from the attacker's context into a different security authority (another VM/tenant or the host kernel), impacting resources beyond the attacking component's scope.\nC:H - Improper isolation of a shared op-cache resource is an information-disclosure vector across contexts, and the resulting instruction corruption can be leveraged to read memory belonging to another security domain.\nI:H - The defining impact is \"instruction corruption\" — the CPU executes corrupted/wrong instructions in a victim context, which is a direct, severe integrity violation enabling control-flow and data corruption across the isolation boundary.\nA:H - Instruction corruption causes incorrect execution, crashes, and hangs in the affected (potentially cross-context) code, resulting in high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46174","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46243","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local `request_key(2)` or `add_key(2)` from an unprivileged process; the flaw is missing origin validation in the keyring path, not remote SMB/CIFS protocol input.\nAC:L - On typical affected systems (CIFS module with upcall, cifs-utils request-key rule, unprivileged user/mount namespaces), the attacker fully controls the forged description, target pid, and namespace layout for a reliable root upcall chain.\nPR:L - Any local unprivileged user account can invoke the key syscalls; user/mount namespaces are part of the standard exploit setup and map to basic local user capability, not root-only access.\nUI:N - No victim action such as mounting a Kerberos CIFS share is required; the attacker forges the key request directly without depending on another user’s mount or session.\nS:U - Successful exploitation elevates privileges within the same host/kernel security domain (local root) and does not cross a VM/hypervisor or hardware isolation boundary by itself.\nC:H - The attack chain yields root-equivalent access in the root upcall helper, enabling arbitrary read of host data (full confidentiality compromise of the system).\nI:H - Malicious NSS modules run as root inside `cifs.upcall`, giving arbitrary code execution and full integrity compromise of the host, not merely limited data modification.\nA:N - The kernel bug is a trust-boundary failure without memory corruption or guaranteed kernel panic; primary impact is privilege escalation rather than kernel crash or sustained denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46243","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46323","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local attacker to inject zerocopy/managed-frags skbs via io_uring SEND_ZC, TUN/TAP, or similar local APIs; ordinary remote wire packets processed by GRO do not carry SKBFL_MANAGED_FRAG_REFS, so a network-only attacker cannot reach the buggy merge path.\nAC:L - The attacker fully controls both sides of the GRO merge (seed and zerocopy TCP segments over a veth pair), timing (netem delay, RST race), and buffer setup; a public working LPE exploit exists, so success does not depend on conditions outside attacker control.\nPR:L - Triggering requires only a basic unprivileged local account with io_uring and user-namespace access (unshare -Urn), which is the default on many distributions; no init-namespace root or CAP_NET_ADMIN is needed.\nUI:N - No victim user action is required; the attacker drives the entire exploit autonomously through syscalls and local network namespace setup.\nS:U - Impact is standard host-kernel privilege escalation (root on the same kernel); it does not cross a distinct hypervisor/IOMMU security boundary such as VM-guest-to-host escape.\nC:H - The flaw is a use-after-free on page structures; the known exploit leverages the refcount underflow to obtain stale read access to freed physical pages and extract kernel PTE contents, enabling arbitrary memory disclosure primitives.\nI:H - UAF page refcount corruption enables crafting writable PTE entries against read-only page-cache pages; the public exploit demonstrates integrity compromise by rewriting /etc/passwd and obtaining root via su.\nA:H - Use-after-free of page structures can cause kernel oops/panic during skb teardown; even failed exploitation attempts can crash the system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46323","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46324","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in nf_tables netdev hook teardown reached only via Netfilter netlink (nft) syscalls—chain/flowtable updates, dumps, netns teardown, and netlink socket release—not from remote packet handling alone. Per kernel guidance, nftables/netfilter is Local (L).\nAC:L - Exploitation is a race between hook-list removal (`list_del()` + RCU free) and concurrent RCU walkers (`nft_dump_basechain_hook_list`, flowtable dump, or packet-path `list_for_each_entry_rcu`). An attacker with CAP_NET_ADMIN can drive both sides concurrently (e.g., one thread dumping chains/flowtables while another deletes hooks or tears down the netns).\nPR:L - All nf_tables netlink operations are gated by `netlink_net_capable(skb, CAP_NET_ADMIN)` in `nfnetlink_rcv()`. CAP_NET_ADMIN is obtainable by an unprivileged user via user+network namespaces (`unshare -Urn`), not real init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers hook teardown and concurrent dumps or traffic entirely through their own netlink sockets and namespace lifecycle.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries.\nC:H - Using `list_del()` instead of `list_del_rcu()` on lists walked under `rcu_read_lock()` is a use-after-free/list-corruption bug; concurrent dumpers dereference `nft_hook` fields (e.g., `ifname`) after unlink/free, enabling arbitrary kernel memory read via heap grooming.\nI:H - The freed `nft_hook` kmalloc object can be reallocated and corrupted through the dangling RCU list pointers, providing a standard kernel UAF primitive exploitable for arbitrary write and control-flow hijacking.\nA:H - The race reliably causes kernel list corruption and use-after-free, leading to oops/panic during hook dumps, flowtable lookups, or netns cleanup; UAF in this path has inherent high availability impact even when not fully weaponized."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46324","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46333","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable authorization check is reached through local interfaces such as ptrace-style checks, procfs, and pidfd_getfd; it is not reachable from network packets or adjacent/physical input.\nAC:L - A local attacker can repeatedly trigger the relevant check and, for exiting tasks, can race pidfd_getfd/procfs access against a target's exit path after exit_mm() but before exit_files(). The race is attacker-driven and does not require unusual kernel configuration or conditions outside the attacker's influence.\nPR:L - An unprivileged local user can target same-UID nondumpable tasks because the vulnerable code skips the dumpability requirement once task->mm is NULL. User-namespace root does not help against init-namespace root kernel threads, but low local privileges are enough for the same-UID exiting-task case.\nUI:N - Exploitation does not require a victim user to open a file or perform an interactive action; the attacker can use local syscalls/procfs against an existing or attacker-terminated target task.\nS:U - The bug bypasses Linux kernel task-access authorization within the same OS security authority. It does not cross a VM, IOMMU, or hypervisor boundary.\nC:H - The bypass can allow access to sensitive task details and, most importantly, pidfd_getfd can duplicate file descriptors from a nondumpable task during the exit window. In a plausible helper/sandbox scenario, those descriptors can expose highly sensitive files or privileged resources.\nI:H - If the duplicated descriptor is writable, the attacker can modify the protected resource reachable through the victim's file descriptor despite the dumpability restriction. This is a high-impact integrity bypass even though the bug is not memory corruption.\nA:N - The issue is an access-control bypass around ptrace/dumpability checks and does not by itself provide a kernel crash, hang, deadlock, or sustained denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46333","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52967","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable SMB client parser consumes an SMB2 CREATE error response supplied by a remote SMB server over the network. A malicious or compromised SMB share can send the crafted `STATUS_STOPPED_ON_SYMLINK` response.\nAC:L - The server directly controls `ErrorContextCount`, `ByteCount`, `ErrorId`, and `ErrorDataLength`, and no race or hard-to-hit state is required. Although the wraparound behavior is 32-bit specific, that is a deployment property rather than an attacker-uncontrolled exploitation condition.\nPR:N - The attacker needs no privileges on the victim system; they only need to operate or control the SMB server endpoint that the client connects to. The path can also be reached through guest or null-auth SMB sessions.\nUI:R - The victim client must mount/connect to the SMB share and perform a path operation such as lookup, stat, open, or create that causes an SMB2 CREATE response to be parsed. The remote server cannot trigger this parser without client-side filesystem activity.\nS:U - The affected component is the Linux kernel SMB client, and the impact is to the same kernel/client security authority. This is not a VM escape, IOMMU bypass, or cross-scope sandbox escape.\nC:H - The bug is an out-of-bounds kernel read in a server-controlled response parser, and the read is not strictly bounded to only a few harmless bytes. Following the required conservative rule, this is scored as high confidentiality impact.\nI:N - The defect advances a parser pointer incorrectly and reads from the wrong location, but it does not write out of bounds or provide a kernel memory write primitive. No direct integrity impact beyond normal malicious-server control of SMB content was identified.\nA:H - The crafted length can make the parser loop indefinitely on 32-bit systems, causing a reliable denial of service. Other malformed pointer positions can also lead to invalid kernel reads and possible oops conditions."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52967","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52986","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable SIP conntrack helper parses SIP payload carried in TCP/UDP network packets once the SIP helper is enabled, which is a reasonable deployment for NAT/firewall SIP gateways. A remote SIP peer can send crafted packets to that packet-processing path.\nAC:L - The trigger is a malformed numeric SIP field or URI port at the parser buffer boundary; no race or victim-controlled timing is required. Helper/NAT configuration is an environmental prerequisite, not an attacker-controlled complexity condition.\nPR:N - In the network gateway scenario, the attacker only needs to send unauthenticated SIP traffic through a system using the SIP conntrack helper. No local account or kernel privilege is required.\nUI:N - Exploitation is driven by packet processing in netfilter/conntrack. No user action is needed after the affected helper is configured.\nS:U - The impact is within the kernel/network stack security authority of the vulnerable system. It does not cross a separate scope such as guest-to-host or IOMMU isolation.\nC:H - The bug is an unbounded out-of-bounds read from non-NUL-terminated skb data via simple_strtoul and missing limit checks. Following the required guidance, an unbounded OOB read is high confidentiality impact.\nI:H - In NATed SIP paths, an out-of-bounds parser end pointer can feed attacker-influenced match lengths into NAT packet mangling, whose memmove/memcpy path lacks a bounds check against the skb payload. That creates a defensible kernel memory-corruption/code-execution risk.\nA:H - The same OOB read and possible invalid NAT mangle lengths can cause kernel faults, skb corruption, or panic. Crafted packets can be sent repeatedly, so availability impact is high."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52986","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53050","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local filesystem quota activity on a mounted OCFS2 filesystem, via ordinary dquot lifetime changes racing with the OCFS2 quota sync worker. It is not reachable by remote packets or adjacent/physical input.\nAC:L - This is a race, but a local attacker can repeatedly churn dquot references with filesystem operations while the periodic scanner runs. When uncertain, the higher-severity AC:L is appropriate.\nPR:L - After OCFS2 quotas are enabled, an unprivileged local user with write access to the filesystem can trigger dquot allocation and release paths. Mounting/configuring quotas is an environmental prerequisite, not a privilege needed for each exploit attempt.\nUI:N - No victim interaction is required once the affected filesystem is mounted and quotas are active. The attacker can trigger the relevant filesystem operations directly.\nS:U - The impact remains within the kernel and the same host security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The bug can lead to use-after-free of a dquot object under memory pressure. Kernel UAF conditions can be leveraged for memory disclosure, so confidentiality impact is High.\nI:H - The stale dquot/list state creates kernel heap use-after-free/list corruption, which can plausibly be shaped into write primitives or code execution. Integrity impact is therefore High.\nA:H - The race already produces kernel WARN/oops-style failure conditions and can dereference freed kernel objects. This can crash or destabilize the kernel, so availability impact is High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53050","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53131","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.4,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable netfilter match, ipset, and logging paths run while processing packets in receive/netdev hooks. In a reasonable firewall, router, VPN, or tunnel deployment with these rules installed, unauthenticated remote packets can reach the vulnerable code.\nAC:L - No race or difficult timing is required; a packet reaching a vulnerable rule with an invalid, unset, non-Ethernet, or too-short MAC header deterministically drives the bad eth_hdr(skb) access. The needed rule/interface setup is a plausible deployment condition, not an exploit race.\nPR:N - The remote packet sender does not need credentials or local privileges once the affected rule or logger is configured. Although rule installation requires CAP_NET_ADMIN, that is not required for the runtime remote-trigger scenario.\nUI:N - Exploitation is triggered by packet processing and does not require a victim user to open a file, mount anything, or perform another action.\nS:U - The impact remains within the kernel/network stack security authority. There is no VM, IOMMU, or separate sandbox boundary crossing.\nC:H - The flaw causes invalid or out-of-bounds reads from the skb MAC header, and those bytes can be copied into logs/ipset state or influence observable match behavior. Per the required guidance, out-of-bounds reads are scored High when not proven strictly harmless.\nI:L - The primitive is a read rather than an arbitrary write or control-flow hijack. However, the wrongly read MAC bytes can influence firewall matches and ipset add/delete/test behavior, giving limited integrity impact.\nA:H - Invalid eth_hdr(skb) access can produce slab out-of-bounds/KASAN reports or kernel oops/panic conditions, and packets can be sent repeatedly. Kernel crashes are High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53224","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - An unauthenticated remote SCTP peer can reach the vulnerable COOKIE_ECHO processing path by sending SCTP packets to a listening SCTP endpoint. In deployments with cookie HMAC disabled, the attacker can obtain and modify the state cookie over the network.\nAC:L - The bug is triggered with a malformed COOKIE_ECHO and attacker-controlled embedded INIT/address-list lengths; no race or hard-to-control timing condition is required. The no-cookie-auth deployment condition is a reasonable supported SCTP configuration.\nPR:N - No credentials or local privileges are needed to send SCTP INIT/COOKIE_ECHO traffic to a listening service. The vulnerable parsing occurs before any application authentication.\nUI:N - Exploitation only requires sending network packets to the target SCTP endpoint. No victim user action is required.\nS:U - The impact is within the kernel/network stack security authority of the target system. It does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The malformed lengths can drive out-of-bounds kernel reads beyond the COOKIE_ECHO payload, including attacker-controlled oversized address-list parsing. Because the read is not strictly bounded to a few bytes and related SCTP COOKIE_ECHO bugs demonstrate kernel memory leakage potential, confidentiality impact is High.\nI:N - The investigated fix addresses out-of-bounds reads and missing length validation, not an out-of-bounds write or direct arbitrary memory modification primitive. I did not find a defensible direct integrity impact from this bug alone.\nA:H - The attacker-controlled out-of-bounds reads can walk beyond the skb/cookie buffer and fault or trigger KASAN/oops conditions. A remotely triggerable kernel crash is High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53224","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53246","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable COOKIE_ECHO processing is reached by remote SCTP packets delivered through the IPv4/IPv6 SCTP protocol handlers to a listening SCTP endpoint.\nAC:L - In a deployment with SCTP cookie HMAC disabled, the attacker can obtain a cookie through the normal INIT/INIT_ACK exchange, modify the cached INIT length, and send the forged COOKIE_ECHO without races or conditions outside attacker control.\nPR:N - The path is pre-authentication network protocol handling for a listening SCTP server; no local account or SCTP authentication is required when cookie HMAC is disabled.\nUI:N - Exploitation only requires sending SCTP handshake packets to the target listener and does not require victim user action.\nS:U - The impact is within the Linux kernel/network stack security authority and does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The inflated cached INIT length drives out-of-bounds parameter walking and attacker-sized kmemdup() reads beyond the received skb, which can expose kernel memory.\nI:H - The bug is kernel memory-safety corruption during nested parameter handling, and the higher-severity choice is appropriate because attacker-controlled parsing and copies beyond the valid buffer can corrupt kernel association state and plausibly support stronger primitives.\nA:H - The out-of-bounds reads and large attacker-controlled copies can trigger kernel faults, KASAN splats, allocation failure paths, or repeated remote crashes of SCTP processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53246","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53250","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached by a local process using AF_XDP socket setup, UMEM registration, TX ring submission, and send/poll-driven transmit; it is not reachable directly from remote network packets.\nAC:L - The attacker controls the UMEM metadata and can trigger TX from the same process, so the TOCTOU race can be created with attacker-controlled concurrent writes.\nPR:L - AF_XDP socket creation requires CAP_NET_RAW in the relevant network namespace, which is attainable by a low-privileged local user in user/network namespace deployments.\nUI:N - No victim action is needed after the attacker has local execution; the attacker sets up the socket, UMEM, metadata, and transmit operation directly.\nS:U - The vulnerability corrupts or reads kernel networking memory within the same kernel security authority; this is standard local kernel attack surface, not a VM or hardware boundary crossing.\nC:H - Racing csum_start/csum_offset can bypass validation and drive out-of-bounds checksum reads in kernel transmit checksum handling, so potential kernel memory disclosure is high.\nI:H - The same unvalidated checksum offsets can cause checksum writes to an attacker-influenced out-of-bounds location relative to skb data, making kernel memory corruption plausible.\nA:H - The out-of-bounds memory access in the kernel transmit path can trigger warnings, faults, or kernel crashes and can be repeatedly exercised by the local attacker."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53250","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53262","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through a local `ioctl()` on a connected PPPoL2TP `AF_PPPOX` socket. Remote L2TP packets do not invoke `pppol2tp_ioctl()`.\nAC:L - The attacker controls both sides of the race by blocking `copy_from_user()` in the ioctl thread and closing the same socket concurrently. No external victim state is required.\nPR:L - A local unprivileged user can reach the PPPoL2TP socket/ioctl path; L2TP management also uses user-namespace admin permissions rather than requiring real init-namespace root. This is not remotely reachable without local code execution.\nUI:N - No victim action is required after the attacker runs local code. The attacker creates/connects the socket, issues the ioctl, and closes the socket.\nS:U - The impact is within the kernel security authority on the same system. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel heap use-after-free of `struct l2tp_session`, and the resumed ioctl can read from reclaimed/faked session and tunnel data before copying results to userspace. Per conservative kernel UAF scoring, this supports high confidentiality impact.\nI:H - Kernel UAFs with attacker-controlled timing and heap reuse can be leveraged beyond a simple stale read, including corruption or control-flow primitives. When uncertain, the higher severity option is appropriate.\nA:H - At minimum, dereferencing the stale session or tunnel pointer can trigger a kernel oops or panic. The attacker can repeatedly trigger the race locally."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53262","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53267","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached by installing crafted nftables/netfilter rules through NETLINK_NETFILTER and then triggering packet evaluation locally. Remote packets alone cannot install the rule, so this is a local attack vector.\nAC:L - A single crafted rule sequence such as `ct zone set` followed by `ct original saddr` can deterministically trigger the bug on matching packets. No race or external condition beyond the attacker's control is required.\nPR:L - Rule creation requires CAP_NET_ADMIN for the relevant network namespace via nfnetlink. Because nftables is reachable with CAP_NET_ADMIN in a user-created network namespace on systems permitting unprivileged user namespaces, this is low privileges rather than high.\nUI:N - After the attacker installs the crafted rule, triggering occurs through packet processing without any victim user action. No user needs to open a file, mount anything, or interact with attacker-controlled content.\nS:U - The bug corrupts kernel memory during kernel packet-filter evaluation and impacts the same kernel security authority. This is standard kernel privilege escalation/DoS behavior, not a VM, IOMMU, or distinct security-scope escape.\nC:H - The bug is a kernel stack out-of-bounds write past `struct nft_regs`, a memory corruption primitive. Under the required higher-severity rule, such memory corruption is defensibly treated as capable of enabling high confidentiality impact.\nI:H - The vulnerable 16-byte memcpy can overwrite beyond the validated destination register on the kernel stack. Out-of-bounds kernel writes are high integrity impact because they can plausibly be developed into control-flow or privilege-modification primitives.\nA:H - The stack overwrite can corrupt adjacent stack state or registers during packet evaluation and can crash or oops the kernel. Kernel crash or panic is high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53267","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53354","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable TLBI completion path is reachable by locally executing code that drives memory permission/unmap activity through syscalls or guest/KVM memory-management activity. It is not directly exposed by network packets.\nAC:L - Although the erratum depends on timing, the attacker can repeatedly arrange concurrent stores and translation invalidations on affected multicore Arm systems. The triggering race is therefore attacker-influenced rather than dependent on a one-off external condition.\nPR:L - A basic unprivileged local user or guest workload can reach the relevant Stage-1/Stage-2 TLBI paths without host administrative privileges. No real root capability in the init namespace is required.\nUI:N - After the attacker has local code execution, exploitation only requires attacker-driven memory operations/syscalls or guest activity. No separate victim action is needed.\nS:C - In a severe reasonable deployment such as Arm KVM/cloud virtualization, bypassing Stage-2 or higher-level translation protections can let guest-controlled writes affect hypervisor/host resources. That crosses a security authority boundary.\nC:H - The primitive can enable privilege escalation to kernel or hypervisor context, making protected memory and secrets accessible. Even though the erratum affects stores, successful control of privileged context supports high confidentiality impact.\nI:H - The core issue permits writes to memory after translation permissions or ownership should have been revoked. This is a high-integrity memory corruption primitive with plausible kernel or hypervisor privilege escalation.\nA:H - Incorrect late writes into protected or reused memory can corrupt kernel/hypervisor state. Failed exploitation or corruption can plausibly cause kernel panic, guest/host crash, or system instability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53354","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53375","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through the AMDGPU_CS DRM ioctl on a render node (/dev/dri/renderD*), requiring local access to submit crafted VCE indirect buffers to the GPU driver.\nAC:L - An attacker fully controls the VCE command stream and per-command length fields, and can reliably craft commands where exactly one relocation index is out of bounds (e.g., 0x0500000d with len=32) to trigger partial address patching.\nPR:L - Exploitation requires only unprivileged local access to the amdgpu DRM render node; AMDGPU_CS is gated by DRM_AUTH|DRM_RENDER_ALLOW, not root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the entire malicious command submission through the render node.\nS:C - Partial address patching causes VCE firmware to DMA using attacker-influenced GPU addresses outside the intended buffer object boundaries, crossing the GPU memory/DMA isolation boundary that the relocation logic is meant to enforce.\nC:H - VCE firmware performs DMA reads using the malformed 64-bit address, enabling arbitrary reads from GPU-accessible memory regions (including GTT-mapped system memory) beyond the validated buffer scope.\nI:H - VCE firmware performs DMA writes (encoded bitstreams, feedback, and context buffers) to attacker-influenced addresses, enabling arbitrary GPU-mapped memory corruption and potential privilege escalation primitives.\nA:H - Submitting commands with malformed firmware addresses can cause GPU page faults, driver hangs, GPU resets, or kernel oops/panic when the VCE engine accesses invalid memory regions."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53375","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53388","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local syscalls: mounting a FUSE filesystem, reading files to trigger readpages, and the FUSE daemon writing replies to /dev/fuse via splice_write with SPLICE_F_MOVE.\nAC:L - The race is between the attacker's own splice reply and a concurrent abort they trigger (e.g., via sysfs abort or unmount); the attacker controls both threads and can retry until the window is hit.\nPR:L - Exploitation requires mounting and operating a FUSE filesystem via /dev/fuse, which needs local user privileges; on typical systems this is reachable by unprivileged users via user namespaces (CAP_SYS_ADMIN in a user namespace) without init-namespace root.\nUI:N - No victim interaction is required; the attacker mounts the filesystem, runs the FUSE daemon, and triggers the concurrent abort themselves.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as guest-to-host or sandbox breakout.\nC:H - The vulnerability is a use-after-free of fuse_io_args and associated folio pointers in kernel heap memory, which can be leveraged for arbitrary kernel memory read via heap reuse.\nI:H - Use-after-free of fuse_io_args enables heap spraying and controlled reuse of freed kernel objects, providing a path to arbitrary kernel memory write or code execution.\nA:H - The UAF and the race with folio replacement can cause kernel oops/panic, including NULL pointer dereference when fuse_readpages_end accesses a folio with a NULL mapping."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53388","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53391","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The crash is triggered by processing a malicious GETDEVICEINFO RPC response from an NFS metadata server over the network, on the standard NFSv4 client path used by pNFS file and flexfile layouts.\nAC:L - Once a victim is a pNFS client, the attacker reliably triggers the bug by sending a GETDEVICEINFO body with a zero-length r_netid or r_addr opaque; no race or special memory layout is required.\nPR:N - The attacker acts as (or compromises) the remote NFS metadata server and needs no local privileges on the victim client; exploitation is delivered entirely through NFS protocol responses to an already-established mount.\nUI:N - In the highest-impact scenario—a compromised enterprise/HPC metadata server or autofs-managed pNFS mount—no further victim action is needed beyond normal file I/O that provokes GETDEVICEINFO.\nS:U - The vulnerability causes a kernel panic on the NFS client itself and does not cross a security boundary such as a VM escape or sandbox breakout.\nC:N - This is a NULL pointer dereference in strrchr() with no out-of-bounds read or use-after-free; it does not disclose kernel memory or attacker-controlled data.\nI:N - There is no memory corruption, arbitrary write, or control-flow hijack primitive—only an immediate NULL dereference that terminates kernel execution.\nA:H - The NULL pointer dereference in kernel context causes an oops or panic, fully denying availability of the affected client (and any co-hosted workloads until reboot)."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53391","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53402","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the KDFONTOP ioctl on a framebuffer-console virtual terminal (/dev/ttyN), which is a local syscall path with no network or physical-access vector.\nAC:L - An attacker who controls a session on an fbcon-backed VT can reliably trigger the bug by issuing a font-change ioctl with different dimensions and a 256↔512 glyph transition, then inducing vc_resize() failure through self-controlled memory pressure; no race or victim-dependent timing is required.\nPR:L - KDFONTOP font-set operations require only that the caller owns the controlling TTY (current->signal->tty == tty), which any unprivileged local user with a console or VT session has; CAP_SYS_TTY_CONFIG is not required on that path.\nUI:N - Exploitation requires only the attacker's own ioctl and memory-pressure actions on their TTY; no action by another user or administrator is needed.\nS:U - Impact is confined to kernel memory disclosure and potential kernel crash within the same kernel security authority; there is no VM escape, sandbox escape, or cross-security-boundary effect.\nC:H - The desynchronized hi_font_mask causes deterministic out-of-bounds reads from the kernel font glyph buffer during fbcon rendering (e.g., bit_cursor and rotated putcs paths), enabling disclosure of adjacent kernel memory.\nI:N - The flaw is an out-of-bounds read with console state desynchronization; it does not provide an arbitrary kernel write, code execution, or other data-modification primitive.\nA:H - Out-of-bounds reads from kernel font data can cause kernel page faults and oopses, consistent with the prior syzkaller-reported fbcon font/resize failure class that produced unhandled page faults."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53402","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63802","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local cgroup management (rmdir on cgroupfs) and concurrent block I/O to populate per-blkcg rstat lists; the vulnerable code is in the block cgroup teardown path, not in any network protocol handler.\nAC:L - The attacker controls both sides of the race by issuing I/O on multiple block devices to create multiple blkgs with pending stats, then concurrently destroying the cgroup to trigger parallel blkg_release() calls on multiple CPUs.\nPR:L - Triggering cgroup deletion and block I/O requires only delegated cgroup write access or namespace/container root (CAP_SYS_ADMIN in a user namespace), not init-namespace root; this is routinely available in containers, Kubernetes pods, and systemd user cgroup hierarchies.\nUI:N - No victim interaction is required; the attacker programmatically performs I/O and cgroup teardown from their own process or container.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it does not inherently cross a VM, container, or IOMMU boundary without a separate privilege-escalation step.\nC:H - The use-after-free dereferences freed blkg structures and associated iostat data during list iteration, enabling arbitrary kernel memory read primitives typical of slab UAF bugs.\nI:H - UAF on kmalloc-allocated blkg objects allows heap grooming and write through dangling pointers, which can be leveraged for arbitrary kernel memory modification or code execution.\nA:H - Concurrent use-after-free during blkg teardown can cause immediate kernel oops/panic from accessing freed memory, and repeated triggering enables reliable denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63802","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63806","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - A malicious KVM guest triggers this via guest-executed MMIO stores handled by the x86 instruction emulator (KVM_RUN → vmx_handle_exit → kvm_mmu_page_fault → x86_emulate_instruction → emulator_read_write → vcpu_mmio_write → ioeventfd_write), not via remote network input to the host.\nAC:L - The guest fully controls the spanning store address, size, and timing; with standard QEMU/virtio datamatch ioeventfd MMIO layouts, a page-boundary write reliably reaches ioeventfd_in_range() with a misaligned val pointer and fires the BUG_ON().\nPR:N - Exploitation requires only unprivileged code execution inside an already-running guest VM (reproducer ran as UID 1000); no host capabilities, KVM ioctls, or guest root are needed beyond what any cloud VM tenant or compromised guest process already has.\nUI:N - No victim interaction is required once the attacker can run code in a KVM guest with a datamatch ioeventfd configured, which is the default virtio/QEMU setup.\nS:C - The vulnerable component is the host kernel KVM subsystem, but exploitation is initiated from a guest VM and causes a host kernel BUG/oops, crossing the hypervisor security boundary.\nC:N - The failure mode is an explicit BUG_ON() alignment check before any datamatch comparison; there is no out-of-bounds read, use-after-free, or other memory corruption that could disclose host data.\nI:N - The bug triggers a deliberate kernel BUG and does not corrupt or modify host memory; it is a crash-only denial-of-service with no integrity impact.\nA:H - A guest-triggered BUG_ON() in ioeventfd_write() causes a host kernel oops/panic, denying availability of the entire physical host and all co-resident VMs on multi-tenant KVM hypervisors."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63807","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the KVM VM file descriptor ioctl path (KVM_SET_USER_MEMORY_REGION), which requires local syscall access to /dev/kvm rather than any network-facing protocol.\nAC:L - An attacker with KVM access can deterministically set up the required state (partial hugepage memslot, dirty logging enabled then disabled, guest hugepage mapping extending below slot bounds) and trigger the bug without depending on conditions outside their control.\nPR:L - Exploitation requires only local access to /dev/kvm and control of a VM (e.g., membership in the kvm group), as demonstrated by the reproducer running as UID 1000; it does not require host root in the init namespace.\nUI:N - No victim user interaction is required beyond the attacker issuing the KVM ioctl to disable dirty logging on a memslot they control.\nS:C - The vulnerable KVM x86 MMU code runs in the host kernel and a VM operator can corrupt or crash host kernel memory from their guest/VM management context, crossing the guest-to-host virtualization security boundary.\nC:H - The bug is an out-of-bounds kernel read of memslot lpage_info metadata via an invalid gfn index in kvm_mmu_max_mapping_level(), which per kernel guidance qualifies as high confidentiality impact even though it typically manifests as a page fault.\nI:H - Out-of-bounds access to kernel heap metadata in the KVM MMU subsystem can potentially be steered for memory corruption and control-flow influence; similar KVM shadow MMU memory safety bugs are scored at high integrity impact.