From 92e6ebb73839556ef622818ba0304914579ba715 Mon Sep 17 00:00:00 2001 From: Vulnerability Bot Date: Thu, 12 Nov 2026 01:47:57 +0100 Subject: [PATCH] NVD update 2026-11-12T00:47:51Z --- data/2022/CVE-2022-23851.json | 2 +- data/2022/CVE-2022-45899.json | 2 +- data/2022/CVE-2022-4997.json | 2 +- data/2022/CVE-2022-50617.json | 2 +- data/2022/CVE-2022-50618.json | 2 +- data/2022/CVE-2022-50619.json | 2 +- data/2022/CVE-2022-50620.json | 2 +- data/2022/CVE-2022-50621.json | 2 +- data/2022/CVE-2022-50622.json | 2 +- data/2022/CVE-2022-50624.json | 2 +- data/2022/CVE-2022-50625.json | 2 +- data/2022/CVE-2022-50626.json | 2 +- data/2022/CVE-2022-50627.json | 2 +- data/2022/CVE-2022-50628.json | 2 +- data/2022/CVE-2022-50629.json | 2 +- data/2022/CVE-2022-50631.json | 2 +- data/2022/CVE-2022-50632.json | 2 +- data/2022/CVE-2022-50633.json | 2 +- data/2022/CVE-2022-50634.json | 2 +- data/2022/CVE-2022-50739.json | 2 +- data/2025/CVE-2025-0166.json | 2 +- data/2025/CVE-2025-11395.json | 2 +- data/2025/CVE-2025-12848.json | 2 +- data/2025/CVE-2025-1837.json | 2 +- data/2025/CVE-2025-36075.json | 2 +- data/2025/CVE-2025-60679.json | 2 +- data/2025/CVE-2025-69993.json | 2 +- data/2025/CVE-2025-71453.json | 2 +- data/2026/CVE-2026-107922.json | 1 + data/2026/CVE-2026-108094.json | 2 +- data/2026/CVE-2026-119777.json | 2 +- data/2026/CVE-2026-125637.json | 1 + data/2026/CVE-2026-125712.json | 2 +- data/2026/CVE-2026-126757.json | 1 + data/2026/CVE-2026-126758.json | 1 + data/2026/CVE-2026-126759.json | 1 + data/2026/CVE-2026-126840.json | 1 + data/2026/CVE-2026-126841.json | 1 + data/2026/CVE-2026-126842.json | 1 + data/2026/CVE-2026-126843.json | 1 + data/2026/CVE-2026-126844.json | 1 + data/2026/CVE-2026-126845.json | 1 + data/2026/CVE-2026-126846.json | 1 + data/2026/CVE-2026-126847.json | 1 + data/2026/CVE-2026-126848.json | 1 + data/2026/CVE-2026-126849.json | 1 + data/2026/CVE-2026-126850.json | 1 + data/2026/CVE-2026-126851.json | 1 + data/2026/CVE-2026-126852.json | 1 + data/2026/CVE-2026-126853.json | 1 + data/2026/CVE-2026-126854.json | 1 + data/2026/CVE-2026-126855.json | 1 + data/2026/CVE-2026-126856.json | 1 + data/2026/CVE-2026-126857.json | 1 + data/2026/CVE-2026-126858.json | 1 + data/2026/CVE-2026-126859.json | 1 + data/2026/CVE-2026-126860.json | 1 + data/2026/CVE-2026-126861.json | 1 + data/2026/CVE-2026-126862.json | 1 + data/2026/CVE-2026-126863.json | 1 + data/2026/CVE-2026-126864.json | 1 + data/2026/CVE-2026-126865.json | 1 + data/2026/CVE-2026-126866.json | 1 + data/2026/CVE-2026-126867.json | 1 + data/2026/CVE-2026-126868.json | 1 + data/2026/CVE-2026-126869.json | 1 + data/2026/CVE-2026-126870.json | 1 + data/2026/CVE-2026-126871.json | 1 + data/2026/CVE-2026-126872.json | 1 + data/2026/CVE-2026-126873.json | 1 + data/2026/CVE-2026-126874.json | 1 + data/2026/CVE-2026-126875.json | 1 + data/2026/CVE-2026-126876.json | 1 + data/2026/CVE-2026-126877.json | 1 + data/2026/CVE-2026-126878.json | 1 + data/2026/CVE-2026-126879.json | 1 + data/2026/CVE-2026-126880.json | 1 + data/2026/CVE-2026-126881.json | 1 + data/2026/CVE-2026-126882.json | 1 + data/2026/CVE-2026-126883.json | 1 + data/2026/CVE-2026-126884.json | 1 + data/2026/CVE-2026-126885.json | 1 + data/2026/CVE-2026-126886.json | 1 + data/2026/CVE-2026-126887.json | 1 + data/2026/CVE-2026-126888.json | 1 + data/2026/CVE-2026-126889.json | 1 + data/2026/CVE-2026-126890.json | 1 + data/2026/CVE-2026-126891.json | 1 + data/2026/CVE-2026-126892.json | 1 + data/2026/CVE-2026-126893.json | 1 + data/2026/CVE-2026-126894.json | 1 + data/2026/CVE-2026-126895.json | 1 + data/2026/CVE-2026-126896.json | 1 + data/2026/CVE-2026-126897.json | 1 + data/2026/CVE-2026-126898.json | 1 + data/2026/CVE-2026-126899.json | 1 + data/2026/CVE-2026-126900.json | 1 + data/2026/CVE-2026-126901.json | 1 + data/2026/CVE-2026-126902.json | 1 + data/2026/CVE-2026-126903.json | 1 + data/2026/CVE-2026-126904.json | 1 + data/2026/CVE-2026-126905.json | 1 + data/2026/CVE-2026-126906.json | 1 + data/2026/CVE-2026-126907.json | 1 + data/2026/CVE-2026-126908.json | 1 + data/2026/CVE-2026-126909.json | 1 + data/2026/CVE-2026-126910.json | 1 + data/2026/CVE-2026-126911.json | 1 + data/2026/CVE-2026-126912.json | 1 + data/2026/CVE-2026-126913.json | 1 + data/2026/CVE-2026-126914.json | 1 + data/2026/CVE-2026-126915.json | 1 + data/2026/CVE-2026-126916.json | 1 + data/2026/CVE-2026-126917.json | 1 + data/2026/CVE-2026-126918.json | 1 + data/2026/CVE-2026-126919.json | 1 + data/2026/CVE-2026-126920.json | 1 + data/2026/CVE-2026-126921.json | 1 + data/2026/CVE-2026-126922.json | 1 + data/2026/CVE-2026-126932.json | 1 + data/2026/CVE-2026-126933.json | 1 + data/2026/CVE-2026-126934.json | 1 + data/2026/CVE-2026-126935.json | 1 + data/2026/CVE-2026-1660.json | 2 +- data/2026/CVE-2026-1900.json | 2 +- data/2026/CVE-2026-22560.json | 2 +- data/2026/CVE-2026-28201.json | 2 +- data/2026/CVE-2026-29080.json | 2 +- data/2026/CVE-2026-29090.json | 2 +- data/2026/CVE-2026-29199.json | 2 +- data/2026/CVE-2026-30266.json | 2 +- data/2026/CVE-2026-30269.json | 2 +- data/2026/CVE-2026-30273.json | 2 +- data/2026/CVE-2026-30452.json | 2 +- data/2026/CVE-2026-30461.json | 2 +- data/2026/CVE-2026-30530.json | 2 +- data/2026/CVE-2026-31018.json | 2 +- data/2026/CVE-2026-31019.json | 2 +- data/2026/CVE-2026-31159.json | 2 +- data/2026/CVE-2026-31164.json | 2 +- data/2026/CVE-2026-31168.json | 2 +- data/2026/CVE-2026-31169.json | 2 +- data/2026/CVE-2026-31192.json | 2 +- data/2026/CVE-2026-31417.json | 2 +- data/2026/CVE-2026-31431.json | 2 +- data/2026/CVE-2026-31432.json | 2 +- data/2026/CVE-2026-31433.json | 2 +- data/2026/CVE-2026-31434.json | 2 +- data/2026/CVE-2026-31435.json | 2 +- data/2026/CVE-2026-31436.json | 2 +- data/2026/CVE-2026-31437.json | 2 +- data/2026/CVE-2026-31438.json | 2 +- data/2026/CVE-2026-31439.json | 2 +- data/2026/CVE-2026-31440.json | 2 +- data/2026/CVE-2026-31441.json | 2 +- data/2026/CVE-2026-31442.json | 2 +- data/2026/CVE-2026-31443.json | 2 +- data/2026/CVE-2026-31444.json | 2 +- data/2026/CVE-2026-31445.json | 2 +- data/2026/CVE-2026-31446.json | 2 +- data/2026/CVE-2026-31447.json | 2 +- data/2026/CVE-2026-31448.json | 2 +- data/2026/CVE-2026-31449.json | 2 +- data/2026/CVE-2026-31450.json | 2 +- data/2026/CVE-2026-31451.json | 2 +- data/2026/CVE-2026-31452.json | 2 +- data/2026/CVE-2026-31453.json | 2 +- data/2026/CVE-2026-31454.json | 2 +- data/2026/CVE-2026-31455.json | 2 +- data/2026/CVE-2026-31456.json | 2 +- data/2026/CVE-2026-31457.json | 2 +- data/2026/CVE-2026-31458.json | 2 +- data/2026/CVE-2026-31459.json | 2 +- data/2026/CVE-2026-31460.json | 2 +- data/2026/CVE-2026-31461.json | 2 +- data/2026/CVE-2026-31462.json | 2 +- data/2026/CVE-2026-31463.json | 2 +- data/2026/CVE-2026-31464.json | 2 +- data/2026/CVE-2026-31465.json | 2 +- data/2026/CVE-2026-31466.json | 2 +- data/2026/CVE-2026-31467.json | 2 +- data/2026/CVE-2026-31468.json | 2 +- data/2026/CVE-2026-31469.json | 2 +- data/2026/CVE-2026-31470.json | 2 +- data/2026/CVE-2026-31471.json | 2 +- data/2026/CVE-2026-31472.json | 2 +- data/2026/CVE-2026-31473.json | 2 +- data/2026/CVE-2026-31474.json | 2 +- data/2026/CVE-2026-31475.json | 2 +- data/2026/CVE-2026-31476.json | 2 +- data/2026/CVE-2026-31477.json | 2 +- data/2026/CVE-2026-31478.json | 2 +- data/2026/CVE-2026-31479.json | 2 +- data/2026/CVE-2026-31480.json | 2 +- data/2026/CVE-2026-31481.json | 2 +- data/2026/CVE-2026-31482.json | 2 +- data/2026/CVE-2026-31483.json | 2 +- data/2026/CVE-2026-31484.json | 2 +- data/2026/CVE-2026-31485.json | 2 +- data/2026/CVE-2026-31486.json | 2 +- data/2026/CVE-2026-31487.json | 2 +- data/2026/CVE-2026-31488.json | 2 +- data/2026/CVE-2026-31489.json | 2 +- data/2026/CVE-2026-31490.json | 2 +- data/2026/CVE-2026-31491.json | 2 +- data/2026/CVE-2026-31492.json | 2 +- data/2026/CVE-2026-31493.json | 2 +- data/2026/CVE-2026-31494.json | 2 +- data/2026/CVE-2026-31495.json | 2 +- data/2026/CVE-2026-31496.json | 2 +- data/2026/CVE-2026-31497.json | 2 +- data/2026/CVE-2026-31498.json | 2 +- data/2026/CVE-2026-31499.json | 2 +- data/2026/CVE-2026-31500.json | 2 +- data/2026/CVE-2026-31501.json | 2 +- data/2026/CVE-2026-31502.json | 2 +- data/2026/CVE-2026-31503.json | 2 +- data/2026/CVE-2026-31504.json | 2 +- data/2026/CVE-2026-31505.json | 2 +- data/2026/CVE-2026-31506.json | 2 +- data/2026/CVE-2026-31507.json | 2 +- data/2026/CVE-2026-31508.json | 2 +- data/2026/CVE-2026-31509.json | 2 +- data/2026/CVE-2026-31510.json | 2 +- data/2026/CVE-2026-31511.json | 2 +- data/2026/CVE-2026-31512.json | 2 +- data/2026/CVE-2026-31513.json | 2 +- data/2026/CVE-2026-31514.json | 2 +- data/2026/CVE-2026-31515.json | 2 +- data/2026/CVE-2026-31516.json | 2 +- data/2026/CVE-2026-31517.json | 2 +- data/2026/CVE-2026-31518.json | 2 +- data/2026/CVE-2026-31519.json | 2 +- data/2026/CVE-2026-31520.json | 2 +- data/2026/CVE-2026-31521.json | 2 +- data/2026/CVE-2026-31522.json | 2 +- data/2026/CVE-2026-31523.json | 2 +- data/2026/CVE-2026-31524.json | 2 +- data/2026/CVE-2026-31525.json | 2 +- data/2026/CVE-2026-31526.json | 2 +- data/2026/CVE-2026-31527.json | 2 +- data/2026/CVE-2026-31528.json | 2 +- data/2026/CVE-2026-31529.json | 2 +- data/2026/CVE-2026-31530.json | 2 +- data/2026/CVE-2026-31531.json | 2 +- data/2026/CVE-2026-31532.json | 2 +- data/2026/CVE-2026-31533.json | 2 +- data/2026/CVE-2026-31535.json | 2 +- data/2026/CVE-2026-31536.json | 2 +- data/2026/CVE-2026-31537.json | 2 +- data/2026/CVE-2026-31538.json | 2 +- data/2026/CVE-2026-31539.json | 2 +- data/2026/CVE-2026-31540.json | 2 +- data/2026/CVE-2026-31541.json | 2 +- data/2026/CVE-2026-31542.json | 2 +- data/2026/CVE-2026-31543.json | 2 +- data/2026/CVE-2026-31544.json | 2 +- data/2026/CVE-2026-31545.json | 2 +- data/2026/CVE-2026-31546.json | 2 +- data/2026/CVE-2026-31547.json | 2 +- data/2026/CVE-2026-31548.json | 2 +- data/2026/CVE-2026-31549.json | 2 +- data/2026/CVE-2026-31550.json | 2 +- data/2026/CVE-2026-31551.json | 2 +- data/2026/CVE-2026-31552.json | 2 +- data/2026/CVE-2026-31553.json | 2 +- data/2026/CVE-2026-31554.json | 2 +- data/2026/CVE-2026-31555.json | 2 +- data/2026/CVE-2026-31557.json | 2 +- data/2026/CVE-2026-31558.json | 2 +- data/2026/CVE-2026-31559.json | 2 +- data/2026/CVE-2026-31560.json | 2 +- data/2026/CVE-2026-31561.json | 2 +- data/2026/CVE-2026-31562.json | 2 +- data/2026/CVE-2026-31563.json | 2 +- data/2026/CVE-2026-31564.json | 2 +- data/2026/CVE-2026-31565.json | 2 +- data/2026/CVE-2026-31566.json | 2 +- data/2026/CVE-2026-31567.json | 2 +- data/2026/CVE-2026-31568.json | 2 +- data/2026/CVE-2026-31569.json | 2 +- data/2026/CVE-2026-31570.json | 2 +- data/2026/CVE-2026-31571.json | 2 +- data/2026/CVE-2026-31572.json | 2 +- data/2026/CVE-2026-31573.json | 2 +- data/2026/CVE-2026-31574.json | 2 +- data/2026/CVE-2026-31575.json | 2 +- data/2026/CVE-2026-31576.json | 2 +- data/2026/CVE-2026-31577.json | 2 +- data/2026/CVE-2026-31578.json | 2 +- data/2026/CVE-2026-31579.json | 2 +- data/2026/CVE-2026-31580.json | 2 +- data/2026/CVE-2026-31581.json | 2 +- data/2026/CVE-2026-31582.json | 2 +- data/2026/CVE-2026-31583.json | 2 +- data/2026/CVE-2026-31584.json | 2 +- data/2026/CVE-2026-31585.json | 2 +- data/2026/CVE-2026-31586.json | 2 +- data/2026/CVE-2026-31587.json | 2 +- data/2026/CVE-2026-31588.json | 2 +- data/2026/CVE-2026-31589.json | 2 +- data/2026/CVE-2026-31590.json | 2 +- data/2026/CVE-2026-31591.json | 2 +- data/2026/CVE-2026-31592.json | 2 +- data/2026/CVE-2026-31593.json | 2 +- data/2026/CVE-2026-31594.json | 2 +- data/2026/CVE-2026-31595.json | 2 +- data/2026/CVE-2026-31596.json | 2 +- data/2026/CVE-2026-31597.json | 2 +- data/2026/CVE-2026-31598.json | 2 +- data/2026/CVE-2026-31599.json | 2 +- data/2026/CVE-2026-31600.json | 2 +- data/2026/CVE-2026-31601.json | 2 +- data/2026/CVE-2026-31602.json | 2 +- data/2026/CVE-2026-31603.json | 2 +- data/2026/CVE-2026-31604.json | 2 +- data/2026/CVE-2026-31605.json | 2 +- data/2026/CVE-2026-31606.json | 2 +- data/2026/CVE-2026-31607.json | 2 +- data/2026/CVE-2026-31608.json | 2 +- data/2026/CVE-2026-31609.json | 2 +- data/2026/CVE-2026-31610.json | 2 +- data/2026/CVE-2026-31611.json | 2 +- data/2026/CVE-2026-31612.json | 2 +- data/2026/CVE-2026-31613.json | 2 +- data/2026/CVE-2026-31614.json | 2 +- data/2026/CVE-2026-31615.json | 2 +- data/2026/CVE-2026-31616.json | 2 +- data/2026/CVE-2026-31617.json | 2 +- data/2026/CVE-2026-31618.json | 2 +- data/2026/CVE-2026-31619.json | 2 +- data/2026/CVE-2026-31620.json | 2 +- data/2026/CVE-2026-31621.json | 2 +- data/2026/CVE-2026-31622.json | 2 +- data/2026/CVE-2026-31623.json | 2 +- data/2026/CVE-2026-31624.json | 2 +- data/2026/CVE-2026-31625.json | 2 +- data/2026/CVE-2026-31626.json | 2 +- data/2026/CVE-2026-31627.json | 2 +- data/2026/CVE-2026-31628.json | 2 +- data/2026/CVE-2026-31629.json | 2 +- data/2026/CVE-2026-31630.json | 2 +- data/2026/CVE-2026-31631.json | 2 +- data/2026/CVE-2026-31632.json | 2 +- data/2026/CVE-2026-31633.json | 2 +- data/2026/CVE-2026-31634.json | 2 +- data/2026/CVE-2026-31635.json | 2 +- data/2026/CVE-2026-31636.json | 2 +- data/2026/CVE-2026-31637.json | 2 +- data/2026/CVE-2026-31638.json | 2 +- data/2026/CVE-2026-31639.json | 2 +- data/2026/CVE-2026-31640.json | 2 +- data/2026/CVE-2026-31641.json | 2 +- data/2026/CVE-2026-31642.json | 2 +- data/2026/CVE-2026-31643.json | 2 +- data/2026/CVE-2026-31644.json | 2 +- data/2026/CVE-2026-31645.json | 2 +- data/2026/CVE-2026-31646.json | 2 +- data/2026/CVE-2026-31647.json | 2 +- data/2026/CVE-2026-31648.json | 2 +- data/2026/CVE-2026-31649.json | 2 +- data/2026/CVE-2026-31650.json | 2 +- data/2026/CVE-2026-31651.json | 2 +- data/2026/CVE-2026-31652.json | 2 +- data/2026/CVE-2026-31653.json | 2 +- data/2026/CVE-2026-31654.json | 2 +- data/2026/CVE-2026-31655.json | 2 +- data/2026/CVE-2026-31656.json | 2 +- data/2026/CVE-2026-31657.json | 2 +- data/2026/CVE-2026-31658.json | 2 +- data/2026/CVE-2026-31659.json | 2 +- data/2026/CVE-2026-31660.json | 2 +- data/2026/CVE-2026-31661.json | 2 +- data/2026/CVE-2026-31662.json | 2 +- data/2026/CVE-2026-31663.json | 2 +- data/2026/CVE-2026-31664.json | 2 +- data/2026/CVE-2026-31665.json | 2 +- data/2026/CVE-2026-31666.json | 2 +- data/2026/CVE-2026-31667.json | 2 +- data/2026/CVE-2026-31668.json | 2 +- data/2026/CVE-2026-31669.json | 2 +- data/2026/CVE-2026-31670.json | 2 +- data/2026/CVE-2026-31671.json | 2 +- data/2026/CVE-2026-31672.json | 2 +- data/2026/CVE-2026-31673.json | 2 +- data/2026/CVE-2026-31674.json | 2 +- data/2026/CVE-2026-31675.json | 2 +- data/2026/CVE-2026-31676.json | 2 +- data/2026/CVE-2026-31677.json | 2 +- data/2026/CVE-2026-31678.json | 2 +- data/2026/CVE-2026-31679.json | 2 +- data/2026/CVE-2026-31680.json | 2 +- data/2026/CVE-2026-31681.json | 2 +- data/2026/CVE-2026-31682.json | 2 +- data/2026/CVE-2026-31683.json | 2 +- data/2026/CVE-2026-31684.json | 2 +- data/2026/CVE-2026-31685.json | 2 +- data/2026/CVE-2026-31686.json | 2 +- data/2026/CVE-2026-31687.json | 2 +- data/2026/CVE-2026-31689.json | 2 +- data/2026/CVE-2026-31690.json | 2 +- data/2026/CVE-2026-31691.json | 2 +- data/2026/CVE-2026-31783.json | 2 +- data/2026/CVE-2026-31784.json | 2 +- data/2026/CVE-2026-31785.json | 2 +- data/2026/CVE-2026-32135.json | 2 +- data/2026/CVE-2026-32241.json | 2 +- data/2026/CVE-2026-3254.json | 2 +- data/2026/CVE-2026-32604.json | 2 +- data/2026/CVE-2026-32613.json | 2 +- data/2026/CVE-2026-32885.json | 2 +- data/2026/CVE-2026-33076.json | 2 +- data/2026/CVE-2026-33077.json | 2 +- data/2026/CVE-2026-33078.json | 2 +- data/2026/CVE-2026-33208.json | 2 +- data/2026/CVE-2026-33431.json | 2 +- data/2026/CVE-2026-33432.json | 2 +- data/2026/CVE-2026-33587.json | 2 +- data/2026/CVE-2026-33588.json | 2 +- data/2026/CVE-2026-33589.json | 2 +- data/2026/CVE-2026-33656.json | 2 +- data/2026/CVE-2026-33733.json | 2 +- data/2026/CVE-2026-33900.json | 2 +- data/2026/CVE-2026-34447.json | 2 +- data/2026/CVE-2026-34873.json | 2 +- data/2026/CVE-2026-35206.json | 2 +- data/2026/CVE-2026-35405.json | 2 +- data/2026/CVE-2026-35526.json | 2 +- data/2026/CVE-2026-35548.json | 2 +- data/2026/CVE-2026-35620.json | 2 +- data/2026/CVE-2026-35624.json | 2 +- data/2026/CVE-2026-35626.json | 2 +- data/2026/CVE-2026-35629.json | 2 +- data/2026/CVE-2026-35633.json | 2 +- data/2026/CVE-2026-35640.json | 2 +- data/2026/CVE-2026-35644.json | 2 +- data/2026/CVE-2026-35648.json | 2 +- data/2026/CVE-2026-35659.json | 2 +- data/2026/CVE-2026-35666.json | 2 +- data/2026/CVE-2026-35668.json | 2 +- data/2026/CVE-2026-3590.json | 2 +- data/2026/CVE-2026-36235.json | 2 +- data/2026/CVE-2026-3673.json | 2 +- data/2026/CVE-2026-3690.json | 2 +- data/2026/CVE-2026-37457.json | 2 +- data/2026/CVE-2026-37458.json | 2 +- data/2026/CVE-2026-37503.json | 2 +- data/2026/CVE-2026-37504.json | 2 +- data/2026/CVE-2026-37505.json | 2 +- data/2026/CVE-2026-37525.json | 2 +- data/2026/CVE-2026-37709.json | 2 +- data/2026/CVE-2026-3837.json | 2 +- data/2026/CVE-2026-38651.json | 2 +- data/2026/CVE-2026-38751.json | 2 +- data/2026/CVE-2026-38834.json | 2 +- data/2026/CVE-2026-39388.json | 2 +- data/2026/CVE-2026-39396.json | 2 +- data/2026/CVE-2026-39817.json | 2 +- data/2026/CVE-2026-39819.json | 2 +- data/2026/CVE-2026-39946.json | 2 +- data/2026/CVE-2026-40045.json | 2 +- data/2026/CVE-2026-40170.json | 2 +- data/2026/CVE-2026-40254.json | 2 +- data/2026/CVE-2026-40264.json | 2 +- data/2026/CVE-2026-40279.json | 2 +- data/2026/CVE-2026-40281.json | 2 +- data/2026/CVE-2026-40344.json | 2 +- data/2026/CVE-2026-40496.json | 2 +- data/2026/CVE-2026-40497.json | 2 +- data/2026/CVE-2026-40498.json | 2 +- data/2026/CVE-2026-40565.json | 2 +- data/2026/CVE-2026-40574.json | 2 +- data/2026/CVE-2026-40575.json | 2 +- data/2026/CVE-2026-40584.json | 2 +- data/2026/CVE-2026-40594.json | 2 +- data/2026/CVE-2026-40606.json | 2 +- data/2026/CVE-2026-40613.json | 2 +- data/2026/CVE-2026-40868.json | 2 +- data/2026/CVE-2026-40869.json | 2 +- data/2026/CVE-2026-40882.json | 2 +- data/2026/CVE-2026-40895.json | 2 +- data/2026/CVE-2026-40906.json | 2 +- data/2026/CVE-2026-40927.json | 2 +- data/2026/CVE-2026-40937.json | 2 +- data/2026/CVE-2026-41059.json | 2 +- data/2026/CVE-2026-41066.json | 2 +- data/2026/CVE-2026-41068.json | 2 +- data/2026/CVE-2026-41131.json | 2 +- data/2026/CVE-2026-41133.json | 2 +- data/2026/CVE-2026-41145.json | 2 +- data/2026/CVE-2026-41166.json | 2 +- data/2026/CVE-2026-41168.json | 2 +- data/2026/CVE-2026-41176.json | 2 +- data/2026/CVE-2026-41179.json | 2 +- data/2026/CVE-2026-41196.json | 2 +- data/2026/CVE-2026-41228.json | 2 +- data/2026/CVE-2026-41229.json | 2 +- data/2026/CVE-2026-41230.json | 2 +- data/2026/CVE-2026-41231.json | 2 +- data/2026/CVE-2026-41232.json | 2 +- data/2026/CVE-2026-41233.json | 2 +- data/2026/CVE-2026-41241.json | 2 +- data/2026/CVE-2026-41245.json | 2 +- data/2026/CVE-2026-41259.json | 2 +- data/2026/CVE-2026-41285.json | 2 +- data/2026/CVE-2026-41294.json | 2 +- data/2026/CVE-2026-41295.json | 2 +- data/2026/CVE-2026-41296.json | 2 +- data/2026/CVE-2026-41297.json | 2 +- data/2026/CVE-2026-41298.json | 2 +- data/2026/CVE-2026-41299.json | 2 +- data/2026/CVE-2026-41300.json | 2 +- data/2026/CVE-2026-41301.json | 2 +- data/2026/CVE-2026-41302.json | 2 +- data/2026/CVE-2026-41303.json | 2 +- data/2026/CVE-2026-41312.json | 2 +- data/2026/CVE-2026-41313.json | 2 +- data/2026/CVE-2026-41314.json | 2 +- data/2026/CVE-2026-41323.json | 2 +- data/2026/CVE-2026-41326.json | 2 +- data/2026/CVE-2026-41327.json | 2 +- data/2026/CVE-2026-41328.json | 2 +- data/2026/CVE-2026-41329.json | 2 +- data/2026/CVE-2026-41330.json | 2 +- data/2026/CVE-2026-41331.json | 2 +- data/2026/CVE-2026-41332.json | 2 +- data/2026/CVE-2026-41333.json | 2 +- data/2026/CVE-2026-41334.json | 2 +- data/2026/CVE-2026-41335.json | 2 +- data/2026/CVE-2026-41336.json | 2 +- data/2026/CVE-2026-41337.json | 2 +- data/2026/CVE-2026-41338.json | 2 +- data/2026/CVE-2026-41339.json | 2 +- data/2026/CVE-2026-41340.json | 2 +- data/2026/CVE-2026-41341.json | 2 +- data/2026/CVE-2026-41342.json | 2 +- data/2026/CVE-2026-41343.json | 2 +- data/2026/CVE-2026-41344.json | 2 +- data/2026/CVE-2026-41345.json | 2 +- data/2026/CVE-2026-41346.json | 2 +- data/2026/CVE-2026-41347.json | 2 +- data/2026/CVE-2026-41348.json | 2 +- data/2026/CVE-2026-41349.json | 2 +- data/2026/CVE-2026-41350.json | 2 +- data/2026/CVE-2026-41351.json | 2 +- data/2026/CVE-2026-41352.json | 2 +- data/2026/CVE-2026-41353.json | 2 +- data/2026/CVE-2026-41354.json | 2 +- data/2026/CVE-2026-41355.json | 2 +- data/2026/CVE-2026-41356.json | 2 +- data/2026/CVE-2026-41357.json | 2 +- data/2026/CVE-2026-41358.json | 2 +- data/2026/CVE-2026-41359.json | 2 +- data/2026/CVE-2026-41360.json | 2 +- data/2026/CVE-2026-41361.json | 2 +- data/2026/CVE-2026-41373.json | 2 +- data/2026/CVE-2026-41374.json | 2 +- data/2026/CVE-2026-41389.json | 2 +- data/2026/CVE-2026-41411.json | 2 +- data/2026/CVE-2026-41413.json | 2 +- data/2026/CVE-2026-41417.json | 2 +- data/2026/CVE-2026-41425.json | 2 +- data/2026/CVE-2026-41426.json | 2 +- data/2026/CVE-2026-41428.json | 2 +- data/2026/CVE-2026-41460.json | 2 +- data/2026/CVE-2026-41461.json | 2 +- data/2026/CVE-2026-41475.json | 2 +- data/2026/CVE-2026-41476.json | 2 +- data/2026/CVE-2026-41477.json | 2 +- data/2026/CVE-2026-41478.json | 2 +- data/2026/CVE-2026-41485.json | 2 +- data/2026/CVE-2026-41498.json | 2 +- data/2026/CVE-2026-41500.json | 2 +- data/2026/CVE-2026-41501.json | 2 +- data/2026/CVE-2026-41502.json | 2 +- data/2026/CVE-2026-41503.json | 2 +- data/2026/CVE-2026-41640.json | 2 +- data/2026/CVE-2026-41641.json | 2 +- data/2026/CVE-2026-41644.json | 2 +- data/2026/CVE-2026-41651.json | 2 +- data/2026/CVE-2026-41676.json | 2 +- data/2026/CVE-2026-41677.json | 2 +- data/2026/CVE-2026-41678.json | 2 +- data/2026/CVE-2026-41681.json | 2 +- data/2026/CVE-2026-41898.json | 2 +- data/2026/CVE-2026-41908.json | 2 +- data/2026/CVE-2026-41909.json | 2 +- data/2026/CVE-2026-42033.json | 2 +- data/2026/CVE-2026-42034.json | 2 +- data/2026/CVE-2026-42035.json | 2 +- data/2026/CVE-2026-42036.json | 2 +- data/2026/CVE-2026-42037.json | 2 +- data/2026/CVE-2026-42038.json | 2 +- data/2026/CVE-2026-42039.json | 2 +- data/2026/CVE-2026-42040.json | 2 +- data/2026/CVE-2026-42041.json | 2 +- data/2026/CVE-2026-42042.json | 2 +- data/2026/CVE-2026-42043.json | 2 +- data/2026/CVE-2026-42044.json | 2 +- data/2026/CVE-2026-42151.json | 2 +- data/2026/CVE-2026-42154.json | 2 +- data/2026/CVE-2026-42215.json | 2 +- data/2026/CVE-2026-42226.json | 2 +- data/2026/CVE-2026-42227.json | 2 +- data/2026/CVE-2026-42228.json | 2 +- data/2026/CVE-2026-42230.json | 2 +- data/2026/CVE-2026-42231.json | 2 +- data/2026/CVE-2026-42232.json | 2 +- data/2026/CVE-2026-42233.json | 2 +- data/2026/CVE-2026-42234.json | 2 +- data/2026/CVE-2026-42235.json | 2 +- data/2026/CVE-2026-42236.json | 2 +- data/2026/CVE-2026-42237.json | 2 +- data/2026/CVE-2026-42264.json | 2 +- data/2026/CVE-2026-42267.json | 2 +- data/2026/CVE-2026-42276.json | 2 +- data/2026/CVE-2026-42277.json | 2 +- data/2026/CVE-2026-42284.json | 2 +- data/2026/CVE-2026-42371.json | 2 +- data/2026/CVE-2026-42438.json | 2 +- data/2026/CVE-2026-42439.json | 2 +- data/2026/CVE-2026-42476.json | 2 +- data/2026/CVE-2026-42501.json | 2 +- data/2026/CVE-2026-42796.json | 2 +- data/2026/CVE-2026-43004.json | 2 +- data/2026/CVE-2026-43005.json | 2 +- data/2026/CVE-2026-43006.json | 2 +- data/2026/CVE-2026-43007.json | 2 +- data/2026/CVE-2026-43008.json | 2 +- data/2026/CVE-2026-43009.json | 2 +- data/2026/CVE-2026-43010.json | 2 +- data/2026/CVE-2026-43011.json | 2 +- data/2026/CVE-2026-43012.json | 2 +- data/2026/CVE-2026-43013.json | 2 +- data/2026/CVE-2026-43014.json | 2 +- data/2026/CVE-2026-43015.json | 2 +- data/2026/CVE-2026-43016.json | 2 +- data/2026/CVE-2026-43017.json | 2 +- data/2026/CVE-2026-43018.json | 2 +- data/2026/CVE-2026-43019.json | 2 +- data/2026/CVE-2026-43020.json | 2 +- data/2026/CVE-2026-43021.json | 2 +- data/2026/CVE-2026-43022.json | 2 +- data/2026/CVE-2026-43023.json | 2 +- data/2026/CVE-2026-43024.json | 2 +- data/2026/CVE-2026-43025.json | 2 +- data/2026/CVE-2026-43026.json | 2 +- data/2026/CVE-2026-43027.json | 2 +- data/2026/CVE-2026-43028.json | 2 +- data/2026/CVE-2026-43029.json | 2 +- data/2026/CVE-2026-43030.json | 2 +- data/2026/CVE-2026-43031.json | 2 +- data/2026/CVE-2026-43032.json | 2 +- data/2026/CVE-2026-43033.json | 2 +- data/2026/CVE-2026-43034.json | 2 +- data/2026/CVE-2026-43035.json | 2 +- data/2026/CVE-2026-43036.json | 2 +- data/2026/CVE-2026-43037.json | 2 +- data/2026/CVE-2026-43038.json | 2 +- data/2026/CVE-2026-43039.json | 2 +- data/2026/CVE-2026-43040.json | 2 +- data/2026/CVE-2026-43041.json | 2 +- data/2026/CVE-2026-43042.json | 2 +- data/2026/CVE-2026-43043.json | 2 +- data/2026/CVE-2026-43044.json | 2 +- data/2026/CVE-2026-43045.json | 2 +- data/2026/CVE-2026-43046.json | 2 +- data/2026/CVE-2026-43047.json | 2 +- data/2026/CVE-2026-43048.json | 2 +- data/2026/CVE-2026-43049.json | 2 +- data/2026/CVE-2026-43050.json | 2 +- data/2026/CVE-2026-43051.json | 2 +- data/2026/CVE-2026-43052.json | 2 +- data/2026/CVE-2026-43053.json | 2 +- data/2026/CVE-2026-43054.json | 2 +- data/2026/CVE-2026-43055.json | 2 +- data/2026/CVE-2026-43056.json | 2 +- data/2026/CVE-2026-43057.json | 2 +- data/2026/CVE-2026-43058.json | 2 +- data/2026/CVE-2026-43067.json | 2 +- data/2026/CVE-2026-43259.json | 2 +- data/2026/CVE-2026-43260.json | 2 +- data/2026/CVE-2026-43261.json | 2 +- data/2026/CVE-2026-43262.json | 2 +- data/2026/CVE-2026-43263.json | 2 +- data/2026/CVE-2026-43264.json | 2 +- data/2026/CVE-2026-43265.json | 2 +- data/2026/CVE-2026-43266.json | 2 +- data/2026/CVE-2026-43267.json | 