\nA:H - The vulnerability reliably causes a host kernel oops/page fault (supervisor read to non-present vmalloc address) when triggered, constituting high availability impact via host kernel crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63807","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63824","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reachable only through the keyctl(2) syscall (KEYCTL_PKEY_ENCRYPT, KEYCTL_PKEY_DECRYPT, or KEYCTL_PKEY_SIGN); there is no network, adjacent, or physical attack path to the affected code.\nAC:L - An attacker fully controls the undersized out_len parameter and can reliably trigger the bug on demand with no races or victim-dependent state; CONFIG_ASYMMETRIC_KEY_TYPE is commonly enabled on server and desktop kernels.\nPR:L - Exploitation requires KEY_NEED_SEARCH on an asymmetric key, which any unprivileged local user can satisfy by loading their own RSA/EC key into a session keyring; no real root or init-namespace capabilities are needed.\nUI:N - Exploitation requires only attacker-initiated keyctl calls and does not depend on any victim user action such as opening a file or mounting a filesystem.\nS:U - Impact is confined to kernel heap memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - When out_len is smaller than the cryptographic output (including out_len=0 where kmalloc(0) yields ZERO_SIZE_PTR), asym_eds_op returns the full primitive output size and copy_to_user reads far beyond the allocated buffer, leaking adjacent kernel heap contents to userspace.\nI:H - The undersized kmalloc buffer is passed directly as the crypto output target; asymmetric operations can write up to the primitive maximum (hundreds of bytes for RSA-4096) past the allocation, enabling heap corruption and potential control-flow hijacking.\nA:H - Heap out-of-bounds read/write against kmalloc objects or writes through ZERO_SIZE_PTR can cause kernel oops, panic, or KASAN-detected corruption, satisfying high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63824","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63829","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires sending RTM_NEWLINK changelink requests over rtnetlink (netlink socket), matching the kernel guidance that tc/netlink configuration paths are Local.\nAC:L - Once a cross-namespace GRE/ERSPAN device is present in the caller's netns, triggering the bug is a single deterministic netlink changelink with no races or attacker-uncontrollable timing.\nPR:L - The rtnl entry path requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user can obtain inside a user namespace via unshare --user --map-root-user --net without real init-namespace root.\nUI:N - Exploitation is fully programmatic through netlink; no victim user action such as opening a file or mounting a filesystem is required.\nS:C - The changelink mutates tunnel state in t->net while authorization is checked only against dev_net(dev), crossing from the attacker's net/user namespace into another tenant's or the host's network namespace tunnel tables.\nC:H - An attacker can rewrite IFLA_GRE_REMOTE/LOCAL, keys, and related tunnel parameters to redirect GRE/ERSPAN traffic through attacker-controlled endpoints and read tunneled payloads.\nI:H - Unauthorized changelink updates live tunnel fields (including collect_md and encap parameters parsed before the missing check), enabling arbitrary redirection or injection of traffic in the victim link netns.\nA:H - Rewriting tunnel endpoints, keys, or metadata handling can break production GRE/ERSPAN overlays and VPN paths, causing sustained loss of connectivity for dependent services."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63829","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63884","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local DRM ioctls on the Intel GPU render node (notably I915_GEM_EXECBUFFER2 and I915_GEM_MADVISE); there is no network, adjacent-radio, or physical-access entry path.\nAC:L - An attacker controls the triggering workload (concurrent execbuffers, madvise DONTNEED, and GPU memory pressure to force eviction), and the UAF is a deterministic stale-pointer bug rather than a race against uncontrollable system state.\nPR:L - Exploitation requires only access to the DRM render node and standard unprivileged GEM ioctls (DRM_RENDER_ALLOW); no CAP_SYS_ADMIN, DRM master, or init-namespace root is needed.\nUI:N - No victim interaction is required beyond the attacker (or a compromised local GPU client) issuing its own ioctl submissions to the render node.\nS:U - Successful exploitation yields kernel memory corruption and local privilege escalation within the same kernel security authority; it does not constitute a VM escape or IOMMU/DMA boundary bypass.\nC:H - This is a kernel heap use-after-free on a freed i915_ttm_tt structure; attacker-controlled reuse of the freed object can provide arbitrary kernel memory read primitives.\nI:H - UAF on the i915_ttm_tt/filp path enables heap grooming and corrupting kernel objects, providing a standard path to arbitrary kernel write and code execution.\nA:H - The vulnerability was observed causing a kernel general protection fault/oops under real workloads, and UAF in this path can reliably crash or hang the system even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63884","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63893","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:A - A malicious Thunderbolt XDomain peer (adjacent host, dock, or in-line device on a direct Thunderbolt/USB4 link) delivers crafted PROPERTIES_RESPONSE data that the victim kernel parses during automatic XDomain discovery.\nAC:L - The peer fully controls property entry value/length fields and can reliably craft the u32 wrap (e.g. value=0xffffff00, length=0x100) without races or special memory layout.\nPR:N - Exploitation requires no privileges on the victim system; the attacker only needs to be the connected XDomain peer responding to the kernel-initiated property exchange, with no authentication on that control-plane path.\nUI:N - Once a Thunderbolt XDomain link exists, property fetching and parsing run automatically in the kernel handshake state machine without any additional victim user action at exploitation time.\nS:U - Impact is confined to the victim kernel/userspace boundary (kernel heap disclosure to local sysfs and possible kernel crash); it does not cross VM, IOMMU, or sandbox security boundaries.\nC:H - Integer-wrap bypass enables an out-of-bounds kernel memory read of up to entry->length dwords, which for deviceid/vendorid TEXT properties is copied into world-readable sysfs attributes, disclosing kernel heap contents.\nI:N - The bug is an out-of-bounds read via parse_dwdata(); destination buffers are properly sized kcalloc allocations, so there is no out-of-bounds write or integrity modification of victim kernel structures.\nA:H - Reading from block+0xffffff00 dwords (~4 GB past the allocation) will access unmapped kernel addresses, causing a kernel fault/oops/panic in addition to any information disclosure."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63893","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63912","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the ESP outbound encryption path reached when IPsec-protected traffic is sent through xfrm (e.g., from an internet-facing VPN/tunnel gateway encrypting responses or forwarded flows to a remote peer). A network peer can influence outbound skb fragment sizes to hit the vulnerable fast path without local shell access.\nAC:L - An attacker can reliably craft payload sizes so ALIGN(skb->data_len) and ALIGN(tailen) each pass the broken per-field PAGE_SIZE gate while their combined aligned length exceeds PAGE_SIZE, repeatedly probing until the out-of-place page-frag path is taken.\nPR:N - Exploitation does not require configuring xfrm or host admin rights; it only needs the target to already run ESP and the attacker to send traffic that is encrypted on output (e.g., as a remote VPN/site-to-site peer), which is network-layer access rather than local OS privilege.\nUI:N - Triggering the vulnerable ESP output path requires only attacker-controlled network traffic and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - The flaw is a heap out-of-bounds write during AEAD encryption over an undersized page frag; such memory corruption can expose adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - Writing past the allocated page-frag buffer corrupts adjacent heap memory and can be developed into arbitrary write or control-flow hijack primitives, matching kernel guidance for out-of-bounds writes.\nA:H - Corrupting kernel heap memory during crypto output can cause immediate kernel oops/panic or persistent instability, and repeated triggering can deny service on VPN gateways and other IPsec endpoints."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63912","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63917","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through rtnetlink configuration (RTM_NEWLINK changelink and RTM_SETLINK netns move via `ip link`), not through remote packet handling on the vti6 tunnel itself.\nAC:L - Exploitation is a deterministic, attacker-controlled sequence (create vti6, move netns, changelink, delete netns) with no races or external victim state required.\nPR:L - The fix commit and rtnetlink path confirm reachability with CAP_NET_ADMIN inside an unprivileged user+network namespace (`unshare --user --map-root-user --net`), not init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug entirely through their own netlink operations.\nS:C - On container hosts, an unprivileged tenant can corrupt namespace teardown and panic the host kernel, impacting resources outside the attacker's security scope (other tenants and the host).\nC:H - The stale per-netns hash leaves `cleanup_net()`/`vti6_exit_rtnl_net()` walking freed `ip6_tnl` list nodes, constituting a use-after-free with arbitrary kernel memory read potential.\nI:H - Cross-netns hash corruption can leave dangling pointers and drive `unregister_netdevice_queue()` on already-freed devices (kernel BUG at net/core/dev.c:12376), enabling memory corruption exploitable for control-flow hijacking.\nA:H - The published reproducer reliably triggers a kernel BUG during namespace cleanup, causing host-wide denial of service via kernel panic/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63917","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63919","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable path is reached when IPsec ESP/AH packets are received and processed through xfrm_input transport-mode reinjection, which is a network packet receive path in net/xfrm. Remote peers can send ESP traffic to trigger deferred queueing on systems with IPsec configured.\nAC:L - The attacker controls both sides of the race by flooding IPsec packets to queue deferred reinjection work while concurrently destroying the network namespace, making the UAF reliably triggerable without conditions outside attacker control.\nPR:L - Exploitation requires configuring xfrm/IPsec and managing network namespace lifecycle, both reachable with CAP_NET_ADMIN obtainable by an unprivileged user via user namespaces (unshare -Urn), not requiring real root in the init namespace.\nUI:N - No victim user interaction is required; exploitation is achieved through automated packet transmission and namespace teardown scripted by the attacker.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The deferred callback dereferences a freed struct net (e.g., ip6_rcv_finish_core reads sysctl fields from the UAF pointer), providing an information disclosure primitive from attacker-influenced freed slab memory.\nI:H - Use-after-free on the large struct net slab object enables heap grooming and memory corruption exploitable for arbitrary kernel writes and control-flow hijacking, not merely a bounded modification.\nA:H - Dereferencing a freed network namespace structure causes kernel oops/panic from the workqueue callback path, and UAF reliably threatens system availability even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63919","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63921","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl(SIOCCHGTUNNEL) on a migrated vti6 netdev via socket/dev_ioctl; the bug is in vti6_siocdevprivate(), not in remote packet reception.\nAC:L - The attacker fully controls namespace creation, tunnel migration (IFLA_NET_NS_FD), and ioctl parameters to collide with a victim tunnel; the commit documents a deterministic, reproducible sequence with no uncontrollable race.\nPR:L - Only CAP_NET_ADMIN in the migrated (attacker) network namespace is required, obtainable via unprivileged user namespaces (unshare --user --map-root-user --net); the missing check against the creation namespace's user_ns is the core flaw.\nUI:N - No victim interaction is needed; the attacker performs all setup steps (create/migrate tunnel, issue SIOCCHGTUNNEL) autonomously.\nS:C - The attack hijacks IPsec/XFRM traffic destined for tunnels in a different tenant's network namespace on container hosts, crossing container/tenant security boundaries rather than staying within the attacker's own scope.\nC:H - After hash poisoning, xfrm receive delivers matched/decapsulated packets to the attacker-controlled netdev, enabling interception of victim VPN/IPsec traffic including potentially sensitive plaintext after decryption.\nI:H - The attacker gains control over which netdev receives victim tunnel traffic and can read, drop, or forward/modify decapsulated packets, constituting unauthorized manipulation of another tenant's network data path.\nA:H - Hijacking the creation-namespace hash bucket causes the legitimate victim tunnel to stop receiving matched traffic, producing denial of service to the victim's IPsec connectivity."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63921","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63922","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached on the standard IPv6 input path (ipv6_rcv → ip6_input → ip6_protocol_deliver_rcu → ipv6_destopt_rcv) when a remotely sent IPv6 packet carries a Destination Options header processed by ip6_parse_tlv().\nAC:L - The attacker fully controls the crafted IPv6 Destination Options layout (HAO TLV followed by trailing TLVs/padding); once CONFIG_IPV6_MIP6 and matching XFRM state exist on the target, triggering the stale-pointer condition is a reliable single-packet attack without races or victim-specific timing.\nPR:N - No local privileges or authentication are required; any remote host that can deliver IPv6 traffic to a listening interface can reach this pre-authentication receive-path parser (destopt_protocol uses INET6_PROTO_NOPOLICY).\nUI:N - Exploitation requires only sending a malicious IPv6 packet; no victim interaction such as opening files, clicking links, or mounting filesystems is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the kernel’s security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - After pskb_expand_head() frees the old skb head, ip6_parse_tlv() continues parsing trailing TLVs through the stale nh pointer, causing out-of-bounds/use-after-free reads of kernel heap memory that can disclose sensitive kernel data.\nI:H - Use-after-free of the skb head buffer during TLV parsing is heap memory corruption that can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a bounded parse error.\nA:H - Reading through the stale network-header pointer into freed or invalid memory can cause kernel oops/panic or unrecoverable instability, satisfying high availability impact even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63922","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63924","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPv6 input path (ipv6_rcv → ip6_rcv_core → ipv6_parse_hopopts) triggered by a crafted IPv6 packet with hop-by-hop options containing a Jumbo Payload TLV, reachable from any remote peer that can deliver IPv6 to the host.\nAC:L - An attacker fully controls the crafted IPv6 packet (HBH layout, jumbo length, trailing TLVs) and can send it repeatedly; once the skb is cloned/shared during receive and pskb_trim_rcsum reallocates the head, the stale-pointer UAF is deterministically triggered without races or victim-specific state.\nPR:N - No authentication or local privileges are required; any unauthenticated remote host that can send IPv6 traffic to a listening interface reaches the vulnerable receive handler with no capability or namespace checks along the path.\nUI:N - Exploitation requires only delivery of a malicious IPv6 packet and does not depend on any victim user action such as opening files, clicking links, or mounting filesystems.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary by itself.\nC:H - Continued HBH TLV parsing through the stale nh pointer is a use-after-free read of freed skb head memory, which per kernel guidance enables arbitrary kernel memory disclosure when the freed slab is reused.\nI:H - Stale-pointer UAF during TLV length/type parsing can yield unbounded out-of-bounds reads and corrupt subsequent parsing state, providing memory corruption primitives that can be developed into arbitrary kernel writes or code execution.\nA:H - Dereferencing the freed network-header pointer during TLV parsing can cause immediate kernel oops/panic from invalid memory access, and UAF-triggered parsing errors reliably drop or crash the receive path."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63924","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63946","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when the kernel processes inbound Bluetooth LE ISO data (HCI_ISODATA_PKT) from a remote peer over the radio; per kernel guidance Bluetooth is Adjacent, not Network.\nAC:L - An attacker can reliably win the race by flooding ISO frames while concurrently closing the ISO socket (or inducing disconnect that triggers stack teardown), controlling both the receive path and the iso_sock_kill() teardown path.\nPR:N - Exploitation requires only an established ISO connection with a malicious adjacent Bluetooth device; the vulnerable receive path needs no local privileges, and socket teardown can occur automatically when the remote peer disconnects.\nUI:N - No victim interaction is required during exploitation; ISO socket closure on disconnect is handled automatically by the Bluetooth stack and userspace daemons without user action.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The use-after-free dereferences freed struct sock memory (sk->sk_state) after iso_sock_kill() can sock_put() the socket, enabling arbitrary kernel memory read primitives via heap reuse.\nI:H - The UAF continues into sock_queue_rcv_skb() on the freed socket, corrupting socket receive-queue state and enabling heap-based write/control-flow hijack primitives typical of kernel UAF bugs.\nA:H - Use-after-free on struct sock during receive processing can cause kernel oops/panic from invalid memory access, and UAF bugs in the kernel are rated High availability impact even when not fully weaponized."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63946","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63952","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (memfd_create, mmap, fcntl) with no network-facing code path; the vulnerable logic is reached only through the local fcntl(F_ADD_SEALS) interface on a memfd file descriptor.\nAC:L - The attack is a reliable, deterministic syscall sequence (create executable memfd, establish a writable MAP_SHARED mapping, then apply F_SEAL_EXEC) with no race or attacker-uncontrollable conditions.\nPR:L - Any unprivileged local user can invoke memfd_create, mmap, and fcntl without capabilities; these interfaces are available inside unprivileged user namespaces with no real-root requirement.\nUI:N - Exploitation does not require a human victim action; in the highest-impact scenario a sandboxed process programmatically passes the sealed-appearing memfd to a trusting peer via IPC (e.g., SCM_RIGHTS) without user interaction.\nS:C - The bug breaks the memfd seal security contract designed for mutually untrusted parties, allowing a malicious local peer to deceive a separate process that relies on F_SEAL_WRITE immutability, crossing the inter-process trust boundary (sandbox/W^X enforcement).\nC:H - Bypassing write-seal/W^X guarantees enables arbitrary modification of executable memfd contents presented as immutable, which can be leveraged for arbitrary code execution in a trusting victim process and thereby full read of that process's memory.\nI:H - The vulnerability allows arbitrary modification of memory that is advertised as write-sealed (F_SEAL_WRITE), defeating the kernel's immutability guarantee and enabling W^X bypass and code injection into trusted execution contexts.\nA:N - The flaw is a logic error in seal enforcement that does not cause kernel crashes, panics, hangs, or denial of service; exploitation maintains availability while subverting integrity guarantees."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63952","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63968","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable function is reached from the IPv6 packet receive path (ipv6_rcv → ip6_route_input → ip6_pol_route → fib6_select_path) in softirq context, and production lockups were observed during processing of incoming IPv6 traffic on internet-facing edge routers.\nAC:L - The race is reliably triggerable when an attacker influences both packet flow and route churn (e.g., user-namespace ECMP setup plus traffic, or remote traffic coinciding with BGP nexthop updates); a dedicated selftest reproduces soft lockups in under a minute under controlled conditions.\nPR:N - Triggering fib6_select_path() during packet processing requires only the ability to send IPv6 traffic to destinations using multipath routes; concurrent route-table updates can occur from infrastructure (BGP/dynamic routing) without the attacker holding any local privileges.\nUI:N - Exploitation requires no victim interaction beyond normal network traffic delivery to a host or router processing IPv6 packets.\nS:U - The impact is kernel CPU soft lockup and watchdog panic within the same kernel security boundary; there is no sandbox, VM, or IOMMU boundary crossing.\nC:N - The bug is an infinite loop over stale sibling-list pointers during RCU read-side traversal; it does not read or disclose attacker-controlled memory or kernel secrets.\nI:N - No data modification or memory corruption occurs; the failure mode is CPU hang from unbounded list iteration, not arbitrary write or code execution.\nA:H - The infinite loop in softirq context causes CPU soft lockup, and documented production and test cases show this leads to watchdog-triggered kernel panic, a complete loss of system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63968","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63971","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls on an SCTP socket (`sendmsg`/`sendto` to trigger `sctp_wait_for_connect`, and `getsockopt(SCTP_SOCKOPT_PEELOFF)` to peel off the association). A remote peer can only help complete the SCTP handshake; it cannot invoke peeloff or the racing send path.\nAC:L - The attacker controls both sides of the race by running concurrent threads on the same SCTP one-to-many socket, timing peeloff during the window where `sctp_wait_for_connect()` has released the socket lock. Required options (`SCTP_FRAGMENT_INTERLEAVE`, `SCTP_INTERLEAVING_SUPPORTED`, and `net.sctp.intl_enable`) are attacker-settable in a user/net namespace.\nPR:L - No real-root capability is required; an unprivileged user can create SCTP sockets and drive the full race from a user namespace (`unshare -Urn`), including enabling `net.sctp.intl_enable` and the interleaving socket options needed to reach the vulnerable `sctp_sendmsg_to_asoc()` path.\nUI:N - Exploitation is fully attacker-driven through coordinated local threads and does not require any action from a victim user or administrator beyond normal SCTP socket use.\nS:U - Impact is confined to kernel memory integrity/availability within the same security authority; successful exploitation would be local privilege escalation, not a cross-boundary escape such as VM or container breakout by itself.\nC:H - After peeloff migrates `asoc->base.sk`, the caller continues in `sctp_datamsg_from_user()` while holding the wrong socket lock, creating unsynchronized concurrent access to association/stream state that can corrupt kernel heap metadata and be leveraged for arbitrary kernel memory disclosure.\nI:H - The post-race path builds and queues DATA/I-DATA chunks via `sctp_datamsg_from_user()` and `sctp_primitive_SEND()` without the correct socket lock, enabling concurrent modification of association output queues and stream structures that can be turned into arbitrary kernel writes or control-flow hijacking.\nA:H - Concurrent unsynchronized access to a live SCTP association after peeloff can cause kernel oops/panic or wedged associations, and the underlying race is a classic kernel concurrency defect with high availability impact even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63971","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63975","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when a remote Bluetooth LE peer sends a crafted L2CAP_ECRED_CONN_RSP on the LE signaling channel, processed via hci_recv_frame → l2cap_recv_acldata → l2cap_le_sig_channel → l2cap_ecred_conn_rsp. Bluetooth is Adjacent per kernel CVSS guidance.\nAC:L - An adjacent attacker who establishes a BLE ACL link can reliably trigger this by first creating an L2CAP channel with a chosen DCID (via ECRED_CONN_REQ SCIDs) and then sending a connection response reusing that DCID for a pending outgoing ECRED connection; no race or rare layout is required.\nPR:N - Exploitation requires only the ability to act as a remote Bluetooth peer on an established ACL connection; no local shell access, capabilities, or root on the victim system is needed.\nUI:N - The malicious signaling traffic is delivered entirely by the remote attacker once a BLE link exists; no additional victim-side file open, mount, or application action beyond normal Bluetooth connectivity is required to reach the vulnerable handler.\nS:U - The failure is a kernel L2CAP channel-list use-after-free and crash within the Bluetooth stack on the victim host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Calling l2cap_chan_del() on the original channel during list_for_each_entry_safe can free the saved tmp list node, causing a use-after-free on struct l2cap_chan when iteration continues; UAF is scored as High confidentiality impact.\nI:H - The same iterator invalidation frees and later dereferences l2cap_chan objects under attacker-influenced connection state, providing a heap UAF primitive that can be groomed toward arbitrary memory corruption and code execution.\nA:H - The bug reliably produces kernel list corruption and use-after-free in softirq/context Bluetooth receive path, leading to kernel oops or panic and denial of service on phones, laptops, and embedded devices with Bluetooth enabled."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63975","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63984","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code runs in the IPv6 routing-header receive handler on incoming packets; a remote attacker can deliver a crafted RFC 6554 type-3 RPL SRH to an RPL-enabled router or gateway over the network.\nAC:L - Triggering requires only a deterministically crafted SRH (e.g., n=127, CmprI=15, CmprE=15, pad=0, hdrlen=16, segments_left>0); all of these fields are fully attacker-controlled once the target has rpl_seg_enabled.\nPR:N - No authentication or local privileges are needed to send the malicious IPv6 packet; rpl_seg_enabled is a victim-side deployment setting on RPL routers/gateways (IoT/industrial mesh), not an attacker privilege requirement.\nUI:N - Exploitation is achieved solely by sending a malformed network packet and does not require any action from a victim user.\nS:U - Impact is confined to kernel memory corruption and packet forwarding within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The hdrlen truncation causes overlapping read/write of the same kmalloc buffer during decompress/recompress, constituting kernel heap memory corruption that can be leveraged for information disclosure primitives.\nI:H - ipv6_rpl_srh_compress() performs out-of-bounds writes into the overlapping decompressed region, corrupting routing-header data that is then memcpy'd into the forwarded skb, enabling memory corruption exploitable for control-flow or data modification.\nA:H - Kernel heap corruption during SRH processing can cause kernel oops, panics, or repeated crashes when processing or forwarding the corrupted packet, consistent with high availability impact for memory-corruption bugs."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63984","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63994","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when remotely injected VXLAN/GENEVE UDP packets traverse a bridged/OVS overlay and fail PMTU checks during encapsulation transmit, the same network path previously demonstrated in CVE-2023-53600 via vxlan_xmit through bridge forwarding.\nAC:L - An attacker can reliably send oversized DF-marked inner IP packets over the overlay to force PMTU ICMP generation, and can influence skb_cow() reallocation through bridge flooding/multicast cloning or headroom pressure; no uncontrollable victim state is required.\nPR:N - Exploitation requires no privileges on the victim host; any remote entity that can send VXLAN/GENEVE traffic to a VTEP with a bridged tunnel interface (standard cloud/SDN deployment) can reach the vulnerable code without authentication.\nUI:N - Triggering is fully automatic during kernel packet forwarding and tunnel encapsulation; no victim user action is needed beyond normal network operation of an overlay endpoint.\nS:U - Impact is confined to kernel memory on the affected host (UAF read/crash/potential escalation); it does not inherently cross VM, container, or IOMMU security boundaries.\nC:H - Stale ip_hdr/ipv6_hdr pointers cause reads from freed slab memory; leaked values are incorporated into ICMP error IP headers that are sent back to the attacker, constituting arbitrary kernel heap content disclosure.\nI:H - Use-after-free on skb header memory is a heap corruption primitive that can be developed into controlled writes or code execution via heap grooming, consistent with kernel UAF severity guidance.\nA:H - Dereferencing freed skb head memory during ICMP construction can cause kernel oops/panic and denial of service, as with other confirmed bugs in this same code path."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63994","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64106","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through the KVM device ioctl path (KVM_SET_DEVICE_ATTR with KVM_DEV_ARM_ITS_RESTORE_TABLES), which requires a local process with access to a VM file descriptor; it is not triggered by network packets or guest MMIO/ITS commands.\nAC:L - An attacker can reliably plant a crafted Device Table Entry in guest RAM (Size field encoding 17–32 EventID bits) and have it processed during migration/snapshot restore; no race or attacker-uncontrollable memory layout is required, and the live MAPD path already proves the invalid state is straightforward to supply.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant who needs no host privileges: they write a malformed DTE directly into guest physical memory (bypassing MAPD validation) and trigger host-side restore during automated live migration or snapshot resume, without requiring /dev/kvm or root on the host.\nUI:N - Exploitation does not require victim interaction beyond normal hypervisor operations such as automated live migration or snapshot restore that the attacker can initiate as a VM tenant; no end-user action like opening a file is needed.\nS:C - The vulnerability crosses the VM security boundary because guest-controlled saved state causes the host kernel to perform an oversized ITS table scan and mass kernel allocations, impacting host availability outside the guest's security scope.\nC:H - The unchecked num_eventid_bits value inflates scan_its_table()'s range up to BIT_ULL(32)*8 bytes (and can wrap the int size parameter for values 28–31), causing the host kernel to read far beyond the valid ITT bounds through kvm_read_guest_lock across a large guest GPA span.\nI:N - The flaw causes excessive guest-memory reads and kernel object allocation but does not corrupt or write host kernel memory; there is no demonstrated arbitrary host write, use-after-free, or code-execution primitive from this bug alone.\nA:H - The oversized scan can loop for an enormous number of kvm_read_guest_lock iterations (worse when the truncated int size wraps to a huge unsigned length), and valid-looking restored ITEs can drive unbounded vgic_add_lpi/kzalloc allocations, exhausting host CPU and memory and causing severe denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64106","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64189","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable dump and resize paths are reached through local NETLINK_NETFILTER send and receive syscalls, not through remotely received packets.\nAC:L - The attacker controls both sides by issuing an ipset dump and concurrent CREATE requests that grow ip_set_list, and can repeat the race without any victim-controlled condition.\nPR:L - NFNETLINK requires CAP_NET_ADMIN in the network namespace's owning user namespace, which an unprivileged user can obtain through user and network namespaces on deployments permitting unprivileged user namespaces.\nUI:N - After obtaining local execution, the attacker can trigger both racing operations without any action by another user.\nS:U - Exploitation compromises the kernel of the same host and constitutes standard local privilege escalation rather than crossing a VM, hypervisor, or IOMMU boundary.\nC:H - Reclaiming the freed array can make the loaded struct ip_set pointer attacker-influenced, after which variant-pointer dereferences can enable kernel code execution and arbitrary memory disclosure.\nI:H - The release path performs an indirect uref callback and decrements ref_netlink through the stale pointer, providing control-flow and kernel-memory-write opportunities after heap reclamation.\nA:H - The reported use-after-free produced a general-protection fault and kernel panic, and an attacker can trigger the race repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64189","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64530","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On a transparent bridge or traffic-shaping gateway configured with the RED qevent and act_ct, unauthenticated remote IP fragments reach red_enqueue() through normal receive, bridge-forwarding, and egress-qdisc processing. No local netlink access is required to trigger the deployed configuration.\nAC:L - The attacker controls fragment contents and ordering and can drive RED into deterministic hard-mark or drop conditions with sustained traffic. No race or condition outside the attacker's control must be won.\nPR:N - CAP_NET_ADMIN is required to create the vulnerable configuration, but a remote attacker sending fragments through an already configured appliance needs no privileges or authentication. Local triggering is also possible with namespaced CAP_NET_ADMIN.\nUI:N - Triggering requires only attacker-generated fragmented traffic and does not depend on a victim performing any action.\nS:U - The corruption occurs within the host kernel and compromises resources governed by that same security authority. This remains unchanged scope even when used for namespace escape or kernel privilege escalation.\nC:H - The reclaimable sk_buff use-after-free and corrupted defragmentation-tree links can be leveraged through attacker-controlled network heap spraying to disclose arbitrary kernel memory.\nI:H - RED overwrites linkage fields that overlap the defragmentation RB node and may free the object while it remains referenced, enabling subsequent writes through freed or attacker-reclaimed kernel objects and potential code execution.\nA:H - The dangling fragment-tree entry can cause immediate or deferred use-after-free, double-free, invalid tree operations, and kernel panic when another fragment arrives or the queue expires. The attacker can trigger this repeatedly with fragmented traffic."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64530","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64560","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached purely through local syscalls (`timer_create`/`timer_settime`/`timer_delete`/`clock_nanosleep`) raced against `execve()` from a non-leader thread in the attacker's own process. No network or remote data path reaches posix-cpu-timers.\nAC:L - The attacker controls both sides of the race — one thread arms and deletes a process-wide CPU timer while a non-leader thread in the same process calls `execve()` — and can loop indefinitely with CPU pinning/thread spraying to widen the window between `pid_task()` and `lock_task_sighand()`. No condition depends on anything outside attacker control.\nPR:L - Any ordinary unprivileged local user can create and delete `CLOCK_PROCESS_CPUTIME_ID` timers; `pid_for_clock()` performs no capability check when the encoded PID is 0, and `CONFIG_POSIX_TIMERS` is `default y` on essentially all deployments.\nUI:N - The attacker performs every step — timer creation, arming, deletion, and the concurrent non-leader exec — entirely within its own multithreaded process. No victim action is involved.\nS:U - The corruption stays within the kernel's own security authority; it is a standard local kernel memory-corruption/privilege-escalation primitive with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The stale timerqueue node yields UAF reads of the freed `k_itimer` and causes `current` (a live `task_struct` pointer) plus rbtree pointers to be written into the freed/reallocated slot, and the freed object can be reclaimed by another attacker-created `k_itimer`, enabling kernel pointer disclosure and broad memory read.\nI:H - `collect_timerqueue()` writes into freed memory (`ctmr->firing`, `ctmr->handling`, rbtree rebalancing, list insertion) and the `do_cpu_nanosleep()` variant does so into a live, attacker-groomed kernel stack frame, followed by `cpu_timer_fire()` dereferencing attacker-controlled `it_process`/`it_signal` — a control-flow-hijack-capable write primitive.\nA:H - Even without exploitation the dangling timerqueue node produces rbtree/list corruption and a kernel oops, and the pre-fix `WARN_ON_ONCE(timerqueue_node_queued(...))` is an immediate panic under `panic_on_warn`; the race can be triggered repeatedly by any local user."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64560","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64561","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable shadow-MMU page-fault path is reached via local KVM_RUN handling of guest EPT/shadow faults (and nested EPT via paging_tmpl), not by network or adjacent-radio packets.\nAC:L - An attacker who can run nested or shadow-MMU guests controls MMU pressure (heavy nested mappings and/or KVM_SET_NR_MMU_PAGES) and concurrent faults so reclaim zaps an in-use root during make_mmu_pages_available; no attacker-uncontrollable condition is required.\nPR:L - Exploitation needs /dev/kvm access or a nested-capable guest on the host, privileges commonly available to kvm-group users or cloud tenants, not real init-namespace root or CAP_SYS_ADMIN on the create/run path.\nUI:N - Once the attacker can run the guest, they trigger reclaim and page faults entirely through their own vCPU activity with no action by another user.\nS:C - Guest-controlled faults corrupt host KVM MMU state (invalid shadow pages on active_mmu_pages and subsequent list handling), crossing the guest-to-host virtualization boundary into the host kernel authority.\nC:H - Invalid children on active_mmu_pages break zap accounting assumptions so later prepare_zap list_add on still-linked entries corrupts kernel lists, a memory-corruption primitive that can be leveraged for arbitrary host reads.\nI:H - The same active-list invariant break and linked-list corruption in host MMU teardown/reclaim paths yield writable host corruption suitable for control-flow or structure hijacking, not merely a benign accounting glitch.\nA:H - WARN_ON_ONCE skips, infinite zap loops, list corruption, and host oops/hangs are reachable when invalid shadow pages remain on active_mmu_pages, causing host and co-located VM denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64561","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64564","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in SCTP ASCONF receive processing (sctp_rcv → sctp_sf_do_asconf → sctp_process_asconf → sctp_process_asconf_param); a remote peer triggers it by sending a crafted ASCONF over IP/IPv6 on an established association, matching kernel guidance that net/ stack bugs reachable via received packets are Network.\nAC:L - A single attacker-controlled ASCONF with [Address Parameter L][DEL-IP L][DEL-IP 0.0.0.0] reliably frees asconf->transport then reuses it in the same softirq; the peer fully controls multi-homing, serial, and parameter order, with no race or other condition outside attacker influence.\nPR:N - Any remote SCTP peer that completes a normal association with ADD-IP negotiated can send the ASCONF; SCTP-AUTH keys come from the handshake the peer itself performs (or addip_noauth), and no local credentials or capabilities on the target are required.\nUI:N - Exploitation requires only attacker-sent SCTP packets processed automatically in the receive/state-machine path; no victim user action such as opening a file or mounting a device is needed.\nS:U - Impact is confined to the vulnerable host kernel (sctp_transport UAF / crash or privilege escalation) and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - This is a heap use-after-free of an sctp_transport planted into primary_path/active_path after RCU-deferred free; freed-object reuse yields arbitrary kernel read primitives, scored High per UAF guidance.\nI:H - The same transport UAF enables heap spraying and write/control-flow hijacking via later dereferences of the dangling primary_path/active_path, so integrity impact is High.\nA:H - set_primary() immediately dereferences the freed transport and leaves the association with transport_count 0 and dangling path pointers, causing a reproducible kernel oops/panic on subsequent use, which is High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64564","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64600","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation uses local FICLONE and concurrent O_DIRECT write syscalls against an XFS filesystem.\nAC:L - The attacker controls both racing writers, can amplify the transaction-allocation window, and demonstrated exploitation typically succeeds within seconds.\nPR:L - A basic unprivileged local user needs only read access to the protected source and write access to a scratch file; no capabilities are required.\nUI:N - The attacker creates the reflink and triggers both sides of the race without any victim action.\nS:U - This is a standard local kernel-mediated privilege escalation affecting resources within the host operating system's existing security authority.\nC:H - Overwriting /etc/passwd or a readable SUID-root binary yields full root access and consequently unrestricted access to system-confidential data.\nI:H - The stale physical mapping provides attacker-controlled persistent writes into protected readable files while preserving their ownership and SUID metadata, enabling full root compromise.\nA:H - The attacker can persistently corrupt boot-critical binaries or configuration files and, after obtaining root, cause complete system unavailability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64600","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A3602-1","advisory_id":"130b8b86-0b9f-4b76-b8c0-96bf6997a30c","event_types":["advisory"],"published_at":"2026-10-25T22:45:52.959384+00:00","technologies":["core-osv","kernel-64kb","kernel-default","kernel-default-base","kernel-docs","kernel-livepatch-sle15-sp6-update-30","kernel-obs-build","kernel-source","kernel-syms","kernel-zfcpdump"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T15:40:54+00:00","detail_url":"/advisories/advisory%3A130b8b86-0b9f-4b76-b8c0-96bf6997a30c","group":{"id":"advisory:130b8b86-0b9f-4b76-b8c0-96bf6997a30c","revision":1,"primary_event_id":71340,"change":"published","superseded_by":[],"changed":{"id":71340,"cve_ids":["CVE-2026-31482","CVE-2026-31483","CVE-2026-31542","CVE-2026-31598","CVE-2026-31628","CVE-2026-43033","CVE-2026-43046","CVE-2026-43056","CVE-2026-43276","CVE-2026-43440","CVE-2026-43475","CVE-2026-45904","CVE-2026-46056","CVE-2026-46080","CVE-2026-46084","CVE-2026-46109","CVE-2026-46117","CVE-2026-46126","CVE-2026-46144","CVE-2026-46145","CVE-2026-46174","CVE-2026-46193","CVE-2026-46243","CVE-2026-46323","CVE-2026-46324","CVE-2026-46333","CVE-2026-52967","CVE-2026-52986","CVE-2026-53050","CVE-2026-53129","CVE-2026-53131","CVE-2026-53177","CVE-2026-53224","CVE-2026-53246","CVE-2026-53250","CVE-2026-53262","CVE-2026-53267","CVE-2026-53297","CVE-2026-53324","CVE-2026-53354","CVE-2026-53375","CVE-2026-53388","CVE-2026-53391","CVE-2026-53402","CVE-2026-63794","CVE-2026-63802","CVE-2026-63806","CVE-2026-63807","CVE-2026-63824","CVE-2026-63826","CVE-2026-63829","CVE-2026-63884","CVE-2026-63893","CVE-2026-63912","CVE-2026-63917","CVE-2026-63919","CVE-2026-63921","CVE-2026-63922","CVE-2026-63924","CVE-2026-63946","CVE-2026-63952","CVE-2026-63968","CVE-2026-63971","CVE-2026-63975","CVE-2026-63984","CVE-2026-63994","CVE-2026-64106","CVE-2026-64189","CVE-2026-64530","CVE-2026-64560","CVE-2026-64561","CVE-2026-64564","CVE-2026-64600"],"payload":{"kind":"advisory","title":"Security update for the Linux Kernel","summary":"The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435). - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656). - CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995). - CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181). - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289). - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188). - CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633). - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773). - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997). - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988). - CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808). - CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000). - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577). - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230). - CVE-2026-53375: drm/amdgpu/vce: ","evidence":"osv:SUSE-SU-2026:3602-1","products":[{"name":{"value":"kernel-default","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-livepatch-SLE15-SP6_Update_30","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1-150600.13.5.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-64kb","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1.150600.12.60.3","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-zfcpdump","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1.150600.12.60.3","evidence":"/affected/12/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/13/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/13/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/14/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/14/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/15/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/15/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/16/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/16/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:3602-1","aliases":["SUSE-SU-2026:3602-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.130.1","kernel-default-livepatch-devel":"6.4.0-150600.23.130.1","kernel-livepatch-6_4_0-150600_23_130-default":"1-150600.13.5.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.5.1"}]}],"package":{"name":"kernel-livepatch-SLE15-SP6_Update_30","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_30&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.130.1","kernel-default-livepatch-devel":"6.4.0-150600.23.130.1","kernel-livepatch-6_4_0-150600_23_130-default":"1-150600.13.5.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-64kb","purl":"pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1.150600.12.60.3"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-zfcpdump","purl":"pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1.150600.12.60.3"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}}],"modified":"2026-10-02T18:42:47.946147883Z","provider":"osv","upstream":["CVE-2026-31482","CVE-2026-31483","CVE-2026-31542","CVE-2026-31598","CVE-2026-31628","CVE-2026-43033","CVE-2026-43046","CVE-2026-43056","CVE-2026-43276","CVE-2026-43440","CVE-2026-43475","CVE-2026-45904","CVE-2026-46056","CVE-2026-46080","CVE-2026-46084","CVE-2026-46109","CVE-2026-46117","CVE-2026-46126","CVE-2026-46144","CVE-2026-46145","CVE-2026-46174","CVE-2026-46193","CVE-2026-46243","CVE-2026-46323","CVE-2026-46324","CVE-2026-46333","CVE-2026-52967","CVE-2026-52986","CVE-2026-53050","CVE-2026-53129","CVE-2026-53131","CVE-2026-53177","CVE-2026-53224","CVE-2026-53246","CVE-2026-53250","CVE-2026-53262","CVE-2026-53267","CVE-2026-53297","CVE-2026-53324","CVE-2026-53354","CVE-2026-53375","CVE-2026-53388","CVE-2026-53391","CVE-2026-53402","CVE-2026-63794","CVE-2026-63802","CVE-2026-63806","CVE-2026-63807","CVE-2026-63824","CVE-2026-63826","CVE-2026-63829","CVE-2026-63884","CVE-2026-63893","CVE-2026-63912","CVE-2026-63917","CVE-2026-63919","CVE-2026-63921","CVE-2026-63922","CVE-2026-63924","CVE-2026-63946","CVE-2026-63952","CVE-2026-63968","CVE-2026-63971","CVE-2026-63975","CVE-2026-63984","CVE-2026-63994","CVE-2026-64106","CVE-2026-64189","CVE-2026-64530","CVE-2026-64560","CVE-2026-64561","CVE-2026-64564","CVE-2026-64600"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20263602-1/","https://bugzilla.suse.com/1185845","https://bugzilla.suse.com/1253262","https://bugzilla.suse.com/1258718","https://bugzilla.suse.com/1260347","https://bugzilla.suse.com/1262745","https://bugzilla.suse.com/1262771","https://bugzilla.suse.com/1263010","https://bugzilla.suse.com/1263068","https://bugzilla.suse.com/1263718","https://bugzilla.suse.com/1263788","https://bugzilla.suse.com/1264053","https://bugzilla.suse.com/1264089","https://bugzilla.suse.com/1264090","https://bugzilla.suse.com/1264558","https://bugzilla.suse.com/1264779","https://bugzilla.suse.com/1264795","https://bugzilla.suse.com/1265308","https://bugzilla.suse.com/1266238","https://bugzilla.suse.com/1266758","https://bugzilla.suse.com/1266850","https://bugzilla.suse.com/1266890","https://bugzilla.suse.com/1266913","https://bugzilla.suse.com/1267375","https://bugzilla.suse.com/1267384","https://bugzilla.suse.com/1267435","https://bugzilla.suse.com/1267584","https://bugzilla.suse.com/1267596","https://bugzilla.suse.com/1267656","https://bugzilla.suse.com/1267682","https://bugzilla.suse.com/1267715","https://bugzilla.suse.com/1267995","https://bugzilla.suse.com/1268029","https://bugzilla.suse.com/1268307","https://bugzilla.suse.com/1269181","https://bugzilla.suse.com/1269188","https://bugzilla.suse.com/1269289","https://bugzilla.suse.com/1269383","https://bugzilla.suse.com/1269512","https://bugzilla.suse.com/1269513","https://bugzilla.suse.com/1269577","https://bugzilla.suse.com/1269633","https://bugzilla.suse.com/1269773","https://bugzilla.suse.com/1269808","https://bugzilla.suse.com/1269981","https://bugzilla.suse.com/1269988","https://bugzilla.suse.com/1269997","https://bugzilla.suse.com/1270000","https://bugzilla.suse.com/1270230","https://bugzilla.suse.com/1271349","https://bugzilla.suse.com/1271368","https://bugzilla.suse.com/1271526","https://bugzilla.suse.com/1271825","https://bugzilla.suse.com/1271866","https://bugzilla.suse.com/1271899","https://bugzilla.suse.com/1271904","https://bugzilla.suse.com/1271908","https://bugzilla.suse.com/1271912","https://bugzilla.suse.com/1271964","https://bugzilla.suse.com/1272176","https://bugzilla.suse.com/1272180","https://bugzilla.suse.com/1272183","https://bugzilla.suse.com/1272207","https://bugzilla.suse.com/1272242","https://bugzilla.suse.com/1272263","https://bugzilla.suse.com/1272268","https://bugzilla.suse.com/1272282","https://bugzilla.suse.com/1272466","https://bugzilla.suse.com/1272468","https://bugzilla.suse.com/1272573","https://bugzilla.suse.com/1272607","https://bugzilla.suse.com/1272665","https://bugzilla.suse.com/1272678","https://bugzilla.suse.com/1272693","https://bugzilla.suse.com/1272694","https://bugzilla.suse.com/1272836","https://bugzilla.suse.com/1272855","https://bugzilla.suse.com/1272865","https://bugzilla.suse.com/1272904","https://bugzilla.suse.com/1272907","https://bugzilla.suse.com/1272918","https://bugzilla.suse.com/1273004","https://bugzilla.suse.com/1273035","https://bugzilla.suse.com/1273231","https://bugzilla.suse.com/1274072","https://www.suse.com/security/cve/CVE-2026-31482","https://www.suse.com/security/cve/CVE-2026-31483","https://www.suse.com/security/cve/CVE-2026-31542","https://www.suse.com/security/cve/CVE-2026-31598","https://www.suse.com/security/cve/CVE-2026-31628","https://www.suse.com/security/cve/CVE-2026-43033","https://www.suse.com/security/cve/CVE-2026-43046","https://www.suse.com/security/cve/CVE-2026-43056","https://www.suse.com/security/cve/CVE-2026-43276","https://www.suse.com/security/cve/CVE-2026-43440","https://www.suse.com/security/cve/CVE-2026-43475","https://www.suse.com/security/cve/CVE-2026-45904","https://www.suse.com/security/cve/CVE-2026-46056","https://www.suse.com/security/cve/CVE-2026-46080","https://www.suse.com/security/cve/CVE-2026-46084","https://www.suse.com/security/cve/CVE-2026-46109","https://www.suse.com/security/cve/CVE-2026-46117","https://www.suse.com/security/cve/CVE-2026-46126","https://www.suse.com/security/cve/CVE-2026-46144","https://www.suse.com/security/cve/CVE-2026-46145","https://www.suse.com/security/cve/CVE-2026-46174","https://www.suse.com/security/cve/CVE-2026-46193","https://www.suse.com/security/cve/CVE-2026-46243","https://www.suse.com/security/cve/CVE-2026-46323","https://www.suse.com/security/cve/CVE-2026-46324","https://www.suse.com/security/cve/CVE-2026-46333","https://www.suse.com/security/cve/CVE-2026-52967","https://www.suse.com/security/cve/CVE-2026-52986","https://www.suse.com/security/cve/CVE-2026-53050","https://www.suse.com/security/cve/CVE-2026-53129","https://www.suse.com/security/cve/CVE-2026-53131","https://www.suse.com/security/cve/CVE-2026-53177","https://www.suse.com/security/cve/CVE-2026-53224","https://www.suse.com/security/cve/CVE-2026-53246","https://www.suse.com/security/cve/CVE-2026-53250","https://www.suse.com/security/cve/CVE-2026-53262","https://www.suse.com/security/cve/CVE-2026-53267","https://www.suse.com/security/cve/CVE-2026-53297","https://www.suse.com/security/cve/CVE-2026-53324","https://www.suse.com/security/cve/CVE-2026-53354","https://www.suse.com/security/cve/CVE-2026-53375","https://www.suse.com/security/cve/CVE-2026-53388","https://www.suse.com/security/cve/CVE-2026-53391","https://www.suse.com/security/cve/CVE-2026-53402","https://www.suse.com/security/cve/CVE-2026-63794","https://www.suse.com/security/cve/CVE-2026-63802","https://www.suse.com/security/cve/CVE-2026-63806","https://www.suse.com/security/cve/CVE-2026-63807","https://www.suse.com/security/cve/CVE-2026-63824","https://www.suse.com/security/cve/CVE-2026-63826","https://www.suse.com/security/cve/CVE-2026-63829","https://www.suse.com/security/cve/CVE-2026-63884","https://www.suse.com/security/cve/CVE-2026-63893","https://www.suse.com/security/cve/CVE-2026-63912","https://www.suse.com/security/cve/CVE-2026-63917","https://www.suse.com/security/cve/CVE-2026-63919","https://www.suse.com/security/cve/CVE-2026-63921","https://www.suse.com/security/cve/CVE-2026-63922","https://www.suse.com/security/cve/CVE-2026-63924","https://www.suse.com/security/cve/CVE-2026-63946","https://www.suse.com/security/cve/CVE-2026-63952","https://www.suse.com/security/cve/CVE-2026-63968","https://www.suse.com/security/cve/CVE-2026-63971","https://www.suse.com/security/cve/CVE-2026-63975","https://www.suse.com/security/cve/CVE-2026-63984","https://www.suse.com/security/cve/CVE-2026-63994","https://www.suse.com/security/cve/CVE-2026-64106","https://www.suse.com/security/cve/CVE-2026-64189","https://www.suse.com/security/cve/CVE-2026-64530","https://www.suse.com/security/cve/CVE-2026-64560","https://www.suse.com/security/cve/CVE-2026-64561","https://www.suse.com/security/cve/CVE-2026-64564","https://www.suse.com/security/cve/CVE-2026-64600"]},"related_cves":[{"value":"CVE-2026-31482","evidence":"/upstream"},{"value":"CVE-2026-31483","evidence":"/upstream"},{"value":"CVE-2026-31542","evidence":"/upstream"},{"value":"CVE-2026-31598","evidence":"/upstream"},{"value":"CVE-2026-31628","evidence":"/upstream"},{"value":"CVE-2026-43033","evidence":"/upstream"},{"value":"CVE-2026-43046","evidence":"/upstream"},{"value":"CVE-2026-43056","evidence":"/upstream"},{"value":"CVE-2026-43276","evidence":"/upstream"},{"value":"CVE-2026-43440","evidence":"/upstream"},{"value":"CVE-2026-43475","evidence":"/upstream"},{"value":"CVE-2026-45904","evidence":"/upstream"},{"value":"CVE-2026-46056","evidence":"/upstream"},{"value":"CVE-2026-46080","evidence":"/upstream"},{"value":"CVE-2026-46084","evidence":"/upstream"},{"value":"CVE-2026-46109","evidence":"/upstream"},{"value":"CVE-2026-46117","evidence":"/upstream"},{"value":"CVE-2026-46126","evidence":"/upstream"},{"value":"CVE-2026-46144","evidence":"/upstream"},{"value":"CVE-2026-46145","evidence":"/upstream"},{"value":"CVE-2026-46174","evidence":"/upstream"},{"value":"CVE-2026-46193","evidence":"/upstream"},{"value":"CVE-2026-46243","evidence":"/upstream"},{"value":"CVE-2026-46323","evidence":"/upstream"},{"value":"CVE-2026-46324","evidence":"/upstream"},{"value":"CVE-2026-46333","evidence":"/upstream"},{"value":"CVE-2026-52967","evidence":"/upstream"},{"value":"CVE-2026-52986","evidence":"/upstream"},{"value":"CVE-2026-53050","evidence":"/upstream"},{"value":"CVE-2026-53129","evidence":"/upstream"},{"value":"CVE-2026-53131","evidence":"/upstream"},{"value":"CVE-2026-53177","evidence":"/upstream"},{"value":"CVE-2026-53224","evidence":"/upstream"},{"value":"CVE-2026-53246","evidence":"/upstream"},{"value":"CVE-2026-53250","evidence":"/upstream"},{"value":"CVE-2026-53262","evidence":"/upstream"},{"value":"CVE-2026-53267","evidence":"/upstream"},{"value":"CVE-2026-53297","evidence":"/upstream"},{"value":"CVE-2026-53324","evidence":"/upstream"},{"value":"CVE-2026-53354","evidence":"/upstream"},{"value":"CVE-2026-53375","evidence":"/upstream"},{"value":"CVE-2026-53388","evidence":"/upstream"},{"value":"CVE-2026-53391","evidence":"/upstream"},{"value":"CVE-2026-53402","evidence":"/upstream"},{"value":"CVE-2026-63794","evidence":"/upstream"},{"value":"CVE-2026-63802","evidence":"/upstream"},{"value":"CVE-2026-63806","evidence":"/upstream"},{"value":"CVE-2026-63807","evidence":"/upstream"},{"value":"CVE-2026-63824","evidence":"/upstream"},{"value":"CVE-2026-63826","evidence":"/upstream"},{"value":"CVE-2026-63829","evidence":"/upstream"},{"value":"CVE-2026-63884","evidence":"/upstream"},{"value":"CVE-2026-63893","evidence":"/upstream"},{"value":"CVE-2026-63912","evidence":"/upstream"},{"value":"CVE-2026-63917","evidence":"/upstream"},{"value":"CVE-2026-63919","evidence":"/upstream"},{"value":"CVE-2026-63921","evidence":"/upstream"},{"value":"CVE-2026-63922","evidence":"/upstream"},{"value":"CVE-2026-63924","evidence":"/upstream"},{"value":"CVE-2026-63946","evidence":"/upstream"},{"value":"CVE-2026-63952","evidence":"/upstream"},{"value":"CVE-2026-63968","evidence":"/upstream"},{"value":"CVE-2026-63971","evidence":"/upstream"},{"value":"CVE-2026-63975","evidence":"/upstream"},{"value":"CVE-2026-63984","evidence":"/upstream"},{"value":"CVE-2026-63994","evidence":"/upstream"},{"value":"CVE-2026-64106","evidence":"/upstream"},{"value":"CVE-2026-64189","evidence":"/upstream"},{"value":"CVE-2026-64530","evidence":"/upstream"},{"value":"CVE-2026-64560","evidence":"/upstream"},{"value":"CVE-2026-64561","evidence":"/upstream"},{"value":"CVE-2026-64564","evidence":"/upstream"},{"value":"CVE-2026-64600","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:130b8b86-0b9f-4b76-b8c0-96bf6997a30c","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-31598","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Although the core bug is in ocfs2 filesystem code, ocfs2 is exportable and nfsd can issue direct writes with IOCB_DIRECT while remote REMOVE operations reach vfs_unlink, making the vulnerable lock chains reachable over the network on a writable exported ocfs2 volume.\nAC:L - The bug is an ABBA deadlock where the attacker can drive both sides with concurrent extending direct writes and unlink/remove operations. Once the target deployment exposes those operations, winning the race is attacker-controlled.\nPR:N - A remote NFS client can trigger the operations through an exported writable share without kernel capabilities on the target. In permissive or anonymous export scenarios, no prior authenticated privileges are required.\nUI:N - No victim user action is required after the vulnerable service/filesystem is available. The attacker can send the write and remove operations directly.\nS:U - The impact remains within the same kernel/filesystem security authority. There is no VM escape, sandbox boundary crossing, or separate security scope.\nC:N - The issue is a lock-ordering deadlock, not memory corruption or information disclosure. It does not provide a read primitive or leak data.\nI:N - The vulnerable behavior does not corrupt memory or allow unauthorized data modification. It only causes threads to block on locks.\nA:H - The deadlock can permanently hang ocfs2 operations and affected kernel worker/syscall contexts. A kernel/filesystem hang is a high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31598","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43033","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable out-of-place AEAD decrypt path is reachable by a local process through AF_ALG sockets using authencesn, while normal inbound ESP uses in-place src==dst. This requires local syscall access rather than remote packets directly reaching the bad branch.\nAC:L - The attacker controls the AF_ALG request buffers, associated-data length, operation type, key, and authsize, and no race or hard-to-influence state is required. The fault occurs before ICV verification, so a valid packet/tag is not needed.\nPR:L - AF_ALG socket creation, bind, key setup, and AEAD decrypt do not require CAP_NET_ADMIN or CAP_SYS_ADMIN, but the attacker needs local unprivileged code execution. XFRM state management is privileged, but the lower-privilege AF_ALG path reaches the bug.\nUI:N - No victim action is required once the local attacker runs the AF_ALG syscall sequence. The attacker supplies both input and output buffers directly.\nS:U - The vulnerability is in kernel crypto processing and impacts the same kernel security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:H - The bug is a kernel memory-corruption condition from writing ESN high sequence bytes past the intended out-of-place destination; successful exploitation of such corruption could expose arbitrary kernel memory. Under the required uncertainty rule, this is scored as high confidentiality impact.\nI:H - The vulnerable code performs an attacker-influenced out-of-bounds write of four bytes before authentication succeeds. Kernel out-of-bounds writes are scored as high integrity impact because they can plausibly be shaped into control-flow or data corruption.\nA:H - At minimum, the AF_ALG path can drive scatterwalk past the end of the destination scatterlist and crash the kernel. A local attacker can repeat the trigger without authentication, causing high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43033","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43056","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable `add_adev()` error path is reached during MANA PCI driver probe/resume/recovery or auxiliary RDMA service handling, not by processing received network packets. The highest defensible attacker path is local influence over driver/device lifecycle or resource-failure conditions.\nAC:L - Once `auxiliary_device_add()` fails, the UAF is deterministic because `auxiliary_device_uninit()` releases the embedded object and the cleanup path immediately reads `adev->id`. No attacker-uncontrolled race is required beyond reaching that failure path.\nPR:L - The path is not exposed to unauthenticated remote peers, but a local attacker can plausibly influence resource exhaustion/failure conditions around driver lifecycle events. Direct sysfs/module lifecycle control is privileged, but Low is the higher-severity defensible choice under the conservative scoring rule.\nUI:N - No separate victim action is required once the attacker can exercise or influence the local driver lifecycle/failure path. Probe, resume, and service-event handling run in kernel context.\nS:U - The affected component and impacts are within the Linux kernel security scope. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel use-after-free of an auxiliary-device container object after its release callback frees it. Under conservative kernel UAF scoring, freed slab reuse can support information disclosure, so confidentiality is High.\nI:H - The UAF lets stale object contents influence cleanup through `mana_adev_idx_free()`, and kernel UAFs are conservatively treated as potentially exploitable memory corruption. Integrity is therefore High.\nA:H - At minimum, the stale access can trigger a kernel UAF report, invalid IDA cleanup, oops, or panic during probe/resume error unwinding. Availability impact is High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43056","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46056","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handlers process HCI Secure Simple Pairing events (User Passkey Notify / Keypress Notify) driven by a remote Bluetooth peer during SSP pairing, so the attacker must be within Bluetooth radio range (adjacent), matching kernel guidance that Bluetooth = Adjacent.\nAC:L - This is a use-after-free where a remote peer drives the passkey/keypress events while connection teardown frees the conn from a concurrent context; the attacker influences both sides of the race and can retry, and UAF bugs are scored AC:L unless the race is uncontrollable.\nPR:N - The code path is reached by a remote Bluetooth device participating in the SSP pairing handshake, requiring no credentials or privileges on the target system.\nUI:N - The handlers execute automatically when the controller forwards the SSP passkey/keypress HCI events during the pairing protocol exchange; no local user action is required to reach the vulnerable code.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The use-after-free reads fields (dst, type, dst_type, passkey) from a freed and potentially reallocated hci_conn object, which can disclose attacker-controlled or sensitive kernel heap contents.\nI:H - The handlers write to the freed object (passkey_notify and passkey_entered fields), giving a UAF write into reallocated heap memory that can be leveraged for heap grooming and control-flow corruption.\nA:H - A use-after-free on the hci_conn structure readily causes kernel oops/panic, yielding high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46056","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46117","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through the RDMA userspace verbs interface (/dev/infiniband/uverbs<N>) by issuing a create-QP command locally; it is not exposed to network peers.\nAC:L - The condition is created entirely by the attacker (building an RWQ indirection table whose WQs share one CQ) and is deterministically triggered on the second loop iteration; there is no race or uncontrolled state.\nPR:L - Triggering only requires an unprivileged local process with access to the RDMA verbs device — the normal configuration on RDMA-enabled hosts — and no CAP_* check exists on the create-QP path.\nUI:N - The attacker performs all steps via its own verbs calls; no action by another user is required.\nS:U - The corruption stays within the kernel's own memory/security authority and does not cross a VM/IOMMU/sandbox boundary.\nC:H - The overwrite leaks/dangles objects in cq_table[], and a use-after-free on these IRQ-dispatched structures can be leveraged to read kernel memory contents.\nI:H - The driver \"goes on to corrupt the kernel,\" leaving dangling function-pointer/context entries in a table called from interrupt context, providing a write/control-flow corruption primitive.\nA:H - The user-triggerable WARN_ON panics the system when panic_on_warn is set, and the subsequent kernel state corruption causes oopses/crashes regardless."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46117","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46145","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only by issuing RDMA verbs to the local /dev/infiniband/uverbs* character device; `rx_hash_key_len` arrives via `ib_copy_from_udata` from a local process, with no remote network path.\nAC:L - The attacker directly controls `rx_hash_key_len` in the uAPI struct and can set it arbitrarily large to trigger the overflow on every call; there is no race or condition outside the attacker's control.\nPR:L - Reaching the raw-packet QP path requires CAP_NET_RAW, but that is a narrow, non-root capability (not the \"real root/admin\" bar for High) and is routinely granted to unprivileged networking/RDMA applications such as DPDK workloads.\nUI:N - The overflow is triggered entirely by the attacker's own QP-creation request; no action by any other user is required.\nS:U - The corruption is of the kernel's own heap allocation within the same kernel security authority; no crossing into a separate scope (VM/IOMMU) occurs.\nC:H - The memcpy over-reads the 40-byte stack source by an unbounded amount and the heap overflow can be leveraged to disclose adjacent kernel memory, so confidentiality impact is High.\nI:H - An attacker-controlled-length memcpy writes past a 40-byte heap field, giving a heap out-of-bounds write that corrupts adjacent kernel objects and is exploitable toward arbitrary write/control-flow hijack.\nA:H - A large `rx_hash_key_len` corrupts the kernel heap and/or faults reading unmapped stack/heap pages, reliably causing a kernel panic/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46145","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46174","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in the CPU's op cache and requires executing instructions on the affected core to drive improper resource sharing; it is not reachable over a network. Triggering it needs local code execution on the machine.\nAC:L - An attacker who can co-schedule code on SMT siblings of an affected Zen2 core controls both sides of the shared op-cache contention and can reliably drive the improper-isolation condition. Following the higher-severity rule, this is Low.\nPR:L - Triggering the op-cache resource sharing only requires the ability to run code (an unprivileged local user or a guest VM tenant); no root or admin capability is needed. It does, however, require at least some local execution access, so not None.\nUI:N - The attacker's own executing code populates and contends for the op cache; no victim action is required.\nS:C - The bug is an isolation failure of a microarchitectural resource shared across SMT threads, so instruction corruption can cross from the attacker's context into a different security authority (another VM/tenant or the host kernel), impacting resources beyond the attacking component's scope.\nC:H - Improper isolation of a shared op-cache resource is an information-disclosure vector across contexts, and the resulting instruction corruption can be leveraged to read memory belonging to another security domain.\nI:H - The defining impact is \"instruction corruption\" — the CPU executes corrupted/wrong instructions in a victim context, which is a direct, severe integrity violation enabling control-flow and data corruption across the isolation boundary.\nA:H - Instruction corruption causes incorrect execution, crashes, and hangs in the affected (potentially cross-context) code, resulting in high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46174","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46243","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local `request_key(2)` or `add_key(2)` from an unprivileged process; the flaw is missing origin validation in the keyring path, not remote SMB/CIFS protocol input.\nAC:L - On typical affected systems (CIFS module with upcall, cifs-utils request-key rule, unprivileged user/mount namespaces), the attacker fully controls the forged description, target pid, and namespace layout for a reliable root upcall chain.\nPR:L - Any local unprivileged user account can invoke the key syscalls; user/mount namespaces are part of the standard exploit setup and map to basic local user capability, not root-only access.\nUI:N - No victim action such as mounting a Kerberos CIFS share is required; the attacker forges the key request directly without depending on another user’s mount or session.\nS:U - Successful exploitation elevates privileges within the same host/kernel security domain (local root) and does not cross a VM/hypervisor or hardware isolation boundary by itself.\nC:H - The attack chain yields root-equivalent access in the root upcall helper, enabling arbitrary read of host data (full confidentiality compromise of the system).\nI:H - Malicious NSS modules run as root inside `cifs.upcall`, giving arbitrary code execution and full integrity compromise of the host, not merely limited data modification.\nA:N - The kernel bug is a trust-boundary failure without memory corruption or guaranteed kernel panic; primary impact is privilege escalation rather than kernel crash or sustained denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46243","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46323","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local attacker to inject zerocopy/managed-frags skbs via io_uring SEND_ZC, TUN/TAP, or similar local APIs; ordinary remote wire packets processed by GRO do not carry SKBFL_MANAGED_FRAG_REFS, so a network-only attacker cannot reach the buggy merge path.\nAC:L - The attacker fully controls both sides of the GRO merge (seed and zerocopy TCP segments over a veth pair), timing (netem delay, RST race), and buffer setup; a public working LPE exploit exists, so success does not depend on conditions outside attacker control.\nPR:L - Triggering requires only a basic unprivileged local account with io_uring and user-namespace access (unshare -Urn), which is the default on many distributions; no init-namespace root or CAP_NET_ADMIN is needed.\nUI:N - No victim user action is required; the attacker drives the entire exploit autonomously through syscalls and local network namespace setup.\nS:U - Impact is standard host-kernel privilege escalation (root on the same kernel); it does not cross a distinct hypervisor/IOMMU security boundary such as VM-guest-to-host escape.\nC:H - The flaw is a use-after-free on page structures; the known exploit leverages the refcount underflow to obtain stale read access to freed physical pages and extract kernel PTE contents, enabling arbitrary memory disclosure primitives.\nI:H - UAF page refcount corruption enables crafting writable PTE entries against read-only page-cache pages; the public exploit demonstrates integrity compromise by rewriting /etc/passwd and obtaining root via su.\nA:H - Use-after-free of page structures can cause kernel oops/panic during skb teardown; even failed exploitation attempts can crash the system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46323","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46324","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in nf_tables netdev hook teardown reached only via Netfilter netlink (nft) syscalls—chain/flowtable updates, dumps, netns teardown, and netlink socket release—not from remote packet handling alone. Per kernel guidance, nftables/netfilter is Local (L).\nAC:L - Exploitation is a race between hook-list removal (`list_del()` + RCU free) and concurrent RCU walkers (`nft_dump_basechain_hook_list`, flowtable dump, or packet-path `list_for_each_entry_rcu`). An attacker with CAP_NET_ADMIN can drive both sides concurrently (e.g., one thread dumping chains/flowtables while another deletes hooks or tears down the netns).\nPR:L - All nf_tables netlink operations are gated by `netlink_net_capable(skb, CAP_NET_ADMIN)` in `nfnetlink_rcv()`. CAP_NET_ADMIN is obtainable by an unprivileged user via user+network namespaces (`unshare -Urn`), not real init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers hook teardown and concurrent dumps or traffic entirely through their own netlink sockets and namespace lifecycle.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries.\nC:H - Using `list_del()` instead of `list_del_rcu()` on lists walked under `rcu_read_lock()` is a use-after-free/list-corruption bug; concurrent dumpers dereference `nft_hook` fields (e.g., `ifname`) after unlink/free, enabling arbitrary kernel memory read via heap grooming.\nI:H - The freed `nft_hook` kmalloc object can be reallocated and corrupted through the dangling RCU list pointers, providing a standard kernel UAF primitive exploitable for arbitrary write and control-flow hijacking.\nA:H - The race reliably causes kernel list corruption and use-after-free, leading to oops/panic during hook dumps, flowtable lookups, or netns cleanup; UAF in this path has inherent high availability impact even when not fully weaponized."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46324","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46333","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable authorization check is reached through local interfaces such as ptrace-style checks, procfs, and pidfd_getfd; it is not reachable from network packets or adjacent/physical input.\nAC:L - A local attacker can repeatedly trigger the relevant check and, for exiting tasks, can race pidfd_getfd/procfs access against a target's exit path after exit_mm() but before exit_files(). The race is attacker-driven and does not require unusual kernel configuration or conditions outside the attacker's influence.\nPR:L - An unprivileged local user can target same-UID nondumpable tasks because the vulnerable code skips the dumpability requirement once task->mm is NULL. User-namespace root does not help against init-namespace root kernel threads, but low local privileges are enough for the same-UID exiting-task case.\nUI:N - Exploitation does not require a victim user to open a file or perform an interactive action; the attacker can use local syscalls/procfs against an existing or attacker-terminated target task.\nS:U - The bug bypasses Linux kernel task-access authorization within the same OS security authority. It does not cross a VM, IOMMU, or hypervisor boundary.\nC:H - The bypass can allow access to sensitive task details and, most importantly, pidfd_getfd can duplicate file descriptors from a nondumpable task during the exit window. In a plausible helper/sandbox scenario, those descriptors can expose highly sensitive files or privileged resources.\nI:H - If the duplicated descriptor is writable, the attacker can modify the protected resource reachable through the victim's file descriptor despite the dumpability restriction. This is a high-impact integrity bypass even though the bug is not memory corruption.\nA:N - The issue is an access-control bypass around ptrace/dumpability checks and does not by itself provide a kernel crash, hang, deadlock, or sustained denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46333","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52967","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable SMB client parser consumes an SMB2 CREATE error response supplied by a remote SMB server over the network. A malicious or compromised SMB share can send the crafted `STATUS_STOPPED_ON_SYMLINK` response.\nAC:L - The server directly controls `ErrorContextCount`, `ByteCount`, `ErrorId`, and `ErrorDataLength`, and no race or hard-to-hit state is required. Although the wraparound behavior is 32-bit specific, that is a deployment property rather than an attacker-uncontrolled exploitation condition.\nPR:N - The attacker needs no privileges on the victim system; they only need to operate or control the SMB server endpoint that the client connects to. The path can also be reached through guest or null-auth SMB sessions.\nUI:R - The victim client must mount/connect to the SMB share and perform a path operation such as lookup, stat, open, or create that causes an SMB2 CREATE response to be parsed. The remote server cannot trigger this parser without client-side filesystem activity.\nS:U - The affected component is the Linux kernel SMB client, and the impact is to the same kernel/client security authority. This is not a VM escape, IOMMU bypass, or cross-scope sandbox escape.\nC:H - The bug is an out-of-bounds kernel read in a server-controlled response parser, and the read is not strictly bounded to only a few harmless bytes. Following the required conservative rule, this is scored as high confidentiality impact.\nI:N - The defect advances a parser pointer incorrectly and reads from the wrong location, but it does not write out of bounds or provide a kernel memory write primitive. No direct integrity impact beyond normal malicious-server control of SMB content was identified.\nA:H - The crafted length can make the parser loop indefinitely on 32-bit systems, causing a reliable denial of service. Other malformed pointer positions can also lead to invalid kernel reads and possible oops conditions."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52967","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52986","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable SIP conntrack helper parses SIP payload carried in TCP/UDP network packets once the SIP helper is enabled, which is a reasonable deployment for NAT/firewall SIP gateways. A remote SIP peer can send crafted packets to that packet-processing path.\nAC:L - The trigger is a malformed numeric SIP field or URI port at the parser buffer boundary; no race or victim-controlled timing is required. Helper/NAT configuration is an environmental prerequisite, not an attacker-controlled complexity condition.\nPR:N - In the network gateway scenario, the attacker only needs to send unauthenticated SIP traffic through a system using the SIP conntrack helper. No local account or kernel privilege is required.\nUI:N - Exploitation is driven by packet processing in netfilter/conntrack. No user action is needed after the affected helper is configured.\nS:U - The impact is within the kernel/network stack security authority of the vulnerable system. It does not cross a separate scope such as guest-to-host or IOMMU isolation.\nC:H - The bug is an unbounded out-of-bounds read from non-NUL-terminated skb data via simple_strtoul and missing limit checks. Following the required guidance, an unbounded OOB read is high confidentiality impact.\nI:H - In NATed SIP paths, an out-of-bounds parser end pointer can feed attacker-influenced match lengths into NAT packet mangling, whose memmove/memcpy path lacks a bounds check against the skb payload. That creates a defensible kernel memory-corruption/code-execution risk.\nA:H - The same OOB read and possible invalid NAT mangle lengths can cause kernel faults, skb corruption, or panic. Crafted packets can be sent repeatedly, so availability impact is high."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52986","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53050","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local filesystem quota activity on a mounted OCFS2 filesystem, via ordinary dquot lifetime changes racing with the OCFS2 quota sync worker. It is not reachable by remote packets or adjacent/physical input.\nAC:L - This is a race, but a local attacker can repeatedly churn dquot references with filesystem operations while the periodic scanner runs. When uncertain, the higher-severity AC:L is appropriate.\nPR:L - After OCFS2 quotas are enabled, an unprivileged local user with write access to the filesystem can trigger dquot allocation and release paths. Mounting/configuring quotas is an environmental prerequisite, not a privilege needed for each exploit attempt.\nUI:N - No victim interaction is required once the affected filesystem is mounted and quotas are active. The attacker can trigger the relevant filesystem operations directly.\nS:U - The impact remains within the kernel and the same host security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The bug can lead to use-after-free of a dquot object under memory pressure. Kernel UAF conditions can be leveraged for memory disclosure, so confidentiality impact is High.\nI:H - The stale dquot/list state creates kernel heap use-after-free/list corruption, which can plausibly be shaped into write primitives or code execution. Integrity impact is therefore High.\nA:H - The race already produces kernel WARN/oops-style failure conditions and can dereference freed kernel objects. This can crash or destabilize the kernel, so availability impact is High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53050","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53131","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.4,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable netfilter match, ipset, and logging paths run while processing packets in receive/netdev hooks. In a reasonable firewall, router, VPN, or tunnel deployment with these rules installed, unauthenticated remote packets can reach the vulnerable code.\nAC:L - No race or difficult timing is required; a packet reaching a vulnerable rule with an invalid, unset, non-Ethernet, or too-short MAC header deterministically drives the bad eth_hdr(skb) access. The needed rule/interface setup is a plausible deployment condition, not an exploit race.\nPR:N - The remote packet sender does not need credentials or local privileges once the affected rule or logger is configured. Although rule installation requires CAP_NET_ADMIN, that is not required for the runtime remote-trigger scenario.\nUI:N - Exploitation is triggered by packet processing and does not require a victim user to open a file, mount anything, or perform another action.\nS:U - The impact remains within the kernel/network stack security authority. There is no VM, IOMMU, or separate sandbox boundary crossing.\nC:H - The flaw causes invalid or out-of-bounds reads from the skb MAC header, and those bytes can be copied into logs/ipset state or influence observable match behavior. Per the required guidance, out-of-bounds reads are scored High when not proven strictly harmless.\nI:L - The primitive is a read rather than an arbitrary write or control-flow hijack. However, the wrongly read MAC bytes can influence firewall matches and ipset add/delete/test behavior, giving limited integrity impact.\nA:H - Invalid eth_hdr(skb) access can produce slab out-of-bounds/KASAN reports or kernel oops/panic conditions, and packets can be sent repeatedly. Kernel crashes are High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53224","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - An unauthenticated remote SCTP peer can reach the vulnerable COOKIE_ECHO processing path by sending SCTP packets to a listening SCTP endpoint. In deployments with cookie HMAC disabled, the attacker can obtain and modify the state cookie over the network.\nAC:L - The bug is triggered with a malformed COOKIE_ECHO and attacker-controlled embedded INIT/address-list lengths; no race or hard-to-control timing condition is required. The no-cookie-auth deployment condition is a reasonable supported SCTP configuration.\nPR:N - No credentials or local privileges are needed to send SCTP INIT/COOKIE_ECHO traffic to a listening service. The vulnerable parsing occurs before any application authentication.\nUI:N - Exploitation only requires sending network packets to the target SCTP endpoint. No victim user action is required.\nS:U - The impact is within the kernel/network stack security authority of the target system. It does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The malformed lengths can drive out-of-bounds kernel reads beyond the COOKIE_ECHO payload, including attacker-controlled oversized address-list parsing. Because the read is not strictly bounded to a few bytes and related SCTP COOKIE_ECHO bugs demonstrate kernel memory leakage potential, confidentiality impact is High.\nI:N - The investigated fix addresses out-of-bounds reads and missing length validation, not an out-of-bounds write or direct arbitrary memory modification primitive. I did not find a defensible direct integrity impact from this bug alone.\nA:H - The attacker-controlled out-of-bounds reads can walk beyond the skb/cookie buffer and fault or trigger KASAN/oops conditions. A remotely triggerable kernel crash is High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53224","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53246","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable COOKIE_ECHO processing is reached by remote SCTP packets delivered through the IPv4/IPv6 SCTP protocol handlers to a listening SCTP endpoint.\nAC:L - In a deployment with SCTP cookie HMAC disabled, the attacker can obtain a cookie through the normal INIT/INIT_ACK exchange, modify the cached INIT length, and send the forged COOKIE_ECHO without races or conditions outside attacker control.\nPR:N - The path is pre-authentication network protocol handling for a listening SCTP server; no local account or SCTP authentication is required when cookie HMAC is disabled.\nUI:N - Exploitation only requires sending SCTP handshake packets to the target listener and does not require victim user action.\nS:U - The impact is within the Linux kernel/network stack security authority and does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The inflated cached INIT length drives out-of-bounds parameter walking and attacker-sized kmemdup() reads beyond the received skb, which can expose kernel memory.\nI:H - The bug is kernel memory-safety corruption during nested parameter handling, and the higher-severity choice is appropriate because attacker-controlled parsing and copies beyond the valid buffer can corrupt kernel association state and plausibly support stronger primitives.\nA:H - The out-of-bounds reads and large attacker-controlled copies can trigger kernel faults, KASAN splats, allocation failure paths, or repeated remote crashes of SCTP processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53246","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53250","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached by a local process using AF_XDP socket setup, UMEM registration, TX ring submission, and send/poll-driven transmit; it is not reachable directly from remote network packets.\nAC:L - The attacker controls the UMEM metadata and can trigger TX from the same process, so the TOCTOU race can be created with attacker-controlled concurrent writes.\nPR:L - AF_XDP socket creation requires CAP_NET_RAW in the relevant network namespace, which is attainable by a low-privileged local user in user/network namespace deployments.\nUI:N - No victim action is needed after the attacker has local execution; the attacker sets up the socket, UMEM, metadata, and transmit operation directly.\nS:U - The vulnerability corrupts or reads kernel networking memory within the same kernel security authority; this is standard local kernel attack surface, not a VM or hardware boundary crossing.\nC:H - Racing csum_start/csum_offset can bypass validation and drive out-of-bounds checksum reads in kernel transmit checksum handling, so potential kernel memory disclosure is high.\nI:H - The same unvalidated checksum offsets can cause checksum writes to an attacker-influenced out-of-bounds location relative to skb data, making kernel memory corruption plausible.\nA:H - The out-of-bounds memory access in the kernel transmit path can trigger warnings, faults, or kernel crashes and can be repeatedly exercised by the local attacker."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53250","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53262","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through a local `ioctl()` on a connected PPPoL2TP `AF_PPPOX` socket. Remote L2TP packets do not invoke `pppol2tp_ioctl()`.\nAC:L - The attacker controls both sides of the race by blocking `copy_from_user()` in the ioctl thread and closing the same socket concurrently. No external victim state is required.\nPR:L - A local unprivileged user can reach the PPPoL2TP socket/ioctl path; L2TP management also uses user-namespace admin permissions rather than requiring real init-namespace root. This is not remotely reachable without local code execution.\nUI:N - No victim action is required after the attacker runs local code. The attacker creates/connects the socket, issues the ioctl, and closes the socket.\nS:U - The impact is within the kernel security authority on the same system. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel heap use-after-free of `struct l2tp_session`, and the resumed ioctl can read from reclaimed/faked session and tunnel data before copying results to userspace. Per conservative kernel UAF scoring, this supports high confidentiality impact.\nI:H - Kernel UAFs with attacker-controlled timing and heap reuse can be leveraged beyond a simple stale read, including corruption or control-flow primitives. When uncertain, the higher severity option is appropriate.\nA:H - At minimum, dereferencing the stale session or tunnel pointer can trigger a kernel oops or panic. The attacker can repeatedly trigger the race locally."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53262","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53267","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached by installing crafted nftables/netfilter rules through NETLINK_NETFILTER and then triggering packet evaluation locally. Remote packets alone cannot install the rule, so this is a local attack vector.\nAC:L - A single crafted rule sequence such as `ct zone set` followed by `ct original saddr` can deterministically trigger the bug on matching packets. No race or external condition beyond the attacker's control is required.\nPR:L - Rule creation requires CAP_NET_ADMIN for the relevant network namespace via nfnetlink. Because nftables is reachable with CAP_NET_ADMIN in a user-created network namespace on systems permitting unprivileged user namespaces, this is low privileges rather than high.\nUI:N - After the attacker installs the crafted rule, triggering occurs through packet processing without any victim user action. No user needs to open a file, mount anything, or interact with attacker-controlled content.\nS:U - The bug corrupts kernel memory during kernel packet-filter evaluation and impacts the same kernel security authority. This is standard kernel privilege escalation/DoS behavior, not a VM, IOMMU, or distinct security-scope escape.\nC:H - The bug is a kernel stack out-of-bounds write past `struct nft_regs`, a memory corruption primitive. Under the required higher-severity rule, such memory corruption is defensibly treated as capable of enabling high confidentiality impact.\nI:H - The vulnerable 16-byte memcpy can overwrite beyond the validated destination register on the kernel stack. Out-of-bounds kernel writes are high integrity impact because they can plausibly be developed into control-flow or privilege-modification primitives.\nA:H - The stack overwrite can corrupt adjacent stack state or registers during packet evaluation and can crash or oops the kernel. Kernel crash or panic is high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53267","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53354","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable TLBI completion path is reachable by locally executing code that drives memory permission/unmap activity through syscalls or guest/KVM memory-management activity. It is not directly exposed by network packets.\nAC:L - Although the erratum depends on timing, the attacker can repeatedly arrange concurrent stores and translation invalidations on affected multicore Arm systems. The triggering race is therefore attacker-influenced rather than dependent on a one-off external condition.\nPR:L - A basic unprivileged local user or guest workload can reach the relevant Stage-1/Stage-2 TLBI paths without host administrative privileges. No real root capability in the init namespace is required.\nUI:N - After the attacker has local code execution, exploitation only requires attacker-driven memory operations/syscalls or guest activity. No separate victim action is needed.\nS:C - In a severe reasonable deployment such as Arm KVM/cloud virtualization, bypassing Stage-2 or higher-level translation protections can let guest-controlled writes affect hypervisor/host resources. That crosses a security authority boundary.\nC:H - The primitive can enable privilege escalation to kernel or hypervisor context, making protected memory and secrets accessible. Even though the erratum affects stores, successful control of privileged context supports high confidentiality impact.\nI:H - The core issue permits writes to memory after translation permissions or ownership should have been revoked. This is a high-integrity memory corruption primitive with plausible kernel or hypervisor privilege escalation.\nA:H - Incorrect late writes into protected or reused memory can corrupt kernel/hypervisor state. Failed exploitation or corruption can plausibly cause kernel panic, guest/host crash, or system instability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53354","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53375","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through the AMDGPU_CS DRM ioctl on a render node (/dev/dri/renderD*), requiring local access to submit crafted VCE indirect buffers to the GPU driver.\nAC:L - An attacker fully controls the VCE command stream and per-command length fields, and can reliably craft commands where exactly one relocation index is out of bounds (e.g., 0x0500000d with len=32) to trigger partial address patching.\nPR:L - Exploitation requires only unprivileged local access to the amdgpu DRM render node; AMDGPU_CS is gated by DRM_AUTH|DRM_RENDER_ALLOW, not root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the entire malicious command submission through the render node.\nS:C - Partial address patching causes VCE firmware to DMA using attacker-influenced GPU addresses outside the intended buffer object boundaries, crossing the GPU memory/DMA isolation boundary that the relocation logic is meant to enforce.\nC:H - VCE firmware performs DMA reads using the malformed 64-bit address, enabling arbitrary reads from GPU-accessible memory regions (including GTT-mapped system memory) beyond the validated buffer scope.\nI:H - VCE firmware performs DMA writes (encoded bitstreams, feedback, and context buffers) to attacker-influenced addresses, enabling arbitrary GPU-mapped memory corruption and potential privilege escalation primitives.\nA:H - Submitting commands with malformed firmware addresses can cause GPU page faults, driver hangs, GPU resets, or kernel oops/panic when the VCE engine accesses invalid memory regions."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53375","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53388","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local syscalls: mounting a FUSE filesystem, reading files to trigger readpages, and the FUSE daemon writing replies to /dev/fuse via splice_write with SPLICE_F_MOVE.\nAC:L - The race is between the attacker's own splice reply and a concurrent abort they trigger (e.g., via sysfs abort or unmount); the attacker controls both threads and can retry until the window is hit.\nPR:L - Exploitation requires mounting and operating a FUSE filesystem via /dev/fuse, which needs local user privileges; on typical systems this is reachable by unprivileged users via user namespaces (CAP_SYS_ADMIN in a user namespace) without init-namespace root.\nUI:N - No victim interaction is required; the attacker mounts the filesystem, runs the FUSE daemon, and triggers the concurrent abort themselves.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as guest-to-host or sandbox breakout.\nC:H - The vulnerability is a use-after-free of fuse_io_args and associated folio pointers in kernel heap memory, which can be leveraged for arbitrary kernel memory read via heap reuse.\nI:H - Use-after-free of fuse_io_args enables heap spraying and controlled reuse of freed kernel objects, providing a path to arbitrary kernel memory write or code execution.\nA:H - The UAF and the race with folio replacement can cause kernel oops/panic, including NULL pointer dereference when fuse_readpages_end accesses a folio with a NULL mapping."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53388","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53391","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The crash is triggered by processing a malicious GETDEVICEINFO RPC response from an NFS metadata server over the network, on the standard NFSv4 client path used by pNFS file and flexfile layouts.\nAC:L - Once a victim is a pNFS client, the attacker reliably triggers the bug by sending a GETDEVICEINFO body with a zero-length r_netid or r_addr opaque; no race or special memory layout is required.\nPR:N - The attacker acts as (or compromises) the remote NFS metadata server and needs no local privileges on the victim client; exploitation is delivered entirely through NFS protocol responses to an already-established mount.\nUI:N - In the highest-impact scenario—a compromised enterprise/HPC metadata server or autofs-managed pNFS mount—no further victim action is needed beyond normal file I/O that provokes GETDEVICEINFO.\nS:U - The vulnerability causes a kernel panic on the NFS client itself and does not cross a security boundary such as a VM escape or sandbox breakout.\nC:N - This is a NULL pointer dereference in strrchr() with no out-of-bounds read or use-after-free; it does not disclose kernel memory or attacker-controlled data.\nI:N - There is no memory corruption, arbitrary write, or control-flow hijack primitive—only an immediate NULL dereference that terminates kernel execution.\nA:H - The NULL pointer dereference in kernel context causes an oops or panic, fully denying availability of the affected client (and any co-hosted workloads until reboot)."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53391","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53402","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the KDFONTOP ioctl on a framebuffer-console virtual terminal (/dev/ttyN), which is a local syscall path with no network or physical-access vector.\nAC:L - An attacker who controls a session on an fbcon-backed VT can reliably trigger the bug by issuing a font-change ioctl with different dimensions and a 256↔512 glyph transition, then inducing vc_resize() failure through self-controlled memory pressure; no race or victim-dependent timing is required.\nPR:L - KDFONTOP font-set operations require only that the caller owns the controlling TTY (current->signal->tty == tty), which any unprivileged local user with a console or VT session has; CAP_SYS_TTY_CONFIG is not required on that path.\nUI:N - Exploitation requires only the attacker's own ioctl and memory-pressure actions on their TTY; no action by another user or administrator is needed.\nS:U - Impact is confined to kernel memory disclosure and potential kernel crash within the same kernel security authority; there is no VM escape, sandbox escape, or cross-security-boundary effect.\nC:H - The desynchronized hi_font_mask causes deterministic out-of-bounds reads from the kernel font glyph buffer during fbcon rendering (e.g., bit_cursor and rotated putcs paths), enabling disclosure of adjacent kernel memory.\nI:N - The flaw is an out-of-bounds read with console state desynchronization; it does not provide an arbitrary kernel write, code execution, or other data-modification primitive.\nA:H - Out-of-bounds reads from kernel font data can cause kernel page faults and oopses, consistent with the prior syzkaller-reported fbcon font/resize failure class that produced unhandled page faults."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53402","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63802","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local cgroup management (rmdir on cgroupfs) and concurrent block I/O to populate per-blkcg rstat lists; the vulnerable code is in the block cgroup teardown path, not in any network protocol handler.\nAC:L - The attacker controls both sides of the race by issuing I/O on multiple block devices to create multiple blkgs with pending stats, then concurrently destroying the cgroup to trigger parallel blkg_release() calls on multiple CPUs.\nPR:L - Triggering cgroup deletion and block I/O requires only delegated cgroup write access or namespace/container root (CAP_SYS_ADMIN in a user namespace), not init-namespace root; this is routinely available in containers, Kubernetes pods, and systemd user cgroup hierarchies.\nUI:N - No victim interaction is required; the attacker programmatically performs I/O and cgroup teardown from their own process or container.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it does not inherently cross a VM, container, or IOMMU boundary without a separate privilege-escalation step.\nC:H - The use-after-free dereferences freed blkg structures and associated iostat data during list iteration, enabling arbitrary kernel memory read primitives typical of slab UAF bugs.\nI:H - UAF on kmalloc-allocated blkg objects allows heap grooming and write through dangling pointers, which can be leveraged for arbitrary kernel memory modification or code execution.\nA:H - Concurrent use-after-free during blkg teardown can cause immediate kernel oops/panic from accessing freed memory, and repeated triggering enables reliable denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63802","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63806","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - A malicious KVM guest triggers this via guest-executed MMIO stores handled by the x86 instruction emulator (KVM_RUN → vmx_handle_exit → kvm_mmu_page_fault → x86_emulate_instruction → emulator_read_write → vcpu_mmio_write → ioeventfd_write), not via remote network input to the host.\nAC:L - The guest fully controls the spanning store address, size, and timing; with standard QEMU/virtio datamatch ioeventfd MMIO layouts, a page-boundary write reliably reaches ioeventfd_in_range() with a misaligned val pointer and fires the BUG_ON().\nPR:N - Exploitation requires only unprivileged code execution inside an already-running guest VM (reproducer ran as UID 1000); no host capabilities, KVM ioctls, or guest root are needed beyond what any cloud VM tenant or compromised guest process already has.\nUI:N - No victim interaction is required once the attacker can run code in a KVM guest with a datamatch ioeventfd configured, which is the default virtio/QEMU setup.\nS:C - The vulnerable component is the host kernel KVM subsystem, but exploitation is initiated from a guest VM and causes a host kernel BUG/oops, crossing the hypervisor security boundary.\nC:N - The failure mode is an explicit BUG_ON() alignment check before any datamatch comparison; there is no out-of-bounds read, use-after-free, or other memory corruption that could disclose host data.\nI:N - The bug triggers a deliberate kernel BUG and does not corrupt or modify host memory; it is a crash-only denial-of-service with no integrity impact.\nA:H - A guest-triggered BUG_ON() in ioeventfd_write() causes a host kernel oops/panic, denying availability of the entire physical host and all co-resident VMs on multi-tenant KVM hypervisors."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63807","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the KVM VM file descriptor ioctl path (KVM_SET_USER_MEMORY_REGION), which requires local syscall access to /dev/kvm rather than any network-facing protocol.\nAC:L - An attacker with KVM access can deterministically set up the required state (partial hugepage memslot, dirty logging enabled then disabled, guest hugepage mapping extending below slot bounds) and trigger the bug without depending on conditions outside their control.\nPR:L - Exploitation requires only local access to /dev/kvm and control of a VM (e.g., membership in the kvm group), as demonstrated by the reproducer running as UID 1000; it does not require host root in the init namespace.\nUI:N - No victim user interaction is required beyond the attacker issuing the KVM ioctl to disable dirty logging on a memslot they control.\nS:C - The vulnerable KVM x86 MMU code runs in the host kernel and a VM operator can corrupt or crash host kernel memory from their guest/VM management context, crossing the guest-to-host virtualization security boundary.\nC:H - The bug is an out-of-bounds kernel read of memslot lpage_info metadata via an invalid gfn index in kvm_mmu_max_mapping_level(), which per kernel guidance qualifies as high confidentiality impact even though it typically manifests as a page fault.\nI:H - Out-of-bounds access to kernel heap metadata in the KVM MMU subsystem can potentially be steered for memory corruption and control-flow influence; similar KVM shadow MMU memory safety bugs are scored at high integrity impact.\nA:H - The vulnerability reliably causes a host kernel oops/page fault (supervisor read to non-present vmalloc address) when triggered, constituting high availability impact via host kernel crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63807","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63824","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reachable only through the keyctl(2) syscall (KEYCTL_PKEY_ENCRYPT, KEYCTL_PKEY_DECRYPT, or KEYCTL_PKEY_SIGN); there is no network, adjacent, or physical attack path to the affected code.\nAC:L - An attacker fully controls the undersized out_len parameter and can reliably trigger the bug on demand with no races or victim-dependent state; CONFIG_ASYMMETRIC_KEY_TYPE is commonly enabled on server and desktop kernels.\nPR:L - Exploitation requires KEY_NEED_SEARCH on an asymmetric key, which any unprivileged local user can satisfy by loading their own RSA/EC key into a session keyring; no real root or init-namespace capabilities are needed.\nUI:N - Exploitation requires only attacker-initiated keyctl calls and does not depend on any victim user action such as opening a file or mounting a filesystem.\nS:U - Impact is confined to kernel heap memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - When out_len is smaller than the cryptographic output (including out_len=0 where kmalloc(0) yields ZERO_SIZE_PTR), asym_eds_op returns the full primitive output size and copy_to_user reads far beyond the allocated buffer, leaking adjacent kernel heap contents to userspace.\nI:H - The undersized kmalloc buffer is passed directly as the crypto output target; asymmetric operations can write up to the primitive maximum (hundreds of bytes for RSA-4096) past the allocation, enabling heap corruption and potential control-flow hijacking.\nA:H - Heap out-of-bounds read/write against kmalloc objects or writes through ZERO_SIZE_PTR can cause kernel oops, panic, or KASAN-detected corruption, satisfying high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63824","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63829","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires sending RTM_NEWLINK changelink requests over rtnetlink (netlink socket), matching the kernel guidance that tc/netlink configuration paths are Local.\nAC:L - Once a cross-namespace GRE/ERSPAN device is present in the caller's netns, triggering the bug is a single deterministic netlink changelink with no races or attacker-uncontrollable timing.\nPR:L - The rtnl entry path requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user can obtain inside a user namespace via unshare --user --map-root-user --net without real init-namespace root.\nUI:N - Exploitation is fully programmatic through netlink; no victim user action such as opening a file or mounting a filesystem is required.\nS:C - The changelink mutates tunnel state in t->net while authorization is checked only against dev_net(dev), crossing from the attacker's net/user namespace into another tenant's or the host's network namespace tunnel tables.\nC:H - An attacker can rewrite IFLA_GRE_REMOTE/LOCAL, keys, and related tunnel parameters to redirect GRE/ERSPAN traffic through attacker-controlled endpoints and read tunneled payloads.\nI:H - Unauthorized changelink updates live tunnel fields (including collect_md and encap parameters parsed before the missing check), enabling arbitrary redirection or injection of traffic in the victim link netns.\nA:H - Rewriting tunnel endpoints, keys, or metadata handling can break production GRE/ERSPAN overlays and VPN paths, causing sustained loss of connectivity for dependent services."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63829","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63884","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local DRM ioctls on the Intel GPU render node (notably I915_GEM_EXECBUFFER2 and I915_GEM_MADVISE); there is no network, adjacent-radio, or physical-access entry path.\nAC:L - An attacker controls the triggering workload (concurrent execbuffers, madvise DONTNEED, and GPU memory pressure to force eviction), and the UAF is a deterministic stale-pointer bug rather than a race against uncontrollable system state.\nPR:L - Exploitation requires only access to the DRM render node and standard unprivileged GEM ioctls (DRM_RENDER_ALLOW); no CAP_SYS_ADMIN, DRM master, or init-namespace root is needed.\nUI:N - No victim interaction is required beyond the attacker (or a compromised local GPU client) issuing its own ioctl submissions to the render node.\nS:U - Successful exploitation yields kernel memory corruption and local privilege escalation within the same kernel security authority; it does not constitute a VM escape or IOMMU/DMA boundary bypass.\nC:H - This is a kernel heap use-after-free on a freed i915_ttm_tt structure; attacker-controlled reuse of the freed object can provide arbitrary kernel memory read primitives.\nI:H - UAF on the i915_ttm_tt/filp path enables heap grooming and corrupting kernel objects, providing a standard path to arbitrary kernel write and code execution.\nA:H - The vulnerability was observed causing a kernel general protection fault/oops under real workloads, and UAF in this path can reliably crash or hang the system even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63884","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63893","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:A - A malicious Thunderbolt XDomain peer (adjacent host, dock, or in-line device on a direct Thunderbolt/USB4 link) delivers crafted PROPERTIES_RESPONSE data that the victim kernel parses during automatic XDomain discovery.\nAC:L - The peer fully controls property entry value/length fields and can reliably craft the u32 wrap (e.g. value=0xffffff00, length=0x100) without races or special memory layout.\nPR:N - Exploitation requires no privileges on the victim system; the attacker only needs to be the connected XDomain peer responding to the kernel-initiated property exchange, with no authentication on that control-plane path.\nUI:N - Once a Thunderbolt XDomain link exists, property fetching and parsing run automatically in the kernel handshake state machine without any additional victim user action at exploitation time.\nS:U - Impact is confined to the victim kernel/userspace boundary (kernel heap disclosure to local sysfs and possible kernel crash); it does not cross VM, IOMMU, or sandbox security boundaries.\nC:H - Integer-wrap bypass enables an out-of-bounds kernel memory read of up to entry->length dwords, which for deviceid/vendorid TEXT properties is copied into world-readable sysfs attributes, disclosing kernel heap contents.\nI:N - The bug is an out-of-bounds read via parse_dwdata(); destination buffers are properly sized kcalloc allocations, so there is no out-of-bounds write or integrity modification of victim kernel structures.\nA:H - Reading from block+0xffffff00 dwords (~4 GB past the allocation) will access unmapped kernel addresses, causing a kernel fault/oops/panic in addition to any information disclosure."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63893","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63912","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the ESP outbound encryption path reached when IPsec-protected traffic is sent through xfrm (e.g., from an internet-facing VPN/tunnel gateway encrypting responses or forwarded flows to a remote peer). A network peer can influence outbound skb fragment sizes to hit the vulnerable fast path without local shell access.\nAC:L - An attacker can reliably craft payload sizes so ALIGN(skb->data_len) and ALIGN(tailen) each pass the broken per-field PAGE_SIZE gate while their combined aligned length exceeds PAGE_SIZE, repeatedly probing until the out-of-place page-frag path is taken.\nPR:N - Exploitation does not require configuring xfrm or host admin rights; it only needs the target to already run ESP and the attacker to send traffic that is encrypted on output (e.g., as a remote VPN/site-to-site peer), which is network-layer access rather than local OS privilege.\nUI:N - Triggering the vulnerable ESP output path requires only attacker-controlled network traffic and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - The flaw is a heap out-of-bounds write during AEAD encryption over an undersized page frag; such memory corruption can expose adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - Writing past the allocated page-frag buffer corrupts adjacent heap memory and can be developed into arbitrary write or control-flow hijack primitives, matching kernel guidance for out-of-bounds writes.\nA:H - Corrupting kernel heap memory during crypto output can cause immediate kernel oops/panic or persistent instability, and repeated triggering can deny service on VPN gateways and other IPsec endpoints."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63912","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63917","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through rtnetlink configuration (RTM_NEWLINK changelink and RTM_SETLINK netns move via `ip link`), not through remote packet handling on the vti6 tunnel itself.\nAC:L - Exploitation is a deterministic, attacker-controlled sequence (create vti6, move netns, changelink, delete netns) with no races or external victim state required.\nPR:L - The fix commit and rtnetlink path confirm reachability with CAP_NET_ADMIN inside an unprivileged user+network namespace (`unshare --user --map-root-user --net`), not init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug entirely through their own netlink operations.\nS:C - On container hosts, an unprivileged tenant can corrupt namespace teardown and panic the host kernel, impacting resources outside the attacker's security scope (other tenants and the host).\nC:H - The stale per-netns hash leaves `cleanup_net()`/`vti6_exit_rtnl_net()` walking freed `ip6_tnl` list nodes, constituting a use-after-free with arbitrary kernel memory read potential.\nI:H - Cross-netns hash corruption can leave dangling pointers and drive `unregister_netdevice_queue()` on already-freed devices (kernel BUG at net/core/dev.c:12376), enabling memory corruption exploitable for control-flow hijacking.\nA:H - The published reproducer reliably triggers a kernel BUG during namespace cleanup, causing host-wide denial of service via kernel panic/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63917","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63919","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable path is reached when IPsec ESP/AH packets are received and processed through xfrm_input transport-mode reinjection, which is a network packet receive path in net/xfrm. Remote peers can send ESP traffic to trigger deferred queueing on systems with IPsec configured.\nAC:L - The attacker controls both sides of the race by flooding IPsec packets to queue deferred reinjection work while concurrently destroying the network namespace, making the UAF reliably triggerable without conditions outside attacker control.\nPR:L - Exploitation requires configuring xfrm/IPsec and managing network namespace lifecycle, both reachable with CAP_NET_ADMIN obtainable by an unprivileged user via user namespaces (unshare -Urn), not requiring real root in the init namespace.\nUI:N - No victim user interaction is required; exploitation is achieved through automated packet transmission and namespace teardown scripted by the attacker.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The deferred callback dereferences a freed struct net (e.g., ip6_rcv_finish_core reads sysctl fields from the UAF pointer), providing an information disclosure primitive from attacker-influenced freed slab memory.\nI:H - Use-after-free on the large struct net slab object enables heap grooming and memory corruption exploitable for arbitrary kernel writes and control-flow hijacking, not merely a bounded modification.\nA:H - Dereferencing a freed network namespace structure causes kernel oops/panic from the workqueue callback path, and UAF reliably threatens system availability even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63919","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63921","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl(SIOCCHGTUNNEL) on a migrated vti6 netdev via socket/dev_ioctl; the bug is in vti6_siocdevprivate(), not in remote packet reception.\nAC:L - The attacker fully controls namespace creation, tunnel migration (IFLA_NET_NS_FD), and ioctl parameters to collide with a victim tunnel; the commit documents a deterministic, reproducible sequence with no uncontrollable race.\nPR:L - Only CAP_NET_ADMIN in the migrated (attacker) network namespace is required, obtainable via unprivileged user namespaces (unshare --user --map-root-user --net); the missing check against the creation namespace's user_ns is the core flaw.\nUI:N - No victim interaction is needed; the attacker performs all setup steps (create/migrate tunnel, issue SIOCCHGTUNNEL) autonomously.\nS:C - The attack hijacks IPsec/XFRM traffic destined for tunnels in a different tenant's network namespace on container hosts, crossing container/tenant security boundaries rather than staying within the attacker's own scope.\nC:H - After hash poisoning, xfrm receive delivers matched/decapsulated packets to the attacker-controlled netdev, enabling interception of victim VPN/IPsec traffic including potentially sensitive plaintext after decryption.\nI:H - The attacker gains control over which netdev receives victim tunnel traffic and can read, drop, or forward/modify decapsulated packets, constituting unauthorized manipulation of another tenant's network data path.\nA:H - Hijacking the creation-namespace hash bucket causes the legitimate victim tunnel to stop receiving matched traffic, producing denial of service to the victim's IPsec connectivity."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63921","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63922","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached on the standard IPv6 input path (ipv6_rcv → ip6_input → ip6_protocol_deliver_rcu → ipv6_destopt_rcv) when a remotely sent IPv6 packet carries a Destination Options header processed by ip6_parse_tlv().\nAC:L - The attacker fully controls the crafted IPv6 Destination Options layout (HAO TLV followed by trailing TLVs/padding); once CONFIG_IPV6_MIP6 and matching XFRM state exist on the target, triggering the stale-pointer condition is a reliable single-packet attack without races or victim-specific timing.\nPR:N - No local privileges or authentication are required; any remote host that can deliver IPv6 traffic to a listening interface can reach this pre-authentication receive-path parser (destopt_protocol uses INET6_PROTO_NOPOLICY).\nUI:N - Exploitation requires only sending a malicious IPv6 packet; no victim interaction such as opening files, clicking links, or mounting filesystems is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the kernel’s security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - After pskb_expand_head() frees the old skb head, ip6_parse_tlv() continues parsing trailing TLVs through the stale nh pointer, causing out-of-bounds/use-after-free reads of kernel heap memory that can disclose sensitive kernel data.\nI:H - Use-after-free of the skb head buffer during TLV parsing is heap memory corruption that can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a bounded parse error.\nA:H - Reading through the stale network-header pointer into freed or invalid memory can cause kernel oops/panic or unrecoverable instability, satisfying high availability impact even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63922","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63924","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPv6 input path (ipv6_rcv → ip6_rcv_core → ipv6_parse_hopopts) triggered by a crafted IPv6 packet with hop-by-hop options containing a Jumbo Payload TLV, reachable from any remote peer that can deliver IPv6 to the host.\nAC:L - An attacker fully controls the crafted IPv6 packet (HBH layout, jumbo length, trailing TLVs) and can send it repeatedly; once the skb is cloned/shared during receive and pskb_trim_rcsum reallocates the head, the stale-pointer UAF is deterministically triggered without races or victim-specific state.\nPR:N - No authentication or local privileges are required; any unauthenticated remote host that can send IPv6 traffic to a listening interface reaches the vulnerable receive handler with no capability or namespace checks along the path.\nUI:N - Exploitation requires only delivery of a malicious IPv6 packet and does not depend on any victim user action such as opening files, clicking links, or mounting filesystems.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary by itself.\nC:H - Continued HBH TLV parsing through the stale nh pointer is a use-after-free read of freed skb head memory, which per kernel guidance enables arbitrary kernel memory disclosure when the freed slab is reused.\nI:H - Stale-pointer UAF during TLV length/type parsing can yield unbounded out-of-bounds reads and corrupt subsequent parsing state, providing memory corruption primitives that can be developed into arbitrary kernel writes or code execution.\nA:H - Dereferencing the freed network-header pointer during TLV parsing can cause immediate kernel oops/panic from invalid memory access, and UAF-triggered parsing errors reliably drop or crash the receive path."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63924","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63946","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when the kernel processes inbound Bluetooth LE ISO data (HCI_ISODATA_PKT) from a remote peer over the radio; per kernel guidance Bluetooth is Adjacent, not Network.\nAC:L - An attacker can reliably win the race by flooding ISO frames while concurrently closing the ISO socket (or inducing disconnect that triggers stack teardown), controlling both the receive path and the iso_sock_kill() teardown path.\nPR:N - Exploitation requires only an established ISO connection with a malicious adjacent Bluetooth device; the vulnerable receive path needs no local privileges, and socket teardown can occur automatically when the remote peer disconnects.\nUI:N - No victim interaction is required during exploitation; ISO socket closure on disconnect is handled automatically by the Bluetooth stack and userspace daemons without user action.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The use-after-free dereferences freed struct sock memory (sk->sk_state) after iso_sock_kill() can sock_put() the socket, enabling arbitrary kernel memory read primitives via heap reuse.\nI:H - The UAF continues into sock_queue_rcv_skb() on the freed socket, corrupting socket receive-queue state and enabling heap-based write/control-flow hijack primitives typical of kernel UAF bugs.\nA:H - Use-after-free on struct sock during receive processing can cause kernel oops/panic from invalid memory access, and UAF bugs in the kernel are rated High availability impact even when not fully weaponized."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63946","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63952","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (memfd_create, mmap, fcntl) with no network-facing code path; the vulnerable logic is reached only through the local fcntl(F_ADD_SEALS) interface on a memfd file descriptor.\nAC:L - The attack is a reliable, deterministic syscall sequence (create executable memfd, establish a writable MAP_SHARED mapping, then apply F_SEAL_EXEC) with no race or attacker-uncontrollable conditions.\nPR:L - Any unprivileged local user can invoke memfd_create, mmap, and fcntl without capabilities; these interfaces are available inside unprivileged user namespaces with no real-root requirement.\nUI:N - Exploitation does not require a human victim action; in the highest-impact scenario a sandboxed process programmatically passes the sealed-appearing memfd to a trusting peer via IPC (e.g., SCM_RIGHTS) without user interaction.\nS:C - The bug breaks the memfd seal security contract designed for mutually untrusted parties, allowing a malicious local peer to deceive a separate process that relies on F_SEAL_WRITE immutability, crossing the inter-process trust boundary (sandbox/W^X enforcement).\nC:H - Bypassing write-seal/W^X guarantees enables arbitrary modification of executable memfd contents presented as immutable, which can be leveraged for arbitrary code execution in a trusting victim process and thereby full read of that process's memory.\nI:H - The vulnerability allows arbitrary modification of memory that is advertised as write-sealed (F_SEAL_WRITE), defeating the kernel's immutability guarantee and enabling W^X bypass and code injection into trusted execution contexts.\nA:N - The flaw is a logic error in seal enforcement that does not cause kernel crashes, panics, hangs, or denial of service; exploitation maintains availability while subverting integrity guarantees."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63952","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63968","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable function is reached from the IPv6 packet receive path (ipv6_rcv → ip6_route_input → ip6_pol_route → fib6_select_path) in softirq context, and production lockups were observed during processing of incoming IPv6 traffic on internet-facing edge routers.\nAC:L - The race is reliably triggerable when an attacker influences both packet flow and route churn (e.g., user-namespace ECMP setup plus traffic, or remote traffic coinciding with BGP nexthop updates); a dedicated selftest reproduces soft lockups in under a minute under controlled conditions.\nPR:N - Triggering fib6_select_path() during packet processing requires only the ability to send IPv6 traffic to destinations using multipath routes; concurrent route-table updates can occur from infrastructure (BGP/dynamic routing) without the attacker holding any local privileges.\nUI:N - Exploitation requires no victim interaction beyond normal network traffic delivery to a host or router processing IPv6 packets.\nS:U - The impact is kernel CPU soft lockup and watchdog panic within the same kernel security boundary; there is no sandbox, VM, or IOMMU boundary crossing.\nC:N - The bug is an infinite loop over stale sibling-list pointers during RCU read-side traversal; it does not read or disclose attacker-controlled memory or kernel secrets.\nI:N - No data modification or memory corruption occurs; the failure mode is CPU hang from unbounded list iteration, not arbitrary write or code execution.\nA:H - The infinite loop in softirq context causes CPU soft lockup, and documented production and test cases show this leads to watchdog-triggered kernel panic, a complete loss of system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63968","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63971","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls on an SCTP socket (`sendmsg`/`sendto` to trigger `sctp_wait_for_connect`, and `getsockopt(SCTP_SOCKOPT_PEELOFF)` to peel off the association). A remote peer can only help complete the SCTP handshake; it cannot invoke peeloff or the racing send path.\nAC:L - The attacker controls both sides of the race by running concurrent threads on the same SCTP one-to-many socket, timing peeloff during the window where `sctp_wait_for_connect()` has released the socket lock. Required options (`SCTP_FRAGMENT_INTERLEAVE`, `SCTP_INTERLEAVING_SUPPORTED`, and `net.sctp.intl_enable`) are attacker-settable in a user/net namespace.\nPR:L - No real-root capability is required; an unprivileged user can create SCTP sockets and drive the full race from a user namespace (`unshare -Urn`), including enabling `net.sctp.intl_enable` and the interleaving socket options needed to reach the vulnerable `sctp_sendmsg_to_asoc()` path.\nUI:N - Exploitation is fully attacker-driven through coordinated local threads and does not require any action from a victim user or administrator beyond normal SCTP socket use.\nS:U - Impact is confined to kernel memory integrity/availability within the same security authority; successful exploitation would be local privilege escalation, not a cross-boundary escape such as VM or container breakout by itself.\nC:H - After peeloff migrates `asoc->base.sk`, the caller continues in `sctp_datamsg_from_user()` while holding the wrong socket lock, creating unsynchronized concurrent access to association/stream state that can corrupt kernel heap metadata and be leveraged for arbitrary kernel memory disclosure.\nI:H - The post-race path builds and queues DATA/I-DATA chunks via `sctp_datamsg_from_user()` and `sctp_primitive_SEND()` without the correct socket lock, enabling concurrent modification of association output queues and stream structures that can be turned into arbitrary kernel writes or control-flow hijacking.\nA:H - Concurrent unsynchronized access to a live SCTP association after peeloff can cause kernel oops/panic or wedged associations, and the underlying race is a classic kernel concurrency defect with high availability impact even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63971","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63975","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when a remote Bluetooth LE peer sends a crafted L2CAP_ECRED_CONN_RSP on the LE signaling channel, processed via hci_recv_frame → l2cap_recv_acldata → l2cap_le_sig_channel → l2cap_ecred_conn_rsp. Bluetooth is Adjacent per kernel CVSS guidance.\nAC:L - An adjacent attacker who establishes a BLE ACL link can reliably trigger this by first creating an L2CAP channel with a chosen DCID (via ECRED_CONN_REQ SCIDs) and then sending a connection response reusing that DCID for a pending outgoing ECRED connection; no race or rare layout is required.\nPR:N - Exploitation requires only the ability to act as a remote Bluetooth peer on an established ACL connection; no local shell access, capabilities, or root on the victim system is needed.\nUI:N - The malicious signaling traffic is delivered entirely by the remote attacker once a BLE link exists; no additional victim-side file open, mount, or application action beyond normal Bluetooth connectivity is required to reach the vulnerable handler.\nS:U - The failure is a kernel L2CAP channel-list use-after-free and crash within the Bluetooth stack on the victim host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Calling l2cap_chan_del() on the original channel during list_for_each_entry_safe can free the saved tmp list node, causing a use-after-free on struct l2cap_chan when iteration continues; UAF is scored as High confidentiality impact.\nI:H - The same iterator invalidation frees and later dereferences l2cap_chan objects under attacker-influenced connection state, providing a heap UAF primitive that can be groomed toward arbitrary memory corruption and code execution.\nA:H - The bug reliably produces kernel list corruption and use-after-free in softirq/context Bluetooth receive path, leading to kernel oops or panic and denial of service on phones, laptops, and embedded devices with Bluetooth enabled."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63975","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63984","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code runs in the IPv6 routing-header receive handler on incoming packets; a remote attacker can deliver a crafted RFC 6554 type-3 RPL SRH to an RPL-enabled router or gateway over the network.\nAC:L - Triggering requires only a deterministically crafted SRH (e.g., n=127, CmprI=15, CmprE=15, pad=0, hdrlen=16, segments_left>0); all of these fields are fully attacker-controlled once the target has rpl_seg_enabled.\nPR:N - No authentication or local privileges are needed to send the malicious IPv6 packet; rpl_seg_enabled is a victim-side deployment setting on RPL routers/gateways (IoT/industrial mesh), not an attacker privilege requirement.\nUI:N - Exploitation is achieved solely by sending a malformed network packet and does not require any action from a victim user.\nS:U - Impact is confined to kernel memory corruption and packet forwarding within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The hdrlen truncation causes overlapping read/write of the same kmalloc buffer during decompress/recompress, constituting kernel heap memory corruption that can be leveraged for information disclosure primitives.\nI:H - ipv6_rpl_srh_compress() performs out-of-bounds writes into the overlapping decompressed region, corrupting routing-header data that is then memcpy'd into the forwarded skb, enabling memory corruption exploitable for control-flow or data modification.\nA:H - Kernel heap corruption during SRH processing can cause kernel oops, panics, or repeated crashes when processing or forwarding the corrupted packet, consistent with high availability impact for memory-corruption bugs."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63984","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63994","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when remotely injected VXLAN/GENEVE UDP packets traverse a bridged/OVS overlay and fail PMTU checks during encapsulation transmit, the same network path previously demonstrated in CVE-2023-53600 via vxlan_xmit through bridge forwarding.\nAC:L - An attacker can reliably send oversized DF-marked inner IP packets over the overlay to force PMTU ICMP generation, and can influence skb_cow() reallocation through bridge flooding/multicast cloning or headroom pressure; no uncontrollable victim state is required.\nPR:N - Exploitation requires no privileges on the victim host; any remote entity that can send VXLAN/GENEVE traffic to a VTEP with a bridged tunnel interface (standard cloud/SDN deployment) can reach the vulnerable code without authentication.\nUI:N - Triggering is fully automatic during kernel packet forwarding and tunnel encapsulation; no victim user action is needed beyond normal network operation of an overlay endpoint.\nS:U - Impact is confined to kernel memory on the affected host (UAF read/crash/potential escalation); it does not inherently cross VM, container, or IOMMU security boundaries.\nC:H - Stale ip_hdr/ipv6_hdr pointers cause reads from freed slab memory; leaked values are incorporated into ICMP error IP headers that are sent back to the attacker, constituting arbitrary kernel heap content disclosure.\nI:H - Use-after-free on skb header memory is a heap corruption primitive that can be developed into controlled writes or code execution via heap grooming, consistent with kernel UAF severity guidance.\nA:H - Dereferencing freed skb head memory during ICMP construction can cause kernel oops/panic and denial of service, as with other confirmed bugs in this same code path."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63994","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64106","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through the KVM device ioctl path (KVM_SET_DEVICE_ATTR with KVM_DEV_ARM_ITS_RESTORE_TABLES), which requires a local process with access to a VM file descriptor; it is not triggered by network packets or guest MMIO/ITS commands.\nAC:L - An attacker can reliably plant a crafted Device Table Entry in guest RAM (Size field encoding 17–32 EventID bits) and have it processed during migration/snapshot restore; no race or attacker-uncontrollable memory layout is required, and the live MAPD path already proves the invalid state is straightforward to supply.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant who needs no host privileges: they write a malformed DTE directly into guest physical memory (bypassing MAPD validation) and trigger host-side restore during automated live migration or snapshot resume, without requiring /dev/kvm or root on the host.\nUI:N - Exploitation does not require victim interaction beyond normal hypervisor operations such as automated live migration or snapshot restore that the attacker can initiate as a VM tenant; no end-user action like opening a file is needed.\nS:C - The vulnerability crosses the VM security boundary because guest-controlled saved state causes the host kernel to perform an oversized ITS table scan and mass kernel allocations, impacting host availability outside the guest's security scope.\nC:H - The unchecked num_eventid_bits value inflates scan_its_table()'s range up to BIT_ULL(32)*8 bytes (and can wrap the int size parameter for values 28–31), causing the host kernel to read far beyond the valid ITT bounds through kvm_read_guest_lock across a large guest GPA span.\nI:N - The flaw causes excessive guest-memory reads and kernel object allocation but does not corrupt or write host kernel memory; there is no demonstrated arbitrary host write, use-after-free, or code-execution primitive from this bug alone.\nA:H - The oversized scan can loop for an enormous number of kvm_read_guest_lock iterations (worse when the truncated int size wraps to a huge unsigned length), and valid-looking restored ITEs can drive unbounded vgic_add_lpi/kzalloc allocations, exhausting host CPU and memory and causing severe denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64106","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64189","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable dump and resize paths are reached through local NETLINK_NETFILTER send and receive syscalls, not through remotely received packets.\nAC:L - The attacker controls both sides by issuing an ipset dump and concurrent CREATE requests that grow ip_set_list, and can repeat the race without any victim-controlled condition.\nPR:L - NFNETLINK requires CAP_NET_ADMIN in the network namespace's owning user namespace, which an unprivileged user can obtain through user and network namespaces on deployments permitting unprivileged user namespaces.\nUI:N - After obtaining local execution, the attacker can trigger both racing operations without any action by another user.\nS:U - Exploitation compromises the kernel of the same host and constitutes standard local privilege escalation rather than crossing a VM, hypervisor, or IOMMU boundary.\nC:H - Reclaiming the freed array can make the loaded struct ip_set pointer attacker-influenced, after which variant-pointer dereferences can enable kernel code execution and arbitrary memory disclosure.\nI:H - The release path performs an indirect uref callback and decrements ref_netlink through the stale pointer, providing control-flow and kernel-memory-write opportunities after heap reclamation.\nA:H - The reported use-after-free produced a general-protection fault and kernel panic, and an attacker can trigger the race repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64189","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64530","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On a transparent bridge or traffic-shaping gateway configured with the RED qevent and act_ct, unauthenticated remote IP fragments reach red_enqueue() through normal receive, bridge-forwarding, and egress-qdisc processing. No local netlink access is required to trigger the deployed configuration.\nAC:L - The attacker controls fragment contents and ordering and can drive RED into deterministic hard-mark or drop conditions with sustained traffic. No race or condition outside the attacker's control must be won.\nPR:N - CAP_NET_ADMIN is required to create the vulnerable configuration, but a remote attacker sending fragments through an already configured appliance needs no privileges or authentication. Local triggering is also possible with namespaced CAP_NET_ADMIN.\nUI:N - Triggering requires only attacker-generated fragmented traffic and does not depend on a victim performing any action.\nS:U - The corruption occurs within the host kernel and compromises resources governed by that same security authority. This remains unchanged scope even when used for namespace escape or kernel privilege escalation.\nC:H - The reclaimable sk_buff use-after-free and corrupted defragmentation-tree links can be leveraged through attacker-controlled network heap spraying to disclose arbitrary kernel memory.\nI:H - RED overwrites linkage fields that overlap the defragmentation RB node and may free the object while it remains referenced, enabling subsequent writes through freed or attacker-reclaimed kernel objects and potential code execution.\nA:H - The dangling fragment-tree entry can cause immediate or deferred use-after-free, double-free, invalid tree operations, and kernel panic when another fragment arrives or the queue expires. The attacker can trigger this repeatedly with fragmented traffic."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64530","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64560","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached purely through local syscalls (`timer_create`/`timer_settime`/`timer_delete`/`clock_nanosleep`) raced against `execve()` from a non-leader thread in the attacker's own process. No network or remote data path reaches posix-cpu-timers.\nAC:L - The attacker controls both sides of the race — one thread arms and deletes a process-wide CPU timer while a non-leader thread in the same process calls `execve()` — and can loop indefinitely with CPU pinning/thread spraying to widen the window between `pid_task()` and `lock_task_sighand()`. No condition depends on anything outside attacker control.\nPR:L - Any ordinary unprivileged local user can create and delete `CLOCK_PROCESS_CPUTIME_ID` timers; `pid_for_clock()` performs no capability check when the encoded PID is 0, and `CONFIG_POSIX_TIMERS` is `default y` on essentially all deployments.\nUI:N - The attacker performs every step — timer creation, arming, deletion, and the concurrent non-leader exec — entirely within its own multithreaded process. No victim action is involved.\nS:U - The corruption stays within the kernel's own security authority; it is a standard local kernel memory-corruption/privilege-escalation primitive with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The stale timerqueue node yields UAF reads of the freed `k_itimer` and causes `current` (a live `task_struct` pointer) plus rbtree pointers to be written into the freed/reallocated slot, and the freed object can be reclaimed by another attacker-created `k_itimer`, enabling kernel pointer disclosure and broad memory read.\nI:H - `collect_timerqueue()` writes into freed memory (`ctmr->firing`, `ctmr->handling`, rbtree rebalancing, list insertion) and the `do_cpu_nanosleep()` variant does so into a live, attacker-groomed kernel stack frame, followed by `cpu_timer_fire()` dereferencing attacker-controlled `it_process`/`it_signal` — a control-flow-hijack-capable write primitive.\nA:H - Even without exploitation the dangling timerqueue node produces rbtree/list corruption and a kernel oops, and the pre-fix `WARN_ON_ONCE(timerqueue_node_queued(...))` is an immediate panic under `panic_on_warn`; the race can be triggered repeatedly by any local user."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64560","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64561","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable shadow-MMU page-fault path is reached via local KVM_RUN handling of guest EPT/shadow faults (and nested EPT via paging_tmpl), not by network or adjacent-radio packets.\nAC:L - An attacker who can run nested or shadow-MMU guests controls MMU pressure (heavy nested mappings and/or KVM_SET_NR_MMU_PAGES) and concurrent faults so reclaim zaps an in-use root during make_mmu_pages_available; no attacker-uncontrollable condition is required.\nPR:L - Exploitation needs /dev/kvm access or a nested-capable guest on the host, privileges commonly available to kvm-group users or cloud tenants, not real init-namespace root or CAP_SYS_ADMIN on the create/run path.\nUI:N - Once the attacker can run the guest, they trigger reclaim and page faults entirely through their own vCPU activity with no action by another user.\nS:C - Guest-controlled faults corrupt host KVM MMU state (invalid shadow pages on active_mmu_pages and subsequent list handling), crossing the guest-to-host virtualization boundary into the host kernel authority.\nC:H - Invalid children on active_mmu_pages break zap accounting assumptions so later prepare_zap list_add on still-linked entries corrupts kernel lists, a memory-corruption primitive that can be leveraged for arbitrary host reads.\nI:H - The same active-list invariant break and linked-list corruption in host MMU teardown/reclaim paths yield writable host corruption suitable for control-flow or structure hijacking, not merely a benign accounting glitch.\nA:H - WARN_ON_ONCE skips, infinite zap loops, list corruption, and host oops/hangs are reachable when invalid shadow pages remain on active_mmu_pages, causing host and co-located VM denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64561","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64564","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in SCTP ASCONF receive processing (sctp_rcv → sctp_sf_do_asconf → sctp_process_asconf → sctp_process_asconf_param); a remote peer triggers it by sending a crafted ASCONF over IP/IPv6 on an established association, matching kernel guidance that net/ stack bugs reachable via received packets are Network.\nAC:L - A single attacker-controlled ASCONF with [Address Parameter L][DEL-IP L][DEL-IP 0.0.0.0] reliably frees asconf->transport then reuses it in the same softirq; the peer fully controls multi-homing, serial, and parameter order, with no race or other condition outside attacker influence.\nPR:N - Any remote SCTP peer that completes a normal association with ADD-IP negotiated can send the ASCONF; SCTP-AUTH keys come from the handshake the peer itself performs (or addip_noauth), and no local credentials or capabilities on the target are required.\nUI:N - Exploitation requires only attacker-sent SCTP packets processed automatically in the receive/state-machine path; no victim user action such as opening a file or mounting a device is needed.\nS:U - Impact is confined to the vulnerable host kernel (sctp_transport UAF / crash or privilege escalation) and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - This is a heap use-after-free of an sctp_transport planted into primary_path/active_path after RCU-deferred free; freed-object reuse yields arbitrary kernel read primitives, scored High per UAF guidance.\nI:H - The same transport UAF enables heap spraying and write/control-flow hijacking via later dereferences of the dangling primary_path/active_path, so integrity impact is High.\nA:H - set_primary() immediately dereferences the freed transport and leaves the association with transport_count 0 and dangling path pointers, causing a reproducible kernel oops/panic on subsequent use, which is High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64564","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64600","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation uses local FICLONE and concurrent O_DIRECT write syscalls against an XFS filesystem.\nAC:L - The attacker controls both racing writers, can amplify the transaction-allocation window, and demonstrated exploitation typically succeeds within seconds.\nPR:L - A basic unprivileged local user needs only read access to the protected source and write access to a scratch file; no capabilities are required.\nUI:N - The attacker creates the reflink and triggers both sides of the race without any victim action.\nS:U - This is a standard local kernel-mediated privilege escalation affecting resources within the host operating system's existing security authority.\nC:H - Overwriting /etc/passwd or a readable SUID-root binary yields full root access and consequently unrestricted access to system-confidential data.\nI:H - The stale physical mapping provides attacker-controlled persistent writes into protected readable files while preserving their ownership and SUID metadata, enabling full root compromise.\nA:H - The attacker can persistently corrupt boot-critical binaries or configuration files and, after obtaining root, cause complete system unavailability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64600","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A3602-1","advisory_id":"130b8b86-0b9f-4b76-b8c0-96bf6997a30c","event_types":["advisory"],"published_at":"2026-10-25T22:45:52.959384+00:00","technologies":["core-osv","kernel-64kb","kernel-default","kernel-default-base","kernel-docs","kernel-livepatch-sle15-sp6-update-30","kernel-obs-build","kernel-source","kernel-syms","kernel-zfcpdump"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T15:40:54+00:00","detail_url":"/events/71340"},"members":[{"id":71340,"cve_ids":["CVE-2026-31482","CVE-2026-31483","CVE-2026-31542","CVE-2026-31598","CVE-2026-31628","CVE-2026-43033","CVE-2026-43046","CVE-2026-43056","CVE-2026-43276","CVE-2026-43440","CVE-2026-43475","CVE-2026-45904","CVE-2026-46056","CVE-2026-46080","CVE-2026-46084","CVE-2026-46109","CVE-2026-46117","CVE-2026-46126","CVE-2026-46144","CVE-2026-46145","CVE-2026-46174","CVE-2026-46193","CVE-2026-46243","CVE-2026-46323","CVE-2026-46324","CVE-2026-46333","CVE-2026-52967","CVE-2026-52986","CVE-2026-53050","CVE-2026-53129","CVE-2026-53131","CVE-2026-53177","CVE-2026-53224","CVE-2026-53246","CVE-2026-53250","CVE-2026-53262","CVE-2026-53267","CVE-2026-53297","CVE-2026-53324","CVE-2026-53354","CVE-2026-53375","CVE-2026-53388","CVE-2026-53391","CVE-2026-53402","CVE-2026-63794","CVE-2026-63802","CVE-2026-63806","CVE-2026-63807","CVE-2026-63824","CVE-2026-63826","CVE-2026-63829","CVE-2026-63884","CVE-2026-63893","CVE-2026-63912","CVE-2026-63917","CVE-2026-63919","CVE-2026-63921","CVE-2026-63922","CVE-2026-63924","CVE-2026-63946","CVE-2026-63952","CVE-2026-63968","CVE-2026-63971","CVE-2026-63975","CVE-2026-63984","CVE-2026-63994","CVE-2026-64106","CVE-2026-64189","CVE-2026-64530","CVE-2026-64560","CVE-2026-64561","CVE-2026-64564","CVE-2026-64600"],"payload":{"kind":"advisory","title":"Security update for the Linux Kernel","summary":"The SUSE Linux Enterprise 15 SP6 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2026-46056: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (bsc#1267435). - CVE-2026-46193: xfrm: ah: account for ESN high bits in async callbacks (bsc#1267656). - CVE-2026-46324: netfilter: nf_tables: Introduce functions freeing nft_hook objects (bsc#1267995). - CVE-2026-52967: smb/client: fix possible infinite loop and oob read in symlink_data() (bsc#1269181). - CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul (bsc#1269289). - CVE-2026-53050: quota: Fix race of dquot_scan_active() with quota deactivation (bsc#1269188). - CVE-2026-53129: fs/mbcache: cancel shrink work before destroying the cache (bsc#1269633). - CVE-2026-53131: netfilter: require Ethernet MAC header before using eth_hdr() (bsc#1269773). - CVE-2026-53224: sctp: validate embedded INIT chunk and address list lengths in cookie (bsc#1269997). - CVE-2026-53246: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (bsc#1269988). - CVE-2026-53250: xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (bsc#1269808). - CVE-2026-53262: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() (bsc#1270000). - CVE-2026-53267: netfilter: nft_ct: bail out on template ct in get eval (bsc#1269577). - CVE-2026-53354: arm64: errata: Mitigate TLBI errata on various Arm CPUs (bsc#1270230). - CVE-2026-53375: drm/amdgpu/vce: ","evidence":"osv:SUSE-SU-2026:3602-1","products":[{"name":{"value":"kernel-default","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-livepatch-SLE15-SP6_Update_30","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1-150600.13.5.1","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-64kb","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1.150600.12.60.3","evidence":"/affected/5/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/6/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/7/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/7/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/8/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/8/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/9/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/9/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-zfcpdump","evidence":"/affected/10/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/10/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default","evidence":"/affected/11/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/11/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-default-base","evidence":"/affected/12/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1.150600.12.60.3","evidence":"/affected/12/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-docs","evidence":"/affected/13/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/13/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-obs-build","evidence":"/affected/14/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/14/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-source","evidence":"/affected/15/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/15/ranges"}],"affected_versions":[]},{"name":{"value":"kernel-syms","evidence":"/affected/16/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.4.0-150600.23.130.1","evidence":"/affected/16/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:3602-1","aliases":["SUSE-SU-2026:3602-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.130.1","kernel-default-livepatch-devel":"6.4.0-150600.23.130.1","kernel-livepatch-6_4_0-150600_23_130-default":"1-150600.13.5.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150600.13.5.1"}]}],"package":{"name":"kernel-livepatch-SLE15-SP6_Update_30","purl":"pkg:rpm/suse/kernel-livepatch-SLE15-SP6_Update_30&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-default-livepatch":"6.4.0-150600.23.130.1","kernel-default-livepatch-devel":"6.4.0-150600.23.130.1","kernel-livepatch-6_4_0-150600_23_130-default":"1-150600.13.5.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP6","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-64kb","purl":"pkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1.150600.12.60.3"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-zfcpdump","purl":"pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-64kb":"6.4.0-150600.23.130.1","kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","kernel-zfcpdump":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","kernel-64kb-devel":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-default","purl":"pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1.150600.12.60.3"}]}],"package":{"name":"kernel-default-base","purl":"pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-docs","purl":"pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-obs-build","purl":"pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-source","purl":"pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-150600.23.130.1"}]}],"package":{"name":"kernel-syms","purl":"pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3602-1.json"},"ecosystem_specific":{"binaries":[{"kernel-docs":"6.4.0-150600.23.130.1","kernel-syms":"6.4.0-150600.23.130.1","kernel-devel":"6.4.0-150600.23.130.1","kernel-macros":"6.4.0-150600.23.130.1","kernel-source":"6.4.0-150600.23.130.1","kernel-default":"6.4.0-150600.23.130.1","dlm-kmp-default":"6.4.0-150600.23.130.1","gfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-obs-build":"6.4.0-150600.23.130.1","ocfs2-kmp-default":"6.4.0-150600.23.130.1","kernel-default-base":"6.4.0-150600.23.130.1.150600.12.60.3","kernel-default-devel":"6.4.0-150600.23.130.1","reiserfs-kmp-default":"6.4.0-150600.23.130.1","cluster-md-kmp-default":"6.4.0-150600.23.130.1"}]}}],"modified":"2026-10-02T18:42:47.946147883Z","provider":"osv","upstream":["CVE-2026-31482","CVE-2026-31483","CVE-2026-31542","CVE-2026-31598","CVE-2026-31628","CVE-2026-43033","CVE-2026-43046","CVE-2026-43056","CVE-2026-43276","CVE-2026-43440","CVE-2026-43475","CVE-2026-45904","CVE-2026-46056","CVE-2026-46080","CVE-2026-46084","CVE-2026-46109","CVE-2026-46117","CVE-2026-46126","CVE-2026-46144","CVE-2026-46145","CVE-2026-46174","CVE-2026-46193","CVE-2026-46243","CVE-2026-46323","CVE-2026-46324","CVE-2026-46333","CVE-2026-52967","CVE-2026-52986","CVE-2026-53050","CVE-2026-53129","CVE-2026-53131","CVE-2026-53177","CVE-2026-53224","CVE-2026-53246","CVE-2026-53250","CVE-2026-53262","CVE-2026-53267","CVE-2026-53297","CVE-2026-53324","CVE-2026-53354","CVE-2026-53375","CVE-2026-53388","CVE-2026-53391","CVE-2026-53402","CVE-2026-63794","CVE-2026-63802","CVE-2026-63806","CVE-2026-63807","CVE-2026-63824","CVE-2026-63826","CVE-2026-63829","CVE-2026-63884","CVE-2026-63893","CVE-2026-63912","CVE-2026-63917","CVE-2026-63919","CVE-2026-63921","CVE-2026-63922","CVE-2026-63924","CVE-2026-63946","CVE-2026-63952","CVE-2026-63968","CVE-2026-63971","CVE-2026-63975","CVE-2026-63984","CVE-2026-63994","CVE-2026-64106","CVE-2026-64189","CVE-2026-64530","CVE-2026-64560","CVE-2026-64561","CVE-2026-64564","CVE-2026-64600"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20263602-1/","https://bugzilla.suse.com/1185845","https://bugzilla.suse.com/1253262","https://bugzilla.suse.com/1258718","https://bugzilla.suse.com/1260347","https://bugzilla.suse.com/1262745","https://bugzilla.suse.com/1262771","https://bugzilla.suse.com/1263010","https://bugzilla.suse.com/1263068","https://bugzilla.suse.com/1263718","https://bugzilla.suse.com/1263788","https://bugzilla.suse.com/1264053","https://bugzilla.suse.com/1264089","https://bugzilla.suse.com/1264090","https://bugzilla.suse.com/1264558","https://bugzilla.suse.com/1264779","https://bugzilla.suse.com/1264795","https://bugzilla.suse.com/1265308","https://bugzilla.suse.com/1266238","https://bugzilla.suse.com/1266758","https://bugzilla.suse.com/1266850","https://bugzilla.suse.com/1266890","https://bugzilla.suse.com/1266913","https://bugzilla.suse.com/1267375","https://bugzilla.suse.com/1267384","https://bugzilla.suse.com/1267435","https://bugzilla.suse.com/1267584","https://bugzilla.suse.com/1267596","https://bugzilla.suse.com/1267656","https://bugzilla.suse.com/1267682","https://bugzilla.suse.com/1267715","https://bugzilla.suse.com/1267995","https://bugzilla.suse.com/1268029","https://bugzilla.suse.com/1268307","https://bugzilla.suse.com/1269181","https://bugzilla.suse.com/1269188","https://bugzilla.suse.com/1269289","https://bugzilla.suse.com/1269383","https://bugzilla.suse.com/1269512","https://bugzilla.suse.com/1269513","https://bugzilla.suse.com/1269577","https://bugzilla.suse.com/1269633","https://bugzilla.suse.com/1269773","https://bugzilla.suse.com/1269808","https://bugzilla.suse.com/1269981","https://bugzilla.suse.com/1269988","https://bugzilla.suse.com/1269997","https://bugzilla.suse.com/1270000","https://bugzilla.suse.com/1270230","https://bugzilla.suse.com/1271349","https://bugzilla.suse.com/1271368","https://bugzilla.suse.com/1271526","https://bugzilla.suse.com/1271825","https://bugzilla.suse.com/1271866","https://bugzilla.suse.com/1271899","https://bugzilla.suse.com/1271904","https://bugzilla.suse.com/1271908","https://bugzilla.suse.com/1271912","https://bugzilla.suse.com/1271964","https://bugzilla.suse.com/1272176","https://bugzilla.suse.com/1272180","https://bugzilla.suse.com/1272183","https://bugzilla.suse.com/1272207","https://bugzilla.suse.com/1272242","https://bugzilla.suse.com/1272263","https://bugzilla.suse.com/1272268","https://bugzilla.suse.com/1272282","https://bugzilla.suse.com/1272466","https://bugzilla.suse.com/1272468","https://bugzilla.suse.com/1272573","https://bugzilla.suse.com/1272607","https://bugzilla.suse.com/1272665","https://bugzilla.suse.com/1272678","https://bugzilla.suse.com/1272693","https://bugzilla.suse.com/1272694","https://bugzilla.suse.com/1272836","https://bugzilla.suse.com/1272855","https://bugzilla.suse.com/1272865","https://bugzilla.suse.com/1272904","https://bugzilla.suse.com/1272907","https://bugzilla.suse.com/1272918","https://bugzilla.suse.com/1273004","https://bugzilla.suse.com/1273035","https://bugzilla.suse.com/1273231","https://bugzilla.suse.com/1274072","https://www.suse.com/security/cve/CVE-2026-31482","https://www.suse.com/security/cve/CVE-2026-31483","https://www.suse.com/security/cve/CVE-2026-31542","https://www.suse.com/security/cve/CVE-2026-31598","https://www.suse.com/security/cve/CVE-2026-31628","https://www.suse.com/security/cve/CVE-2026-43033","https://www.suse.com/security/cve/CVE-2026-43046","https://www.suse.com/security/cve/CVE-2026-43056","https://www.suse.com/security/cve/CVE-2026-43276","https://www.suse.com/security/cve/CVE-2026-43440","https://www.suse.com/security/cve/CVE-2026-43475","https://www.suse.com/security/cve/CVE-2026-45904","https://www.suse.com/security/cve/CVE-2026-46056","https://www.suse.com/security/cve/CVE-2026-46080","https://www.suse.com/security/cve/CVE-2026-46084","https://www.suse.com/security/cve/CVE-2026-46109","https://www.suse.com/security/cve/CVE-2026-46117","https://www.suse.com/security/cve/CVE-2026-46126","https://www.suse.com/security/cve/CVE-2026-46144","https://www.suse.com/security/cve/CVE-2026-46145","https://www.suse.com/security/cve/CVE-2026-46174","https://www.suse.com/security/cve/CVE-2026-46193","https://www.suse.com/security/cve/CVE-2026-46243","https://www.suse.com/security/cve/CVE-2026-46323","https://www.suse.com/security/cve/CVE-2026-46324","https://www.suse.com/security/cve/CVE-2026-46333","https://www.suse.com/security/cve/CVE-2026-52967","https://www.suse.com/security/cve/CVE-2026-52986","https://www.suse.com/security/cve/CVE-2026-53050","https://www.suse.com/security/cve/CVE-2026-53129","https://www.suse.com/security/cve/CVE-2026-53131","https://www.suse.com/security/cve/CVE-2026-53177","https://www.suse.com/security/cve/CVE-2026-53224","https://www.suse.com/security/cve/CVE-2026-53246","https://www.suse.com/security/cve/CVE-2026-53250","https://www.suse.com/security/cve/CVE-2026-53262","https://www.suse.com/security/cve/CVE-2026-53267","https://www.suse.com/security/cve/CVE-2026-53297","https://www.suse.com/security/cve/CVE-2026-53324","https://www.suse.com/security/cve/CVE-2026-53354","https://www.suse.com/security/cve/CVE-2026-53375","https://www.suse.com/security/cve/CVE-2026-53388","https://www.suse.com/security/cve/CVE-2026-53391","https://www.suse.com/security/cve/CVE-2026-53402","https://www.suse.com/security/cve/CVE-2026-63794","https://www.suse.com/security/cve/CVE-2026-63802","https://www.suse.com/security/cve/CVE-2026-63806","https://www.suse.com/security/cve/CVE-2026-63807","https://www.suse.com/security/cve/CVE-2026-63824","https://www.suse.com/security/cve/CVE-2026-63826","https://www.suse.com/security/cve/CVE-2026-63829","https://www.suse.com/security/cve/CVE-2026-63884","https://www.suse.com/security/cve/CVE-2026-63893","https://www.suse.com/security/cve/CVE-2026-63912","https://www.suse.com/security/cve/CVE-2026-63917","https://www.suse.com/security/cve/CVE-2026-63919","https://www.suse.com/security/cve/CVE-2026-63921","https://www.suse.com/security/cve/CVE-2026-63922","https://www.suse.com/security/cve/CVE-2026-63924","https://www.suse.com/security/cve/CVE-2026-63946","https://www.suse.com/security/cve/CVE-2026-63952","https://www.suse.com/security/cve/CVE-2026-63968","https://www.suse.com/security/cve/CVE-2026-63971","https://www.suse.com/security/cve/CVE-2026-63975","https://www.suse.com/security/cve/CVE-2026-63984","https://www.suse.com/security/cve/CVE-2026-63994","https://www.suse.com/security/cve/CVE-2026-64106","https://www.suse.com/security/cve/CVE-2026-64189","https://www.suse.com/security/cve/CVE-2026-64530","https://www.suse.com/security/cve/CVE-2026-64560","https://www.suse.com/security/cve/CVE-2026-64561","https://www.suse.com/security/cve/CVE-2026-64564","https://www.suse.com/security/cve/CVE-2026-64600"]},"related_cves":[{"value":"CVE-2026-31482","evidence":"/upstream"},{"value":"CVE-2026-31483","evidence":"/upstream"},{"value":"CVE-2026-31542","evidence":"/upstream"},{"value":"CVE-2026-31598","evidence":"/upstream"},{"value":"CVE-2026-31628","evidence":"/upstream"},{"value":"CVE-2026-43033","evidence":"/upstream"},{"value":"CVE-2026-43046","evidence":"/upstream"},{"value":"CVE-2026-43056","evidence":"/upstream"},{"value":"CVE-2026-43276","evidence":"/upstream"},{"value":"CVE-2026-43440","evidence":"/upstream"},{"value":"CVE-2026-43475","evidence":"/upstream"},{"value":"CVE-2026-45904","evidence":"/upstream"},{"value":"CVE-2026-46056","evidence":"/upstream"},{"value":"CVE-2026-46080","evidence":"/upstream"},{"value":"CVE-2026-46084","evidence":"/upstream"},{"value":"CVE-2026-46109","evidence":"/upstream"},{"value":"CVE-2026-46117","evidence":"/upstream"},{"value":"CVE-2026-46126","evidence":"/upstream"},{"value":"CVE-2026-46144","evidence":"/upstream"},{"value":"CVE-2026-46145","evidence":"/upstream"},{"value":"CVE-2026-46174","evidence":"/upstream"},{"value":"CVE-2026-46193","evidence":"/upstream"},{"value":"CVE-2026-46243","evidence":"/upstream"},{"value":"CVE-2026-46323","evidence":"/upstream"},{"value":"CVE-2026-46324","evidence":"/upstream"},{"value":"CVE-2026-46333","evidence":"/upstream"},{"value":"CVE-2026-52967","evidence":"/upstream"},{"value":"CVE-2026-52986","evidence":"/upstream"},{"value":"CVE-2026-53050","evidence":"/upstream"},{"value":"CVE-2026-53129","evidence":"/upstream"},{"value":"CVE-2026-53131","evidence":"/upstream"},{"value":"CVE-2026-53177","evidence":"/upstream"},{"value":"CVE-2026-53224","evidence":"/upstream"},{"value":"CVE-2026-53246","evidence":"/upstream"},{"value":"CVE-2026-53250","evidence":"/upstream"},{"value":"CVE-2026-53262","evidence":"/upstream"},{"value":"CVE-2026-53267","evidence":"/upstream"},{"value":"CVE-2026-53297","evidence":"/upstream"},{"value":"CVE-2026-53324","evidence":"/upstream"},{"value":"CVE-2026-53354","evidence":"/upstream"},{"value":"CVE-2026-53375","evidence":"/upstream"},{"value":"CVE-2026-53388","evidence":"/upstream"},{"value":"CVE-2026-53391","evidence":"/upstream"},{"value":"CVE-2026-53402","evidence":"/upstream"},{"value":"CVE-2026-63794","evidence":"/upstream"},{"value":"CVE-2026-63802","evidence":"/upstream"},{"value":"CVE-2026-63806","evidence":"/upstream"},{"value":"CVE-2026-63807","evidence":"/upstream"},{"value":"CVE-2026-63824","evidence":"/upstream"},{"value":"CVE-2026-63826","evidence":"/upstream"},{"value":"CVE-2026-63829","evidence":"/upstream"},{"value":"CVE-2026-63884","evidence":"/upstream"},{"value":"CVE-2026-63893","evidence":"/upstream"},{"value":"CVE-2026-63912","evidence":"/upstream"},{"value":"CVE-2026-63917","evidence":"/upstream"},{"value":"CVE-2026-63919","evidence":"/upstream"},{"value":"CVE-2026-63921","evidence":"/upstream"},{"value":"CVE-2026-63922","evidence":"/upstream"},{"value":"CVE-2026-63924","evidence":"/upstream"},{"value":"CVE-2026-63946","evidence":"/upstream"},{"value":"CVE-2026-63952","evidence":"/upstream"},{"value":"CVE-2026-63968","evidence":"/upstream"},{"value":"CVE-2026-63971","evidence":"/upstream"},{"value":"CVE-2026-63975","evidence":"/upstream"},{"value":"CVE-2026-63984","evidence":"/upstream"},{"value":"CVE-2026-63994","evidence":"/upstream"},{"value":"CVE-2026-64106","evidence":"/upstream"},{"value":"CVE-2026-64189","evidence":"/upstream"},{"value":"CVE-2026-64530","evidence":"/upstream"},{"value":"CVE-2026-64560","evidence":"/upstream"},{"value":"CVE-2026-64561","evidence":"/upstream"},{"value":"CVE-2026-64564","evidence":"/upstream"},{"value":"CVE-2026-64600","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:130b8b86-0b9f-4b76-b8c0-96bf6997a30c","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-31598","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - Although the core bug is in ocfs2 filesystem code, ocfs2 is exportable and nfsd can issue direct writes with IOCB_DIRECT while remote REMOVE operations reach vfs_unlink, making the vulnerable lock chains reachable over the network on a writable exported ocfs2 volume.\nAC:L - The bug is an ABBA deadlock where the attacker can drive both sides with concurrent extending direct writes and unlink/remove operations. Once the target deployment exposes those operations, winning the race is attacker-controlled.\nPR:N - A remote NFS client can trigger the operations through an exported writable share without kernel capabilities on the target. In permissive or anonymous export scenarios, no prior authenticated privileges are required.\nUI:N - No victim user action is required after the vulnerable service/filesystem is available. The attacker can send the write and remove operations directly.\nS:U - The impact remains within the same kernel/filesystem security authority. There is no VM escape, sandbox boundary crossing, or separate security scope.\nC:N - The issue is a lock-ordering deadlock, not memory corruption or information disclosure. It does not provide a read primitive or leak data.\nI:N - The vulnerable behavior does not corrupt memory or allow unauthorized data modification. It only causes threads to block on locks.\nA:H - The deadlock can permanently hang ocfs2 operations and affected kernel worker/syscall contexts. A kernel/filesystem hang is a high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-31598","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43033","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable out-of-place AEAD decrypt path is reachable by a local process through AF_ALG sockets using authencesn, while normal inbound ESP uses in-place src==dst. This requires local syscall access rather than remote packets directly reaching the bad branch.\nAC:L - The attacker controls the AF_ALG request buffers, associated-data length, operation type, key, and authsize, and no race or hard-to-influence state is required. The fault occurs before ICV verification, so a valid packet/tag is not needed.\nPR:L - AF_ALG socket creation, bind, key setup, and AEAD decrypt do not require CAP_NET_ADMIN or CAP_SYS_ADMIN, but the attacker needs local unprivileged code execution. XFRM state management is privileged, but the lower-privilege AF_ALG path reaches the bug.\nUI:N - No victim action is required once the local attacker runs the AF_ALG syscall sequence. The attacker supplies both input and output buffers directly.\nS:U - The vulnerability is in kernel crypto processing and impacts the same kernel security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:H - The bug is a kernel memory-corruption condition from writing ESN high sequence bytes past the intended out-of-place destination; successful exploitation of such corruption could expose arbitrary kernel memory. Under the required uncertainty rule, this is scored as high confidentiality impact.\nI:H - The vulnerable code performs an attacker-influenced out-of-bounds write of four bytes before authentication succeeds. Kernel out-of-bounds writes are scored as high integrity impact because they can plausibly be shaped into control-flow or data corruption.\nA:H - At minimum, the AF_ALG path can drive scatterwalk past the end of the destination scatterlist and crash the kernel. A local attacker can repeat the trigger without authentication, causing high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43033","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-43056","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable `add_adev()` error path is reached during MANA PCI driver probe/resume/recovery or auxiliary RDMA service handling, not by processing received network packets. The highest defensible attacker path is local influence over driver/device lifecycle or resource-failure conditions.\nAC:L - Once `auxiliary_device_add()` fails, the UAF is deterministic because `auxiliary_device_uninit()` releases the embedded object and the cleanup path immediately reads `adev->id`. No attacker-uncontrolled race is required beyond reaching that failure path.\nPR:L - The path is not exposed to unauthenticated remote peers, but a local attacker can plausibly influence resource exhaustion/failure conditions around driver lifecycle events. Direct sysfs/module lifecycle control is privileged, but Low is the higher-severity defensible choice under the conservative scoring rule.\nUI:N - No separate victim action is required once the attacker can exercise or influence the local driver lifecycle/failure path. Probe, resume, and service-event handling run in kernel context.\nS:U - The affected component and impacts are within the Linux kernel security scope. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel use-after-free of an auxiliary-device container object after its release callback frees it. Under conservative kernel UAF scoring, freed slab reuse can support information disclosure, so confidentiality is High.\nI:H - The UAF lets stale object contents influence cleanup through `mana_adev_idx_free()`, and kernel UAFs are conservatively treated as potentially exploitable memory corruption. Integrity is therefore High.\nA:H - At minimum, the stale access can trigger a kernel UAF report, invalid IDA cleanup, oops, or panic during probe/resume error unwinding. Availability impact is High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43056","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46056","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The vulnerable handlers process HCI Secure Simple Pairing events (User Passkey Notify / Keypress Notify) driven by a remote Bluetooth peer during SSP pairing, so the attacker must be within Bluetooth radio range (adjacent), matching kernel guidance that Bluetooth = Adjacent.\nAC:L - This is a use-after-free where a remote peer drives the passkey/keypress events while connection teardown frees the conn from a concurrent context; the attacker influences both sides of the race and can retry, and UAF bugs are scored AC:L unless the race is uncontrollable.\nPR:N - The code path is reached by a remote Bluetooth device participating in the SSP pairing handshake, requiring no credentials or privileges on the target system.\nUI:N - The handlers execute automatically when the controller forwards the SSP passkey/keypress HCI events during the pairing protocol exchange; no local user action is required to reach the vulnerable code.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The use-after-free reads fields (dst, type, dst_type, passkey) from a freed and potentially reallocated hci_conn object, which can disclose attacker-controlled or sensitive kernel heap contents.\nI:H - The handlers write to the freed object (passkey_notify and passkey_entered fields), giving a UAF write into reallocated heap memory that can be leveraged for heap grooming and control-flow corruption.\nA:H - A use-after-free on the hci_conn structure readily causes kernel oops/panic, yielding high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46056","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46117","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached through the RDMA userspace verbs interface (/dev/infiniband/uverbs<N>) by issuing a create-QP command locally; it is not exposed to network peers.\nAC:L - The condition is created entirely by the attacker (building an RWQ indirection table whose WQs share one CQ) and is deterministically triggered on the second loop iteration; there is no race or uncontrolled state.\nPR:L - Triggering only requires an unprivileged local process with access to the RDMA verbs device — the normal configuration on RDMA-enabled hosts — and no CAP_* check exists on the create-QP path.\nUI:N - The attacker performs all steps via its own verbs calls; no action by another user is required.\nS:U - The corruption stays within the kernel's own memory/security authority and does not cross a VM/IOMMU/sandbox boundary.\nC:H - The overwrite leaks/dangles objects in cq_table[], and a use-after-free on these IRQ-dispatched structures can be leveraged to read kernel memory contents.\nI:H - The driver \"goes on to corrupt the kernel,\" leaving dangling function-pointer/context entries in a table called from interrupt context, providing a write/control-flow corruption primitive.\nA:H - The user-triggerable WARN_ON panics the system when panic_on_warn is set, and the subsequent kernel state corruption causes oopses/crashes regardless."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46117","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46145","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only by issuing RDMA verbs to the local /dev/infiniband/uverbs* character device; `rx_hash_key_len` arrives via `ib_copy_from_udata` from a local process, with no remote network path.\nAC:L - The attacker directly controls `rx_hash_key_len` in the uAPI struct and can set it arbitrarily large to trigger the overflow on every call; there is no race or condition outside the attacker's control.\nPR:L - Reaching the raw-packet QP path requires CAP_NET_RAW, but that is a narrow, non-root capability (not the \"real root/admin\" bar for High) and is routinely granted to unprivileged networking/RDMA applications such as DPDK workloads.\nUI:N - The overflow is triggered entirely by the attacker's own QP-creation request; no action by any other user is required.\nS:U - The corruption is of the kernel's own heap allocation within the same kernel security authority; no crossing into a separate scope (VM/IOMMU) occurs.\nC:H - The memcpy over-reads the 40-byte stack source by an unbounded amount and the heap overflow can be leveraged to disclose adjacent kernel memory, so confidentiality impact is High.\nI:H - An attacker-controlled-length memcpy writes past a 40-byte heap field, giving a heap out-of-bounds write that corrupts adjacent kernel objects and is exploitable toward arbitrary write/control-flow hijack.\nA:H - A large `rx_hash_key_len` corrupts the kernel heap and/or faults reading unmapped stack/heap pages, reliably causing a kernel panic/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46145","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46174","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in the CPU's op cache and requires executing instructions on the affected core to drive improper resource sharing; it is not reachable over a network. Triggering it needs local code execution on the machine.\nAC:L - An attacker who can co-schedule code on SMT siblings of an affected Zen2 core controls both sides of the shared op-cache contention and can reliably drive the improper-isolation condition. Following the higher-severity rule, this is Low.\nPR:L - Triggering the op-cache resource sharing only requires the ability to run code (an unprivileged local user or a guest VM tenant); no root or admin capability is needed. It does, however, require at least some local execution access, so not None.\nUI:N - The attacker's own executing code populates and contends for the op cache; no victim action is required.\nS:C - The bug is an isolation failure of a microarchitectural resource shared across SMT threads, so instruction corruption can cross from the attacker's context into a different security authority (another VM/tenant or the host kernel), impacting resources beyond the attacking component's scope.\nC:H - Improper isolation of a shared op-cache resource is an information-disclosure vector across contexts, and the resulting instruction corruption can be leveraged to read memory belonging to another security domain.\nI:H - The defining impact is \"instruction corruption\" — the CPU executes corrupted/wrong instructions in a victim context, which is a direct, severe integrity violation enabling control-flow and data corruption across the isolation boundary.\nA:H - Instruction corruption causes incorrect execution, crashes, and hangs in the affected (potentially cross-context) code, resulting in high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46174","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46243","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local `request_key(2)` or `add_key(2)` from an unprivileged process; the flaw is missing origin validation in the keyring path, not remote SMB/CIFS protocol input.\nAC:L - On typical affected systems (CIFS module with upcall, cifs-utils request-key rule, unprivileged user/mount namespaces), the attacker fully controls the forged description, target pid, and namespace layout for a reliable root upcall chain.\nPR:L - Any local unprivileged user account can invoke the key syscalls; user/mount namespaces are part of the standard exploit setup and map to basic local user capability, not root-only access.\nUI:N - No victim action such as mounting a Kerberos CIFS share is required; the attacker forges the key request directly without depending on another user’s mount or session.\nS:U - Successful exploitation elevates privileges within the same host/kernel security domain (local root) and does not cross a VM/hypervisor or hardware isolation boundary by itself.\nC:H - The attack chain yields root-equivalent access in the root upcall helper, enabling arbitrary read of host data (full confidentiality compromise of the system).\nI:H - Malicious NSS modules run as root inside `cifs.upcall`, giving arbitrary code execution and full integrity compromise of the host, not merely limited data modification.\nA:N - The kernel bug is a trust-boundary failure without memory corruption or guaranteed kernel panic; primary impact is privilege escalation rather than kernel crash or sustained denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46243","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46323","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local attacker to inject zerocopy/managed-frags skbs via io_uring SEND_ZC, TUN/TAP, or similar local APIs; ordinary remote wire packets processed by GRO do not carry SKBFL_MANAGED_FRAG_REFS, so a network-only attacker cannot reach the buggy merge path.\nAC:L - The attacker fully controls both sides of the GRO merge (seed and zerocopy TCP segments over a veth pair), timing (netem delay, RST race), and buffer setup; a public working LPE exploit exists, so success does not depend on conditions outside attacker control.\nPR:L - Triggering requires only a basic unprivileged local account with io_uring and user-namespace access (unshare -Urn), which is the default on many distributions; no init-namespace root or CAP_NET_ADMIN is needed.\nUI:N - No victim user action is required; the attacker drives the entire exploit autonomously through syscalls and local network namespace setup.\nS:U - Impact is standard host-kernel privilege escalation (root on the same kernel); it does not cross a distinct hypervisor/IOMMU security boundary such as VM-guest-to-host escape.\nC:H - The flaw is a use-after-free on page structures; the known exploit leverages the refcount underflow to obtain stale read access to freed physical pages and extract kernel PTE contents, enabling arbitrary memory disclosure primitives.\nI:H - UAF page refcount corruption enables crafting writable PTE entries against read-only page-cache pages; the public exploit demonstrates integrity compromise by rewriting /etc/passwd and obtaining root via su.\nA:H - Use-after-free of page structures can cause kernel oops/panic during skb teardown; even failed exploitation attempts can crash the system."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46323","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46324","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is in nf_tables netdev hook teardown reached only via Netfilter netlink (nft) syscalls—chain/flowtable updates, dumps, netns teardown, and netlink socket release—not from remote packet handling alone. Per kernel guidance, nftables/netfilter is Local (L).\nAC:L - Exploitation is a race between hook-list removal (`list_del()` + RCU free) and concurrent RCU walkers (`nft_dump_basechain_hook_list`, flowtable dump, or packet-path `list_for_each_entry_rcu`). An attacker with CAP_NET_ADMIN can drive both sides concurrently (e.g., one thread dumping chains/flowtables while another deletes hooks or tears down the netns).\nPR:L - All nf_tables netlink operations are gated by `netlink_net_capable(skb, CAP_NET_ADMIN)` in `nfnetlink_rcv()`. CAP_NET_ADMIN is obtainable by an unprivileged user via user+network namespaces (`unshare -Urn`), not real init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers hook teardown and concurrent dumps or traffic entirely through their own netlink sockets and namespace lifecycle.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not inherently cross VM, container, or IOMMU boundaries.\nC:H - Using `list_del()` instead of `list_del_rcu()` on lists walked under `rcu_read_lock()` is a use-after-free/list-corruption bug; concurrent dumpers dereference `nft_hook` fields (e.g., `ifname`) after unlink/free, enabling arbitrary kernel memory read via heap grooming.\nI:H - The freed `nft_hook` kmalloc object can be reallocated and corrupted through the dangling RCU list pointers, providing a standard kernel UAF primitive exploitable for arbitrary write and control-flow hijacking.\nA:H - The race reliably causes kernel list corruption and use-after-free, leading to oops/panic during hook dumps, flowtable lookups, or netns cleanup; UAF in this path has inherent high availability impact even when not fully weaponized."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46324","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-46333","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable authorization check is reached through local interfaces such as ptrace-style checks, procfs, and pidfd_getfd; it is not reachable from network packets or adjacent/physical input.\nAC:L - A local attacker can repeatedly trigger the relevant check and, for exiting tasks, can race pidfd_getfd/procfs access against a target's exit path after exit_mm() but before exit_files(). The race is attacker-driven and does not require unusual kernel configuration or conditions outside the attacker's influence.\nPR:L - An unprivileged local user can target same-UID nondumpable tasks because the vulnerable code skips the dumpability requirement once task->mm is NULL. User-namespace root does not help against init-namespace root kernel threads, but low local privileges are enough for the same-UID exiting-task case.\nUI:N - Exploitation does not require a victim user to open a file or perform an interactive action; the attacker can use local syscalls/procfs against an existing or attacker-terminated target task.\nS:U - The bug bypasses Linux kernel task-access authorization within the same OS security authority. It does not cross a VM, IOMMU, or hypervisor boundary.\nC:H - The bypass can allow access to sensitive task details and, most importantly, pidfd_getfd can duplicate file descriptors from a nondumpable task during the exit window. In a plausible helper/sandbox scenario, those descriptors can expose highly sensitive files or privileged resources.\nI:H - If the duplicated descriptor is writable, the attacker can modify the protected resource reachable through the victim's file descriptor despite the dumpability restriction. This is a high-impact integrity bypass even though the bug is not memory corruption.\nA:N - The issue is an access-control bypass around ptrace/dumpability checks and does not by itself provide a kernel crash, hang, deadlock, or sustained denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46333","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52967","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable SMB client parser consumes an SMB2 CREATE error response supplied by a remote SMB server over the network. A malicious or compromised SMB share can send the crafted `STATUS_STOPPED_ON_SYMLINK` response.\nAC:L - The server directly controls `ErrorContextCount`, `ByteCount`, `ErrorId`, and `ErrorDataLength`, and no race or hard-to-hit state is required. Although the wraparound behavior is 32-bit specific, that is a deployment property rather than an attacker-uncontrolled exploitation condition.\nPR:N - The attacker needs no privileges on the victim system; they only need to operate or control the SMB server endpoint that the client connects to. The path can also be reached through guest or null-auth SMB sessions.\nUI:R - The victim client must mount/connect to the SMB share and perform a path operation such as lookup, stat, open, or create that causes an SMB2 CREATE response to be parsed. The remote server cannot trigger this parser without client-side filesystem activity.\nS:U - The affected component is the Linux kernel SMB client, and the impact is to the same kernel/client security authority. This is not a VM escape, IOMMU bypass, or cross-scope sandbox escape.\nC:H - The bug is an out-of-bounds kernel read in a server-controlled response parser, and the read is not strictly bounded to only a few harmless bytes. Following the required conservative rule, this is scored as high confidentiality impact.\nI:N - The defect advances a parser pointer incorrectly and reads from the wrong location, but it does not write out of bounds or provide a kernel memory write primitive. No direct integrity impact beyond normal malicious-server control of SMB content was identified.\nA:H - The crafted length can make the parser loop indefinitely on 32-bit systems, causing a reliable denial of service. Other malformed pointer positions can also lead to invalid kernel reads and possible oops conditions."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52967","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-52986","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable SIP conntrack helper parses SIP payload carried in TCP/UDP network packets once the SIP helper is enabled, which is a reasonable deployment for NAT/firewall SIP gateways. A remote SIP peer can send crafted packets to that packet-processing path.\nAC:L - The trigger is a malformed numeric SIP field or URI port at the parser buffer boundary; no race or victim-controlled timing is required. Helper/NAT configuration is an environmental prerequisite, not an attacker-controlled complexity condition.\nPR:N - In the network gateway scenario, the attacker only needs to send unauthenticated SIP traffic through a system using the SIP conntrack helper. No local account or kernel privilege is required.\nUI:N - Exploitation is driven by packet processing in netfilter/conntrack. No user action is needed after the affected helper is configured.\nS:U - The impact is within the kernel/network stack security authority of the vulnerable system. It does not cross a separate scope such as guest-to-host or IOMMU isolation.\nC:H - The bug is an unbounded out-of-bounds read from non-NUL-terminated skb data via simple_strtoul and missing limit checks. Following the required guidance, an unbounded OOB read is high confidentiality impact.\nI:H - In NATed SIP paths, an out-of-bounds parser end pointer can feed attacker-influenced match lengths into NAT packet mangling, whose memmove/memcpy path lacks a bounds check against the skb payload. That creates a defensible kernel memory-corruption/code-execution risk.\nA:H - The same OOB read and possible invalid NAT mangle lengths can cause kernel faults, skb corruption, or panic. Crafted packets can be sent repeatedly, so availability impact is high."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-52986","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53050","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local filesystem quota activity on a mounted OCFS2 filesystem, via ordinary dquot lifetime changes racing with the OCFS2 quota sync worker. It is not reachable by remote packets or adjacent/physical input.\nAC:L - This is a race, but a local attacker can repeatedly churn dquot references with filesystem operations while the periodic scanner runs. When uncertain, the higher-severity AC:L is appropriate.\nPR:L - After OCFS2 quotas are enabled, an unprivileged local user with write access to the filesystem can trigger dquot allocation and release paths. Mounting/configuring quotas is an environmental prerequisite, not a privilege needed for each exploit attempt.\nUI:N - No victim interaction is required once the affected filesystem is mounted and quotas are active. The attacker can trigger the relevant filesystem operations directly.\nS:U - The impact remains within the kernel and the same host security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The bug can lead to use-after-free of a dquot object under memory pressure. Kernel UAF conditions can be leveraged for memory disclosure, so confidentiality impact is High.\nI:H - The stale dquot/list state creates kernel heap use-after-free/list corruption, which can plausibly be shaped into write primitives or code execution. Integrity impact is therefore High.\nA:H - The race already produces kernel WARN/oops-style failure conditions and can dereference freed kernel objects. This can crash or destabilize the kernel, so availability impact is High."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53050","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53131","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.4,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable netfilter match, ipset, and logging paths run while processing packets in receive/netdev hooks. In a reasonable firewall, router, VPN, or tunnel deployment with these rules installed, unauthenticated remote packets can reach the vulnerable code.\nAC:L - No race or difficult timing is required; a packet reaching a vulnerable rule with an invalid, unset, non-Ethernet, or too-short MAC header deterministically drives the bad eth_hdr(skb) access. The needed rule/interface setup is a plausible deployment condition, not an exploit race.\nPR:N - The remote packet sender does not need credentials or local privileges once the affected rule or logger is configured. Although rule installation requires CAP_NET_ADMIN, that is not required for the runtime remote-trigger scenario.\nUI:N - Exploitation is triggered by packet processing and does not require a victim user to open a file, mount anything, or perform another action.\nS:U - The impact remains within the kernel/network stack security authority. There is no VM, IOMMU, or separate sandbox boundary crossing.\nC:H - The flaw causes invalid or out-of-bounds reads from the skb MAC header, and those bytes can be copied into logs/ipset state or influence observable match behavior. Per the required guidance, out-of-bounds reads are scored High when not proven strictly harmless.\nI:L - The primitive is a read rather than an arbitrary write or control-flow hijack. However, the wrongly read MAC bytes can influence firewall matches and ipset add/delete/test behavior, giving limited integrity impact.\nA:H - Invalid eth_hdr(skb) access can produce slab out-of-bounds/KASAN reports or kernel oops/panic conditions, and packets can be sent repeatedly. Kernel crashes are High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53131","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53224","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - An unauthenticated remote SCTP peer can reach the vulnerable COOKIE_ECHO processing path by sending SCTP packets to a listening SCTP endpoint. In deployments with cookie HMAC disabled, the attacker can obtain and modify the state cookie over the network.\nAC:L - The bug is triggered with a malformed COOKIE_ECHO and attacker-controlled embedded INIT/address-list lengths; no race or hard-to-control timing condition is required. The no-cookie-auth deployment condition is a reasonable supported SCTP configuration.\nPR:N - No credentials or local privileges are needed to send SCTP INIT/COOKIE_ECHO traffic to a listening service. The vulnerable parsing occurs before any application authentication.\nUI:N - Exploitation only requires sending network packets to the target SCTP endpoint. No victim user action is required.\nS:U - The impact is within the kernel/network stack security authority of the target system. It does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The malformed lengths can drive out-of-bounds kernel reads beyond the COOKIE_ECHO payload, including attacker-controlled oversized address-list parsing. Because the read is not strictly bounded to a few bytes and related SCTP COOKIE_ECHO bugs demonstrate kernel memory leakage potential, confidentiality impact is High.\nI:N - The investigated fix addresses out-of-bounds reads and missing length validation, not an out-of-bounds write or direct arbitrary memory modification primitive. I did not find a defensible direct integrity impact from this bug alone.\nA:H - The attacker-controlled out-of-bounds reads can walk beyond the skb/cookie buffer and fault or trigger KASAN/oops conditions. A remotely triggerable kernel crash is High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53224","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53246","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable COOKIE_ECHO processing is reached by remote SCTP packets delivered through the IPv4/IPv6 SCTP protocol handlers to a listening SCTP endpoint.\nAC:L - In a deployment with SCTP cookie HMAC disabled, the attacker can obtain a cookie through the normal INIT/INIT_ACK exchange, modify the cached INIT length, and send the forged COOKIE_ECHO without races or conditions outside attacker control.\nPR:N - The path is pre-authentication network protocol handling for a listening SCTP server; no local account or SCTP authentication is required when cookie HMAC is disabled.\nUI:N - Exploitation only requires sending SCTP handshake packets to the target listener and does not require victim user action.\nS:U - The impact is within the Linux kernel/network stack security authority and does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The inflated cached INIT length drives out-of-bounds parameter walking and attacker-sized kmemdup() reads beyond the received skb, which can expose kernel memory.\nI:H - The bug is kernel memory-safety corruption during nested parameter handling, and the higher-severity choice is appropriate because attacker-controlled parsing and copies beyond the valid buffer can corrupt kernel association state and plausibly support stronger primitives.\nA:H - The out-of-bounds reads and large attacker-controlled copies can trigger kernel faults, KASAN splats, allocation failure paths, or repeated remote crashes of SCTP processing."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53246","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53250","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached by a local process using AF_XDP socket setup, UMEM registration, TX ring submission, and send/poll-driven transmit; it is not reachable directly from remote network packets.\nAC:L - The attacker controls the UMEM metadata and can trigger TX from the same process, so the TOCTOU race can be created with attacker-controlled concurrent writes.\nPR:L - AF_XDP socket creation requires CAP_NET_RAW in the relevant network namespace, which is attainable by a low-privileged local user in user/network namespace deployments.\nUI:N - No victim action is needed after the attacker has local execution; the attacker sets up the socket, UMEM, metadata, and transmit operation directly.\nS:U - The vulnerability corrupts or reads kernel networking memory within the same kernel security authority; this is standard local kernel attack surface, not a VM or hardware boundary crossing.\nC:H - Racing csum_start/csum_offset can bypass validation and drive out-of-bounds checksum reads in kernel transmit checksum handling, so potential kernel memory disclosure is high.\nI:H - The same unvalidated checksum offsets can cause checksum writes to an attacker-influenced out-of-bounds location relative to skb data, making kernel memory corruption plausible.\nA:H - The out-of-bounds memory access in the kernel transmit path can trigger warnings, faults, or kernel crashes and can be repeatedly exercised by the local attacker."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53250","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53262","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through a local `ioctl()` on a connected PPPoL2TP `AF_PPPOX` socket. Remote L2TP packets do not invoke `pppol2tp_ioctl()`.\nAC:L - The attacker controls both sides of the race by blocking `copy_from_user()` in the ioctl thread and closing the same socket concurrently. No external victim state is required.\nPR:L - A local unprivileged user can reach the PPPoL2TP socket/ioctl path; L2TP management also uses user-namespace admin permissions rather than requiring real init-namespace root. This is not remotely reachable without local code execution.\nUI:N - No victim action is required after the attacker runs local code. The attacker creates/connects the socket, issues the ioctl, and closes the socket.\nS:U - The impact is within the kernel security authority on the same system. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel heap use-after-free of `struct l2tp_session`, and the resumed ioctl can read from reclaimed/faked session and tunnel data before copying results to userspace. Per conservative kernel UAF scoring, this supports high confidentiality impact.\nI:H - Kernel UAFs with attacker-controlled timing and heap reuse can be leveraged beyond a simple stale read, including corruption or control-flow primitives. When uncertain, the higher severity option is appropriate.\nA:H - At minimum, dereferencing the stale session or tunnel pointer can trigger a kernel oops or panic. The attacker can repeatedly trigger the race locally."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53262","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53267","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached by installing crafted nftables/netfilter rules through NETLINK_NETFILTER and then triggering packet evaluation locally. Remote packets alone cannot install the rule, so this is a local attack vector.\nAC:L - A single crafted rule sequence such as `ct zone set` followed by `ct original saddr` can deterministically trigger the bug on matching packets. No race or external condition beyond the attacker's control is required.\nPR:L - Rule creation requires CAP_NET_ADMIN for the relevant network namespace via nfnetlink. Because nftables is reachable with CAP_NET_ADMIN in a user-created network namespace on systems permitting unprivileged user namespaces, this is low privileges rather than high.\nUI:N - After the attacker installs the crafted rule, triggering occurs through packet processing without any victim user action. No user needs to open a file, mount anything, or interact with attacker-controlled content.\nS:U - The bug corrupts kernel memory during kernel packet-filter evaluation and impacts the same kernel security authority. This is standard kernel privilege escalation/DoS behavior, not a VM, IOMMU, or distinct security-scope escape.\nC:H - The bug is a kernel stack out-of-bounds write past `struct nft_regs`, a memory corruption primitive. Under the required higher-severity rule, such memory corruption is defensibly treated as capable of enabling high confidentiality impact.\nI:H - The vulnerable 16-byte memcpy can overwrite beyond the validated destination register on the kernel stack. Out-of-bounds kernel writes are high integrity impact because they can plausibly be developed into control-flow or privilege-modification primitives.\nA:H - The stack overwrite can corrupt adjacent stack state or registers during packet evaluation and can crash or oops the kernel. Kernel crash or panic is high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53267","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53354","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable TLBI completion path is reachable by locally executing code that drives memory permission/unmap activity through syscalls or guest/KVM memory-management activity. It is not directly exposed by network packets.\nAC:L - Although the erratum depends on timing, the attacker can repeatedly arrange concurrent stores and translation invalidations on affected multicore Arm systems. The triggering race is therefore attacker-influenced rather than dependent on a one-off external condition.\nPR:L - A basic unprivileged local user or guest workload can reach the relevant Stage-1/Stage-2 TLBI paths without host administrative privileges. No real root capability in the init namespace is required.\nUI:N - After the attacker has local code execution, exploitation only requires attacker-driven memory operations/syscalls or guest activity. No separate victim action is needed.\nS:C - In a severe reasonable deployment such as Arm KVM/cloud virtualization, bypassing Stage-2 or higher-level translation protections can let guest-controlled writes affect hypervisor/host resources. That crosses a security authority boundary.\nC:H - The primitive can enable privilege escalation to kernel or hypervisor context, making protected memory and secrets accessible. Even though the erratum affects stores, successful control of privileged context supports high confidentiality impact.\nI:H - The core issue permits writes to memory after translation permissions or ownership should have been revoked. This is a high-integrity memory corruption primitive with plausible kernel or hypervisor privilege escalation.\nA:H - Incorrect late writes into protected or reused memory can corrupt kernel/hypervisor state. Failed exploitation or corruption can plausibly cause kernel panic, guest/host crash, or system instability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53354","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53375","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached only through the AMDGPU_CS DRM ioctl on a render node (/dev/dri/renderD*), requiring local access to submit crafted VCE indirect buffers to the GPU driver.\nAC:L - An attacker fully controls the VCE command stream and per-command length fields, and can reliably craft commands where exactly one relocation index is out of bounds (e.g., 0x0500000d with len=32) to trigger partial address patching.\nPR:L - Exploitation requires only unprivileged local access to the amdgpu DRM render node; AMDGPU_CS is gated by DRM_AUTH|DRM_RENDER_ALLOW, not root or special capabilities.\nUI:N - No victim interaction is required; the attacker drives the entire malicious command submission through the render node.\nS:C - Partial address patching causes VCE firmware to DMA using attacker-influenced GPU addresses outside the intended buffer object boundaries, crossing the GPU memory/DMA isolation boundary that the relocation logic is meant to enforce.\nC:H - VCE firmware performs DMA reads using the malformed 64-bit address, enabling arbitrary reads from GPU-accessible memory regions (including GTT-mapped system memory) beyond the validated buffer scope.\nI:H - VCE firmware performs DMA writes (encoded bitstreams, feedback, and context buffers) to attacker-influenced addresses, enabling arbitrary GPU-mapped memory corruption and potential privilege escalation primitives.\nA:H - Submitting commands with malformed firmware addresses can cause GPU page faults, driver hangs, GPU resets, or kernel oops/panic when the VCE engine accesses invalid memory regions."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53375","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53388","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local syscalls: mounting a FUSE filesystem, reading files to trigger readpages, and the FUSE daemon writing replies to /dev/fuse via splice_write with SPLICE_F_MOVE.\nAC:L - The race is between the attacker's own splice reply and a concurrent abort they trigger (e.g., via sysfs abort or unmount); the attacker controls both threads and can retry until the window is hit.\nPR:L - Exploitation requires mounting and operating a FUSE filesystem via /dev/fuse, which needs local user privileges; on typical systems this is reachable by unprivileged users via user namespaces (CAP_SYS_ADMIN in a user namespace) without init-namespace root.\nUI:N - No victim interaction is required; the attacker mounts the filesystem, runs the FUSE daemon, and triggers the concurrent abort themselves.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security domain, not a cross-boundary escape such as guest-to-host or sandbox breakout.\nC:H - The vulnerability is a use-after-free of fuse_io_args and associated folio pointers in kernel heap memory, which can be leveraged for arbitrary kernel memory read via heap reuse.\nI:H - Use-after-free of fuse_io_args enables heap spraying and controlled reuse of freed kernel objects, providing a path to arbitrary kernel memory write or code execution.\nA:H - The UAF and the race with folio replacement can cause kernel oops/panic, including NULL pointer dereference when fuse_readpages_end accesses a folio with a NULL mapping."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53388","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53391","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The crash is triggered by processing a malicious GETDEVICEINFO RPC response from an NFS metadata server over the network, on the standard NFSv4 client path used by pNFS file and flexfile layouts.\nAC:L - Once a victim is a pNFS client, the attacker reliably triggers the bug by sending a GETDEVICEINFO body with a zero-length r_netid or r_addr opaque; no race or special memory layout is required.\nPR:N - The attacker acts as (or compromises) the remote NFS metadata server and needs no local privileges on the victim client; exploitation is delivered entirely through NFS protocol responses to an already-established mount.\nUI:N - In the highest-impact scenario—a compromised enterprise/HPC metadata server or autofs-managed pNFS mount—no further victim action is needed beyond normal file I/O that provokes GETDEVICEINFO.\nS:U - The vulnerability causes a kernel panic on the NFS client itself and does not cross a security boundary such as a VM escape or sandbox breakout.\nC:N - This is a NULL pointer dereference in strrchr() with no out-of-bounds read or use-after-free; it does not disclose kernel memory or attacker-controlled data.\nI:N - There is no memory corruption, arbitrary write, or control-flow hijack primitive—only an immediate NULL dereference that terminates kernel execution.\nA:H - The NULL pointer dereference in kernel context causes an oops or panic, fully denying availability of the affected client (and any co-hosted workloads until reboot)."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53391","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-53402","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the KDFONTOP ioctl on a framebuffer-console virtual terminal (/dev/ttyN), which is a local syscall path with no network or physical-access vector.\nAC:L - An attacker who controls a session on an fbcon-backed VT can reliably trigger the bug by issuing a font-change ioctl with different dimensions and a 256↔512 glyph transition, then inducing vc_resize() failure through self-controlled memory pressure; no race or victim-dependent timing is required.\nPR:L - KDFONTOP font-set operations require only that the caller owns the controlling TTY (current->signal->tty == tty), which any unprivileged local user with a console or VT session has; CAP_SYS_TTY_CONFIG is not required on that path.\nUI:N - Exploitation requires only the attacker's own ioctl and memory-pressure actions on their TTY; no action by another user or administrator is needed.\nS:U - Impact is confined to kernel memory disclosure and potential kernel crash within the same kernel security authority; there is no VM escape, sandbox escape, or cross-security-boundary effect.\nC:H - The desynchronized hi_font_mask causes deterministic out-of-bounds reads from the kernel font glyph buffer during fbcon rendering (e.g., bit_cursor and rotated putcs paths), enabling disclosure of adjacent kernel memory.\nI:N - The flaw is an out-of-bounds read with console state desynchronization; it does not provide an arbitrary kernel write, code execution, or other data-modification primitive.\nA:H - Out-of-bounds reads from kernel font data can cause kernel page faults and oopses, consistent with the prior syzkaller-reported fbcon font/resize failure class that produced unhandled page faults."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53402","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63802","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local cgroup management (rmdir on cgroupfs) and concurrent block I/O to populate per-blkcg rstat lists; the vulnerable code is in the block cgroup teardown path, not in any network protocol handler.\nAC:L - The attacker controls both sides of the race by issuing I/O on multiple block devices to create multiple blkgs with pending stats, then concurrently destroying the cgroup to trigger parallel blkg_release() calls on multiple CPUs.\nPR:L - Triggering cgroup deletion and block I/O requires only delegated cgroup write access or namespace/container root (CAP_SYS_ADMIN in a user namespace), not init-namespace root; this is routinely available in containers, Kubernetes pods, and systemd user cgroup hierarchies.\nUI:N - No victim interaction is required; the attacker programmatically performs I/O and cgroup teardown from their own process or container.\nS:U - The UAF corrupts kernel heap memory within the same kernel security domain; it does not inherently cross a VM, container, or IOMMU boundary without a separate privilege-escalation step.\nC:H - The use-after-free dereferences freed blkg structures and associated iostat data during list iteration, enabling arbitrary kernel memory read primitives typical of slab UAF bugs.\nI:H - UAF on kmalloc-allocated blkg objects allows heap grooming and write through dangling pointers, which can be leveraged for arbitrary kernel memory modification or code execution.\nA:H - Concurrent use-after-free during blkg teardown can cause immediate kernel oops/panic from accessing freed memory, and repeated triggering enables reliable denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63802","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63806","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - A malicious KVM guest triggers this via guest-executed MMIO stores handled by the x86 instruction emulator (KVM_RUN → vmx_handle_exit → kvm_mmu_page_fault → x86_emulate_instruction → emulator_read_write → vcpu_mmio_write → ioeventfd_write), not via remote network input to the host.\nAC:L - The guest fully controls the spanning store address, size, and timing; with standard QEMU/virtio datamatch ioeventfd MMIO layouts, a page-boundary write reliably reaches ioeventfd_in_range() with a misaligned val pointer and fires the BUG_ON().\nPR:N - Exploitation requires only unprivileged code execution inside an already-running guest VM (reproducer ran as UID 1000); no host capabilities, KVM ioctls, or guest root are needed beyond what any cloud VM tenant or compromised guest process already has.\nUI:N - No victim interaction is required once the attacker can run code in a KVM guest with a datamatch ioeventfd configured, which is the default virtio/QEMU setup.\nS:C - The vulnerable component is the host kernel KVM subsystem, but exploitation is initiated from a guest VM and causes a host kernel BUG/oops, crossing the hypervisor security boundary.\nC:N - The failure mode is an explicit BUG_ON() alignment check before any datamatch comparison; there is no out-of-bounds read, use-after-free, or other memory corruption that could disclose host data.\nI:N - The bug triggers a deliberate kernel BUG and does not corrupt or modify host memory; it is a crash-only denial-of-service with no integrity impact.\nA:H - A guest-triggered BUG_ON() in ioeventfd_write() causes a host kernel oops/panic, denying availability of the entire physical host and all co-resident VMs on multi-tenant KVM hypervisors."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63807","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached only through the KVM VM file descriptor ioctl path (KVM_SET_USER_MEMORY_REGION), which requires local syscall access to /dev/kvm rather than any network-facing protocol.\nAC:L - An attacker with KVM access can deterministically set up the required state (partial hugepage memslot, dirty logging enabled then disabled, guest hugepage mapping extending below slot bounds) and trigger the bug without depending on conditions outside their control.\nPR:L - Exploitation requires only local access to /dev/kvm and control of a VM (e.g., membership in the kvm group), as demonstrated by the reproducer running as UID 1000; it does not require host root in the init namespace.\nUI:N - No victim user interaction is required beyond the attacker issuing the KVM ioctl to disable dirty logging on a memslot they control.\nS:C - The vulnerable KVM x86 MMU code runs in the host kernel and a VM operator can corrupt or crash host kernel memory from their guest/VM management context, crossing the guest-to-host virtualization security boundary.\nC:H - The bug is an out-of-bounds kernel read of memslot lpage_info metadata via an invalid gfn index in kvm_mmu_max_mapping_level(), which per kernel guidance qualifies as high confidentiality impact even though it typically manifests as a page fault.\nI:H - Out-of-bounds access to kernel heap metadata in the KVM MMU subsystem can potentially be steered for memory corruption and control-flow influence; similar KVM shadow MMU memory safety bugs are scored at high integrity impact.\nA:H - The vulnerability reliably causes a host kernel oops/page fault (supervisor read to non-present vmalloc address) when triggered, constituting high availability impact via host kernel crash."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63807","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63824","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reachable only through the keyctl(2) syscall (KEYCTL_PKEY_ENCRYPT, KEYCTL_PKEY_DECRYPT, or KEYCTL_PKEY_SIGN); there is no network, adjacent, or physical attack path to the affected code.\nAC:L - An attacker fully controls the undersized out_len parameter and can reliably trigger the bug on demand with no races or victim-dependent state; CONFIG_ASYMMETRIC_KEY_TYPE is commonly enabled on server and desktop kernels.\nPR:L - Exploitation requires KEY_NEED_SEARCH on an asymmetric key, which any unprivileged local user can satisfy by loading their own RSA/EC key into a session keyring; no real root or init-namespace capabilities are needed.\nUI:N - Exploitation requires only attacker-initiated keyctl calls and does not depend on any victim user action such as opening a file or mounting a filesystem.\nS:U - Impact is confined to kernel heap memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - When out_len is smaller than the cryptographic output (including out_len=0 where kmalloc(0) yields ZERO_SIZE_PTR), asym_eds_op returns the full primitive output size and copy_to_user reads far beyond the allocated buffer, leaking adjacent kernel heap contents to userspace.\nI:H - The undersized kmalloc buffer is passed directly as the crypto output target; asymmetric operations can write up to the primitive maximum (hundreds of bytes for RSA-4096) past the allocation, enabling heap corruption and potential control-flow hijacking.\nA:H - Heap out-of-bounds read/write against kmalloc objects or writes through ZERO_SIZE_PTR can cause kernel oops, panic, or KASAN-detected corruption, satisfying high availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63824","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63829","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires sending RTM_NEWLINK changelink requests over rtnetlink (netlink socket), matching the kernel guidance that tc/netlink configuration paths are Local.\nAC:L - Once a cross-namespace GRE/ERSPAN device is present in the caller's netns, triggering the bug is a single deterministic netlink changelink with no races or attacker-uncontrollable timing.\nPR:L - The rtnl entry path requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user can obtain inside a user namespace via unshare --user --map-root-user --net without real init-namespace root.\nUI:N - Exploitation is fully programmatic through netlink; no victim user action such as opening a file or mounting a filesystem is required.\nS:C - The changelink mutates tunnel state in t->net while authorization is checked only against dev_net(dev), crossing from the attacker's net/user namespace into another tenant's or the host's network namespace tunnel tables.\nC:H - An attacker can rewrite IFLA_GRE_REMOTE/LOCAL, keys, and related tunnel parameters to redirect GRE/ERSPAN traffic through attacker-controlled endpoints and read tunneled payloads.\nI:H - Unauthorized changelink updates live tunnel fields (including collect_md and encap parameters parsed before the missing check), enabling arbitrary redirection or injection of traffic in the victim link netns.\nA:H - Rewriting tunnel endpoints, keys, or metadata handling can break production GRE/ERSPAN overlays and VPN paths, causing sustained loss of connectivity for dependent services."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63829","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63884","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through local DRM ioctls on the Intel GPU render node (notably I915_GEM_EXECBUFFER2 and I915_GEM_MADVISE); there is no network, adjacent-radio, or physical-access entry path.\nAC:L - An attacker controls the triggering workload (concurrent execbuffers, madvise DONTNEED, and GPU memory pressure to force eviction), and the UAF is a deterministic stale-pointer bug rather than a race against uncontrollable system state.\nPR:L - Exploitation requires only access to the DRM render node and standard unprivileged GEM ioctls (DRM_RENDER_ALLOW); no CAP_SYS_ADMIN, DRM master, or init-namespace root is needed.\nUI:N - No victim interaction is required beyond the attacker (or a compromised local GPU client) issuing its own ioctl submissions to the render node.\nS:U - Successful exploitation yields kernel memory corruption and local privilege escalation within the same kernel security authority; it does not constitute a VM escape or IOMMU/DMA boundary bypass.\nC:H - This is a kernel heap use-after-free on a freed i915_ttm_tt structure; attacker-controlled reuse of the freed object can provide arbitrary kernel memory read primitives.\nI:H - UAF on the i915_ttm_tt/filp path enables heap grooming and corrupting kernel objects, providing a standard path to arbitrary kernel write and code execution.\nA:H - The vulnerability was observed causing a kernel general protection fault/oops under real workloads, and UAF in this path can reliably crash or hang the system even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63884","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63893","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:A - A malicious Thunderbolt XDomain peer (adjacent host, dock, or in-line device on a direct Thunderbolt/USB4 link) delivers crafted PROPERTIES_RESPONSE data that the victim kernel parses during automatic XDomain discovery.\nAC:L - The peer fully controls property entry value/length fields and can reliably craft the u32 wrap (e.g. value=0xffffff00, length=0x100) without races or special memory layout.\nPR:N - Exploitation requires no privileges on the victim system; the attacker only needs to be the connected XDomain peer responding to the kernel-initiated property exchange, with no authentication on that control-plane path.\nUI:N - Once a Thunderbolt XDomain link exists, property fetching and parsing run automatically in the kernel handshake state machine without any additional victim user action at exploitation time.\nS:U - Impact is confined to the victim kernel/userspace boundary (kernel heap disclosure to local sysfs and possible kernel crash); it does not cross VM, IOMMU, or sandbox security boundaries.\nC:H - Integer-wrap bypass enables an out-of-bounds kernel memory read of up to entry->length dwords, which for deviceid/vendorid TEXT properties is copied into world-readable sysfs attributes, disclosing kernel heap contents.\nI:N - The bug is an out-of-bounds read via parse_dwdata(); destination buffers are properly sized kcalloc allocations, so there is no out-of-bounds write or integrity modification of victim kernel structures.\nA:H - Reading from block+0xffffff00 dwords (~4 GB past the allocation) will access unmapped kernel addresses, causing a kernel fault/oops/panic in addition to any information disclosure."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63893","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63912","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the ESP outbound encryption path reached when IPsec-protected traffic is sent through xfrm (e.g., from an internet-facing VPN/tunnel gateway encrypting responses or forwarded flows to a remote peer). A network peer can influence outbound skb fragment sizes to hit the vulnerable fast path without local shell access.\nAC:L - An attacker can reliably craft payload sizes so ALIGN(skb->data_len) and ALIGN(tailen) each pass the broken per-field PAGE_SIZE gate while their combined aligned length exceeds PAGE_SIZE, repeatedly probing until the out-of-place page-frag path is taken.\nPR:N - Exploitation does not require configuring xfrm or host admin rights; it only needs the target to already run ESP and the attacker to send traffic that is encrypted on output (e.g., as a remote VPN/site-to-site peer), which is network-layer access rather than local OS privilege.\nUI:N - Triggering the vulnerable ESP output path requires only attacker-controlled network traffic and does not depend on any victim user action such as mounting a filesystem or opening a file.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU bypass.\nC:H - The flaw is a heap out-of-bounds write during AEAD encryption over an undersized page frag; such memory corruption can expose adjacent kernel objects and be leveraged for arbitrary memory disclosure, not merely a bounded leak.\nI:H - Writing past the allocated page-frag buffer corrupts adjacent heap memory and can be developed into arbitrary write or control-flow hijack primitives, matching kernel guidance for out-of-bounds writes.\nA:H - Corrupting kernel heap memory during crypto output can cause immediate kernel oops/panic or persistent instability, and repeated triggering can deny service on VPN gateways and other IPsec endpoints."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63912","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63917","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through rtnetlink configuration (RTM_NEWLINK changelink and RTM_SETLINK netns move via `ip link`), not through remote packet handling on the vti6 tunnel itself.\nAC:L - Exploitation is a deterministic, attacker-controlled sequence (create vti6, move netns, changelink, delete netns) with no races or external victim state required.\nPR:L - The fix commit and rtnetlink path confirm reachability with CAP_NET_ADMIN inside an unprivileged user+network namespace (`unshare --user --map-root-user --net`), not init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug entirely through their own netlink operations.\nS:C - On container hosts, an unprivileged tenant can corrupt namespace teardown and panic the host kernel, impacting resources outside the attacker's security scope (other tenants and the host).\nC:H - The stale per-netns hash leaves `cleanup_net()`/`vti6_exit_rtnl_net()` walking freed `ip6_tnl` list nodes, constituting a use-after-free with arbitrary kernel memory read potential.\nI:H - Cross-netns hash corruption can leave dangling pointers and drive `unregister_netdevice_queue()` on already-freed devices (kernel BUG at net/core/dev.c:12376), enabling memory corruption exploitable for control-flow hijacking.\nA:H - The published reproducer reliably triggers a kernel BUG during namespace cleanup, causing host-wide denial of service via kernel panic/oops."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63917","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63919","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable path is reached when IPsec ESP/AH packets are received and processed through xfrm_input transport-mode reinjection, which is a network packet receive path in net/xfrm. Remote peers can send ESP traffic to trigger deferred queueing on systems with IPsec configured.\nAC:L - The attacker controls both sides of the race by flooding IPsec packets to queue deferred reinjection work while concurrently destroying the network namespace, making the UAF reliably triggerable without conditions outside attacker control.\nPR:L - Exploitation requires configuring xfrm/IPsec and managing network namespace lifecycle, both reachable with CAP_NET_ADMIN obtainable by an unprivileged user via user namespaces (unshare -Urn), not requiring real root in the init namespace.\nUI:N - No victim user interaction is required; exploitation is achieved through automated packet transmission and namespace teardown scripted by the attacker.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The deferred callback dereferences a freed struct net (e.g., ip6_rcv_finish_core reads sysctl fields from the UAF pointer), providing an information disclosure primitive from attacker-influenced freed slab memory.\nI:H - Use-after-free on the large struct net slab object enables heap grooming and memory corruption exploitable for arbitrary kernel writes and control-flow hijacking, not merely a bounded modification.\nA:H - Dereferencing a freed network namespace structure causes kernel oops/panic from the workqueue callback path, and UAF reliably threatens system availability even when full exploitation is not attempted."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63919","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63921","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires a local ioctl(SIOCCHGTUNNEL) on a migrated vti6 netdev via socket/dev_ioctl; the bug is in vti6_siocdevprivate(), not in remote packet reception.\nAC:L - The attacker fully controls namespace creation, tunnel migration (IFLA_NET_NS_FD), and ioctl parameters to collide with a victim tunnel; the commit documents a deterministic, reproducible sequence with no uncontrollable race.\nPR:L - Only CAP_NET_ADMIN in the migrated (attacker) network namespace is required, obtainable via unprivileged user namespaces (unshare --user --map-root-user --net); the missing check against the creation namespace's user_ns is the core flaw.\nUI:N - No victim interaction is needed; the attacker performs all setup steps (create/migrate tunnel, issue SIOCCHGTUNNEL) autonomously.\nS:C - The attack hijacks IPsec/XFRM traffic destined for tunnels in a different tenant's network namespace on container hosts, crossing container/tenant security boundaries rather than staying within the attacker's own scope.\nC:H - After hash poisoning, xfrm receive delivers matched/decapsulated packets to the attacker-controlled netdev, enabling interception of victim VPN/IPsec traffic including potentially sensitive plaintext after decryption.\nI:H - The attacker gains control over which netdev receives victim tunnel traffic and can read, drop, or forward/modify decapsulated packets, constituting unauthorized manipulation of another tenant's network data path.\nA:H - Hijacking the creation-namespace hash bucket causes the legitimate victim tunnel to stop receiving matched traffic, producing denial of service to the victim's IPsec connectivity."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63921","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63922","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached on the standard IPv6 input path (ipv6_rcv → ip6_input → ip6_protocol_deliver_rcu → ipv6_destopt_rcv) when a remotely sent IPv6 packet carries a Destination Options header processed by ip6_parse_tlv().\nAC:L - The attacker fully controls the crafted IPv6 Destination Options layout (HAO TLV followed by trailing TLVs/padding); once CONFIG_IPV6_MIP6 and matching XFRM state exist on the target, triggering the stale-pointer condition is a reliable single-packet attack without races or victim-specific timing.\nPR:N - No local privileges or authentication are required; any remote host that can deliver IPv6 traffic to a listening interface can reach this pre-authentication receive-path parser (destopt_protocol uses INET6_PROTO_NOPOLICY).\nUI:N - Exploitation requires only sending a malicious IPv6 packet; no victim interaction such as opening files, clicking links, or mounting filesystems is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the kernel’s security authority; it does not cross VM, container, or IOMMU boundaries.\nC:H - After pskb_expand_head() frees the old skb head, ip6_parse_tlv() continues parsing trailing TLVs through the stale nh pointer, causing out-of-bounds/use-after-free reads of kernel heap memory that can disclose sensitive kernel data.\nI:H - Use-after-free of the skb head buffer during TLV parsing is heap memory corruption that can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a bounded parse error.\nA:H - Reading through the stale network-header pointer into freed or invalid memory can cause kernel oops/panic or unrecoverable instability, satisfying high availability impact even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63922","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63924","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in the IPv6 input path (ipv6_rcv → ip6_rcv_core → ipv6_parse_hopopts) triggered by a crafted IPv6 packet with hop-by-hop options containing a Jumbo Payload TLV, reachable from any remote peer that can deliver IPv6 to the host.\nAC:L - An attacker fully controls the crafted IPv6 packet (HBH layout, jumbo length, trailing TLVs) and can send it repeatedly; once the skb is cloned/shared during receive and pskb_trim_rcsum reallocates the head, the stale-pointer UAF is deterministically triggered without races or victim-specific state.\nPR:N - No authentication or local privileges are required; any unauthenticated remote host that can send IPv6 traffic to a listening interface reaches the vulnerable receive handler with no capability or namespace checks along the path.\nUI:N - Exploitation requires only delivery of a malicious IPv6 packet and does not depend on any victim user action such as opening files, clicking links, or mounting filesystems.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross a VM, container, or IOMMU boundary by itself.\nC:H - Continued HBH TLV parsing through the stale nh pointer is a use-after-free read of freed skb head memory, which per kernel guidance enables arbitrary kernel memory disclosure when the freed slab is reused.\nI:H - Stale-pointer UAF during TLV length/type parsing can yield unbounded out-of-bounds reads and corrupt subsequent parsing state, providing memory corruption primitives that can be developed into arbitrary kernel writes or code execution.\nA:H - Dereferencing the freed network-header pointer during TLV parsing can cause immediate kernel oops/panic from invalid memory access, and UAF-triggered parsing errors reliably drop or crash the receive path."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63924","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63946","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when the kernel processes inbound Bluetooth LE ISO data (HCI_ISODATA_PKT) from a remote peer over the radio; per kernel guidance Bluetooth is Adjacent, not Network.\nAC:L - An attacker can reliably win the race by flooding ISO frames while concurrently closing the ISO socket (or inducing disconnect that triggers stack teardown), controlling both the receive path and the iso_sock_kill() teardown path.\nPR:N - Exploitation requires only an established ISO connection with a malicious adjacent Bluetooth device; the vulnerable receive path needs no local privileges, and socket teardown can occur automatically when the remote peer disconnects.\nUI:N - No victim interaction is required during exploitation; ISO socket closure on disconnect is handled automatically by the Bluetooth stack and userspace daemons without user action.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The use-after-free dereferences freed struct sock memory (sk->sk_state) after iso_sock_kill() can sock_put() the socket, enabling arbitrary kernel memory read primitives via heap reuse.\nI:H - The UAF continues into sock_queue_rcv_skb() on the freed socket, corrupting socket receive-queue state and enabling heap-based write/control-flow hijack primitives typical of kernel UAF bugs.\nA:H - Use-after-free on struct sock during receive processing can cause kernel oops/panic from invalid memory access, and UAF bugs in the kernel are rated High availability impact even when not fully weaponized."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63946","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63952","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls (memfd_create, mmap, fcntl) with no network-facing code path; the vulnerable logic is reached only through the local fcntl(F_ADD_SEALS) interface on a memfd file descriptor.\nAC:L - The attack is a reliable, deterministic syscall sequence (create executable memfd, establish a writable MAP_SHARED mapping, then apply F_SEAL_EXEC) with no race or attacker-uncontrollable conditions.\nPR:L - Any unprivileged local user can invoke memfd_create, mmap, and fcntl without capabilities; these interfaces are available inside unprivileged user namespaces with no real-root requirement.\nUI:N - Exploitation does not require a human victim action; in the highest-impact scenario a sandboxed process programmatically passes the sealed-appearing memfd to a trusting peer via IPC (e.g., SCM_RIGHTS) without user interaction.\nS:C - The bug breaks the memfd seal security contract designed for mutually untrusted parties, allowing a malicious local peer to deceive a separate process that relies on F_SEAL_WRITE immutability, crossing the inter-process trust boundary (sandbox/W^X enforcement).\nC:H - Bypassing write-seal/W^X guarantees enables arbitrary modification of executable memfd contents presented as immutable, which can be leveraged for arbitrary code execution in a trusting victim process and thereby full read of that process's memory.\nI:H - The vulnerability allows arbitrary modification of memory that is advertised as write-sealed (F_SEAL_WRITE), defeating the kernel's immutability guarantee and enabling W^X bypass and code injection into trusted execution contexts.\nA:N - The flaw is a logic error in seal enforcement that does not cause kernel crashes, panics, hangs, or denial of service; exploitation maintains availability while subverting integrity guarantees."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63952","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63968","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable function is reached from the IPv6 packet receive path (ipv6_rcv → ip6_route_input → ip6_pol_route → fib6_select_path) in softirq context, and production lockups were observed during processing of incoming IPv6 traffic on internet-facing edge routers.\nAC:L - The race is reliably triggerable when an attacker influences both packet flow and route churn (e.g., user-namespace ECMP setup plus traffic, or remote traffic coinciding with BGP nexthop updates); a dedicated selftest reproduces soft lockups in under a minute under controlled conditions.\nPR:N - Triggering fib6_select_path() during packet processing requires only the ability to send IPv6 traffic to destinations using multipath routes; concurrent route-table updates can occur from infrastructure (BGP/dynamic routing) without the attacker holding any local privileges.\nUI:N - Exploitation requires no victim interaction beyond normal network traffic delivery to a host or router processing IPv6 packets.\nS:U - The impact is kernel CPU soft lockup and watchdog panic within the same kernel security boundary; there is no sandbox, VM, or IOMMU boundary crossing.\nC:N - The bug is an infinite loop over stale sibling-list pointers during RCU read-side traversal; it does not read or disclose attacker-controlled memory or kernel secrets.\nI:N - No data modification or memory corruption occurs; the failure mode is CPU hang from unbounded list iteration, not arbitrary write or code execution.\nA:H - The infinite loop in softirq context causes CPU soft lockup, and documented production and test cases show this leads to watchdog-triggered kernel panic, a complete loss of system availability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63968","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63971","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local syscalls on an SCTP socket (`sendmsg`/`sendto` to trigger `sctp_wait_for_connect`, and `getsockopt(SCTP_SOCKOPT_PEELOFF)` to peel off the association). A remote peer can only help complete the SCTP handshake; it cannot invoke peeloff or the racing send path.\nAC:L - The attacker controls both sides of the race by running concurrent threads on the same SCTP one-to-many socket, timing peeloff during the window where `sctp_wait_for_connect()` has released the socket lock. Required options (`SCTP_FRAGMENT_INTERLEAVE`, `SCTP_INTERLEAVING_SUPPORTED`, and `net.sctp.intl_enable`) are attacker-settable in a user/net namespace.\nPR:L - No real-root capability is required; an unprivileged user can create SCTP sockets and drive the full race from a user namespace (`unshare -Urn`), including enabling `net.sctp.intl_enable` and the interleaving socket options needed to reach the vulnerable `sctp_sendmsg_to_asoc()` path.\nUI:N - Exploitation is fully attacker-driven through coordinated local threads and does not require any action from a victim user or administrator beyond normal SCTP socket use.\nS:U - Impact is confined to kernel memory integrity/availability within the same security authority; successful exploitation would be local privilege escalation, not a cross-boundary escape such as VM or container breakout by itself.\nC:H - After peeloff migrates `asoc->base.sk`, the caller continues in `sctp_datamsg_from_user()` while holding the wrong socket lock, creating unsynchronized concurrent access to association/stream state that can corrupt kernel heap metadata and be leveraged for arbitrary kernel memory disclosure.\nI:H - The post-race path builds and queues DATA/I-DATA chunks via `sctp_datamsg_from_user()` and `sctp_primitive_SEND()` without the correct socket lock, enabling concurrent modification of association output queues and stream structures that can be turned into arbitrary kernel writes or control-flow hijacking.\nA:H - Concurrent unsynchronized access to a live SCTP association after peeloff can cause kernel oops/panic or wedged associations, and the underlying race is a classic kernel concurrency defect with high availability impact even before full exploitation."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63971","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63975","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when a remote Bluetooth LE peer sends a crafted L2CAP_ECRED_CONN_RSP on the LE signaling channel, processed via hci_recv_frame → l2cap_recv_acldata → l2cap_le_sig_channel → l2cap_ecred_conn_rsp. Bluetooth is Adjacent per kernel CVSS guidance.\nAC:L - An adjacent attacker who establishes a BLE ACL link can reliably trigger this by first creating an L2CAP channel with a chosen DCID (via ECRED_CONN_REQ SCIDs) and then sending a connection response reusing that DCID for a pending outgoing ECRED connection; no race or rare layout is required.\nPR:N - Exploitation requires only the ability to act as a remote Bluetooth peer on an established ACL connection; no local shell access, capabilities, or root on the victim system is needed.\nUI:N - The malicious signaling traffic is delivered entirely by the remote attacker once a BLE link exists; no additional victim-side file open, mount, or application action beyond normal Bluetooth connectivity is required to reach the vulnerable handler.\nS:U - The failure is a kernel L2CAP channel-list use-after-free and crash within the Bluetooth stack on the victim host; it does not cross a VM, container, or IOMMU security boundary.\nC:H - Calling l2cap_chan_del() on the original channel during list_for_each_entry_safe can free the saved tmp list node, causing a use-after-free on struct l2cap_chan when iteration continues; UAF is scored as High confidentiality impact.\nI:H - The same iterator invalidation frees and later dereferences l2cap_chan objects under attacker-influenced connection state, providing a heap UAF primitive that can be groomed toward arbitrary memory corruption and code execution.\nA:H - The bug reliably produces kernel list corruption and use-after-free in softirq/context Bluetooth receive path, leading to kernel oops or panic and denial of service on phones, laptops, and embedded devices with Bluetooth enabled."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63975","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63984","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The vulnerable code runs in the IPv6 routing-header receive handler on incoming packets; a remote attacker can deliver a crafted RFC 6554 type-3 RPL SRH to an RPL-enabled router or gateway over the network.\nAC:L - Triggering requires only a deterministically crafted SRH (e.g., n=127, CmprI=15, CmprE=15, pad=0, hdrlen=16, segments_left>0); all of these fields are fully attacker-controlled once the target has rpl_seg_enabled.\nPR:N - No authentication or local privileges are needed to send the malicious IPv6 packet; rpl_seg_enabled is a victim-side deployment setting on RPL routers/gateways (IoT/industrial mesh), not an attacker privilege requirement.\nUI:N - Exploitation is achieved solely by sending a malformed network packet and does not require any action from a victim user.\nS:U - Impact is confined to kernel memory corruption and packet forwarding within the same kernel security boundary; this is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The hdrlen truncation causes overlapping read/write of the same kmalloc buffer during decompress/recompress, constituting kernel heap memory corruption that can be leveraged for information disclosure primitives.\nI:H - ipv6_rpl_srh_compress() performs out-of-bounds writes into the overlapping decompressed region, corrupting routing-header data that is then memcpy'd into the forwarded skb, enabling memory corruption exploitable for control-flow or data modification.\nA:H - Kernel heap corruption during SRH processing can cause kernel oops, panics, or repeated crashes when processing or forwarding the corrupted packet, consistent with high availability impact for memory-corruption bugs."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63984","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-63994","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached when remotely injected VXLAN/GENEVE UDP packets traverse a bridged/OVS overlay and fail PMTU checks during encapsulation transmit, the same network path previously demonstrated in CVE-2023-53600 via vxlan_xmit through bridge forwarding.\nAC:L - An attacker can reliably send oversized DF-marked inner IP packets over the overlay to force PMTU ICMP generation, and can influence skb_cow() reallocation through bridge flooding/multicast cloning or headroom pressure; no uncontrollable victim state is required.\nPR:N - Exploitation requires no privileges on the victim host; any remote entity that can send VXLAN/GENEVE traffic to a VTEP with a bridged tunnel interface (standard cloud/SDN deployment) can reach the vulnerable code without authentication.\nUI:N - Triggering is fully automatic during kernel packet forwarding and tunnel encapsulation; no victim user action is needed beyond normal network operation of an overlay endpoint.\nS:U - Impact is confined to kernel memory on the affected host (UAF read/crash/potential escalation); it does not inherently cross VM, container, or IOMMU security boundaries.\nC:H - Stale ip_hdr/ipv6_hdr pointers cause reads from freed slab memory; leaked values are incorporated into ICMP error IP headers that are sent back to the attacker, constituting arbitrary kernel heap content disclosure.\nI:H - Use-after-free on skb header memory is a heap corruption primitive that can be developed into controlled writes or code execution via heap grooming, consistent with kernel UAF severity guidance.\nA:H - Dereferencing freed skb head memory during ICMP construction can cause kernel oops/panic and denial of service, as with other confirmed bugs in this same code path."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63994","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64106","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The bug is reached only through the KVM device ioctl path (KVM_SET_DEVICE_ATTR with KVM_DEV_ARM_ITS_RESTORE_TABLES), which requires a local process with access to a VM file descriptor; it is not triggered by network packets or guest MMIO/ITS commands.\nAC:L - An attacker can reliably plant a crafted Device Table Entry in guest RAM (Size field encoding 17–32 EventID bits) and have it processed during migration/snapshot restore; no race or attacker-uncontrollable memory layout is required, and the live MAPD path already proves the invalid state is straightforward to supply.\nPR:N - The highest-impact scenario is a malicious cloud VM tenant who needs no host privileges: they write a malformed DTE directly into guest physical memory (bypassing MAPD validation) and trigger host-side restore during automated live migration or snapshot resume, without requiring /dev/kvm or root on the host.\nUI:N - Exploitation does not require victim interaction beyond normal hypervisor operations such as automated live migration or snapshot restore that the attacker can initiate as a VM tenant; no end-user action like opening a file is needed.\nS:C - The vulnerability crosses the VM security boundary because guest-controlled saved state causes the host kernel to perform an oversized ITS table scan and mass kernel allocations, impacting host availability outside the guest's security scope.\nC:H - The unchecked num_eventid_bits value inflates scan_its_table()'s range up to BIT_ULL(32)*8 bytes (and can wrap the int size parameter for values 28–31), causing the host kernel to read far beyond the valid ITT bounds through kvm_read_guest_lock across a large guest GPA span.\nI:N - The flaw causes excessive guest-memory reads and kernel object allocation but does not corrupt or write host kernel memory; there is no demonstrated arbitrary host write, use-after-free, or code-execution primitive from this bug alone.\nA:H - The oversized scan can loop for an enormous number of kvm_read_guest_lock iterations (worse when the truncated int size wraps to a huge unsigned length), and valid-looking restored ITEs can drive unbounded vgic_add_lpi/kzalloc allocations, exhausting host CPU and memory and causing severe denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64106","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64189","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable dump and resize paths are reached through local NETLINK_NETFILTER send and receive syscalls, not through remotely received packets.\nAC:L - The attacker controls both sides by issuing an ipset dump and concurrent CREATE requests that grow ip_set_list, and can repeat the race without any victim-controlled condition.\nPR:L - NFNETLINK requires CAP_NET_ADMIN in the network namespace's owning user namespace, which an unprivileged user can obtain through user and network namespaces on deployments permitting unprivileged user namespaces.\nUI:N - After obtaining local execution, the attacker can trigger both racing operations without any action by another user.\nS:U - Exploitation compromises the kernel of the same host and constitutes standard local privilege escalation rather than crossing a VM, hypervisor, or IOMMU boundary.\nC:H - Reclaiming the freed array can make the loaded struct ip_set pointer attacker-influenced, after which variant-pointer dereferences can enable kernel code execution and arbitrary memory disclosure.\nI:H - The release path performs an indirect uref callback and decrements ref_netlink through the stale pointer, providing control-flow and kernel-memory-write opportunities after heap reclamation.\nA:H - The reported use-after-free produced a general-protection fault and kernel panic, and an attacker can trigger the race repeatedly."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64189","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64530","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - On a transparent bridge or traffic-shaping gateway configured with the RED qevent and act_ct, unauthenticated remote IP fragments reach red_enqueue() through normal receive, bridge-forwarding, and egress-qdisc processing. No local netlink access is required to trigger the deployed configuration.\nAC:L - The attacker controls fragment contents and ordering and can drive RED into deterministic hard-mark or drop conditions with sustained traffic. No race or condition outside the attacker's control must be won.\nPR:N - CAP_NET_ADMIN is required to create the vulnerable configuration, but a remote attacker sending fragments through an already configured appliance needs no privileges or authentication. Local triggering is also possible with namespaced CAP_NET_ADMIN.\nUI:N - Triggering requires only attacker-generated fragmented traffic and does not depend on a victim performing any action.\nS:U - The corruption occurs within the host kernel and compromises resources governed by that same security authority. This remains unchanged scope even when used for namespace escape or kernel privilege escalation.\nC:H - The reclaimable sk_buff use-after-free and corrupted defragmentation-tree links can be leveraged through attacker-controlled network heap spraying to disclose arbitrary kernel memory.\nI:H - RED overwrites linkage fields that overlap the defragmentation RB node and may free the object while it remains referenced, enabling subsequent writes through freed or attacker-reclaimed kernel objects and potential code execution.\nA:H - The dangling fragment-tree entry can cause immediate or deferred use-after-free, double-free, invalid tree operations, and kernel panic when another fragment arrives or the queue expires. The attacker can trigger this repeatedly with fragmented traffic."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64530","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64560","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached purely through local syscalls (`timer_create`/`timer_settime`/`timer_delete`/`clock_nanosleep`) raced against `execve()` from a non-leader thread in the attacker's own process. No network or remote data path reaches posix-cpu-timers.\nAC:L - The attacker controls both sides of the race — one thread arms and deletes a process-wide CPU timer while a non-leader thread in the same process calls `execve()` — and can loop indefinitely with CPU pinning/thread spraying to widen the window between `pid_task()` and `lock_task_sighand()`. No condition depends on anything outside attacker control.\nPR:L - Any ordinary unprivileged local user can create and delete `CLOCK_PROCESS_CPUTIME_ID` timers; `pid_for_clock()` performs no capability check when the encoded PID is 0, and `CONFIG_POSIX_TIMERS` is `default y` on essentially all deployments.\nUI:N - The attacker performs every step — timer creation, arming, deletion, and the concurrent non-leader exec — entirely within its own multithreaded process. No victim action is involved.\nS:U - The corruption stays within the kernel's own security authority; it is a standard local kernel memory-corruption/privilege-escalation primitive with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The stale timerqueue node yields UAF reads of the freed `k_itimer` and causes `current` (a live `task_struct` pointer) plus rbtree pointers to be written into the freed/reallocated slot, and the freed object can be reclaimed by another attacker-created `k_itimer`, enabling kernel pointer disclosure and broad memory read.\nI:H - `collect_timerqueue()` writes into freed memory (`ctmr->firing`, `ctmr->handling`, rbtree rebalancing, list insertion) and the `do_cpu_nanosleep()` variant does so into a live, attacker-groomed kernel stack frame, followed by `cpu_timer_fire()` dereferencing attacker-controlled `it_process`/`it_signal` — a control-flow-hijack-capable write primitive.\nA:H - Even without exploitation the dangling timerqueue node produces rbtree/list corruption and a kernel oops, and the pre-fix `WARN_ON_ONCE(timerqueue_node_queued(...))` is an immediate panic under `panic_on_warn`; the race can be triggered repeatedly by any local user."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64560","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64561","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable shadow-MMU page-fault path is reached via local KVM_RUN handling of guest EPT/shadow faults (and nested EPT via paging_tmpl), not by network or adjacent-radio packets.\nAC:L - An attacker who can run nested or shadow-MMU guests controls MMU pressure (heavy nested mappings and/or KVM_SET_NR_MMU_PAGES) and concurrent faults so reclaim zaps an in-use root during make_mmu_pages_available; no attacker-uncontrollable condition is required.\nPR:L - Exploitation needs /dev/kvm access or a nested-capable guest on the host, privileges commonly available to kvm-group users or cloud tenants, not real init-namespace root or CAP_SYS_ADMIN on the create/run path.\nUI:N - Once the attacker can run the guest, they trigger reclaim and page faults entirely through their own vCPU activity with no action by another user.\nS:C - Guest-controlled faults corrupt host KVM MMU state (invalid shadow pages on active_mmu_pages and subsequent list handling), crossing the guest-to-host virtualization boundary into the host kernel authority.\nC:H - Invalid children on active_mmu_pages break zap accounting assumptions so later prepare_zap list_add on still-linked entries corrupts kernel lists, a memory-corruption primitive that can be leveraged for arbitrary host reads.\nI:H - The same active-list invariant break and linked-list corruption in host MMU teardown/reclaim paths yield writable host corruption suitable for control-flow or structure hijacking, not merely a benign accounting glitch.\nA:H - WARN_ON_ONCE skips, infinite zap loops, list corruption, and host oops/hangs are reachable when invalid shadow pages remain on active_mmu_pages, causing host and co-located VM denial of service."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64561","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64564","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:N - The bug is in SCTP ASCONF receive processing (sctp_rcv → sctp_sf_do_asconf → sctp_process_asconf → sctp_process_asconf_param); a remote peer triggers it by sending a crafted ASCONF over IP/IPv6 on an established association, matching kernel guidance that net/ stack bugs reachable via received packets are Network.\nAC:L - A single attacker-controlled ASCONF with [Address Parameter L][DEL-IP L][DEL-IP 0.0.0.0] reliably frees asconf->transport then reuses it in the same softirq; the peer fully controls multi-homing, serial, and parameter order, with no race or other condition outside attacker influence.\nPR:N - Any remote SCTP peer that completes a normal association with ADD-IP negotiated can send the ASCONF; SCTP-AUTH keys come from the handshake the peer itself performs (or addip_noauth), and no local credentials or capabilities on the target are required.\nUI:N - Exploitation requires only attacker-sent SCTP packets processed automatically in the receive/state-machine path; no victim user action such as opening a file or mounting a device is needed.\nS:U - Impact is confined to the vulnerable host kernel (sctp_transport UAF / crash or privilege escalation) and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - This is a heap use-after-free of an sctp_transport planted into primary_path/active_path after RCU-deferred free; freed-object reuse yields arbitrary kernel read primitives, scored High per UAF guidance.\nI:H - The same transport UAF enables heap spraying and write/control-flow hijacking via later dereferences of the dangling primary_path/active_path, so integrity impact is High.\nA:H - set_primary() immediately dereferences the freed transport and leaves the association with transport_count 0 and dangling path pointers, causing a reproducible kernel oops/panic on subsequent use, which is High availability impact."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64564","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-64600","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation uses local FICLONE and concurrent O_DIRECT write syscalls against an XFS filesystem.\nAC:L - The attacker controls both racing writers, can amplify the transaction-allocation window, and demonstrated exploitation typically succeeds within seconds.\nPR:L - A basic unprivileged local user needs only read access to the protected source and write access to a scratch file; no capabilities are required.\nUI:N - The attacker creates the reflink and triggers both sides of the race without any victim action.\nS:U - This is a standard local kernel-mediated privilege escalation affecting resources within the host operating system's existing security authority.\nC:H - Overwriting /etc/passwd or a readable SUID-root binary yields full root access and consequently unrestricted access to system-confidential data.\nI:H - The stale physical mapping provides attacker-controlled persistent writes into protected readable files while preserving their ownership and SUID metadata, enabling full root compromise.\nA:H - The attacker can persistently corrupt boot-critical binaries or configuration files and, after obtaining root, cause complete system unavailability."}]}],"products":[{"name":{"value":"Linux","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Linux","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64600","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A3602-1","advisory_id":"130b8b86-0b9f-4b76-b8c0-96bf6997a30c","event_types":["advisory"],"published_at":"2026-10-25T22:45:52.959384+00:00","technologies":["core-osv","kernel-64kb","kernel-default","kernel-default-base","kernel-docs","kernel-livepatch-sle15-sp6-update-30","kernel-obs-build","kernel-source","kernel-syms","kernel-zfcpdump"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T15:40:54+00:00","detail_url":"/events/71340"}]}}],"next_after":70970,"next_before":70967}