2 +- data/2026/CVE-2026-43268.json | 2 +- data/2026/CVE-2026-43269.json | 2 +- data/2026/CVE-2026-43270.json | 2 +- data/2026/CVE-2026-43271.json | 2 +- data/2026/CVE-2026-43272.json | 2 +- data/2026/CVE-2026-43273.json | 2 +- data/2026/CVE-2026-43274.json | 2 +- data/2026/CVE-2026-43275.json | 2 +- data/2026/CVE-2026-43276.json | 2 +- data/2026/CVE-2026-43277.json | 2 +- data/2026/CVE-2026-43278.json | 2 +- data/2026/CVE-2026-43279.json | 2 +- data/2026/CVE-2026-43280.json | 2 +- data/2026/CVE-2026-43281.json | 2 +- data/2026/CVE-2026-43282.json | 2 +- data/2026/CVE-2026-43283.json | 2 +- data/2026/CVE-2026-43504.json | 2 +- data/2026/CVE-2026-43505.json | 2 +- data/2026/CVE-2026-43506.json | 2 +- data/2026/CVE-2026-43507.json | 2 +- data/2026/CVE-2026-43526.json | 2 +- data/2026/CVE-2026-43527.json | 2 +- data/2026/CVE-2026-43528.json | 2 +- data/2026/CVE-2026-43530.json | 2 +- data/2026/CVE-2026-43531.json | 2 +- data/2026/CVE-2026-43532.json | 2 +- data/2026/CVE-2026-43533.json | 2 +- data/2026/CVE-2026-43534.json | 2 +- data/2026/CVE-2026-43535.json | 2 +- data/2026/CVE-2026-43566.json | 2 +- data/2026/CVE-2026-43567.json | 2 +- data/2026/CVE-2026-43568.json | 2 +- data/2026/CVE-2026-43569.json | 2 +- data/2026/CVE-2026-43570.json | 2 +- data/2026/CVE-2026-43571.json | 2 +- data/2026/CVE-2026-43575.json | 2 +- data/2026/CVE-2026-43576.json | 2 +- data/2026/CVE-2026-43577.json | 2 +- data/2026/CVE-2026-43578.json | 2 +- data/2026/CVE-2026-43579.json | 2 +- data/2026/CVE-2026-43580.json | 2 +- data/2026/CVE-2026-43581.json | 2 +- data/2026/CVE-2026-43582.json | 2 +- data/2026/CVE-2026-43583.json | 2 +- data/2026/CVE-2026-43584.json | 2 +- data/2026/CVE-2026-43585.json | 2 +- data/2026/CVE-2026-43940.json | 2 +- data/2026/CVE-2026-43941.json | 2 +- data/2026/CVE-2026-43942.json | 2 +- data/2026/CVE-2026-43943.json | 2 +- data/2026/CVE-2026-43944.json | 2 +- data/2026/CVE-2026-43961.json | 2 +- data/2026/CVE-2026-43964.json | 2 +- data/2026/CVE-2026-44109.json | 2 +- data/2026/CVE-2026-44110.json | 2 +- data/2026/CVE-2026-44111.json | 2 +- data/2026/CVE-2026-44112.json | 2 +- data/2026/CVE-2026-44113.json | 2 +- data/2026/CVE-2026-44114.json | 2 +- data/2026/CVE-2026-44115.json | 2 +- data/2026/CVE-2026-44116.json | 2 +- data/2026/CVE-2026-44117.json | 2 +- data/2026/CVE-2026-44118.json | 2 +- data/2026/CVE-2026-44243.json | 2 +- data/2026/CVE-2026-44244.json | 2 +- data/2026/CVE-2026-44298.json | 2 +- data/2026/CVE-2026-4430.json | 2 +- data/2026/CVE-2026-44742.json | 2 +- data/2026/CVE-2026-4748.json | 2 +- data/2026/CVE-2026-4922.json | 2 +- data/2026/CVE-2026-5055.json | 2 +- data/2026/CVE-2026-5188.json | 2 +- data/2026/CVE-2026-5262.json | 2 +- data/2026/CVE-2026-5362.json | 2 +- data/2026/CVE-2026-5377.json | 2 +- data/2026/CVE-2026-5392.json | 2 +- data/2026/CVE-2026-5393.json | 2 +- data/2026/CVE-2026-5398.json | 2 +- data/2026/CVE-2026-5435.json | 2 +- data/2026/CVE-2026-5448.json | 2 +- data/2026/CVE-2026-5450.json | 2 +- data/2026/CVE-2026-5460.json | 2 +- data/2026/CVE-2026-5466.json | 2 +- data/2026/CVE-2026-5479.json | 2 +- data/2026/CVE-2026-5789.json | 2 +- data/2026/CVE-2026-5816.json | 2 +- data/2026/CVE-2026-5928.json | 2 +- data/2026/CVE-2026-6069.json | 2 +- data/2026/CVE-2026-6321.json | 2 +- data/2026/CVE-2026-6322.json | 2 +- data/2026/CVE-2026-6355.json | 2 +- data/2026/CVE-2026-6356.json | 2 +- data/2026/CVE-2026-6386.json | 2 +- data/2026/CVE-2026-6515.json | 2 +- data/2026/CVE-2026-6525.json | 2 +- data/2026/CVE-2026-68549.json | 1 + data/2026/CVE-2026-6951.json | 2 +- data/2026/CVE-2026-6987.json | 2 +- data/2026/CVE-2026-7020.json | 2 +- data/2026/CVE-2026-7141.json | 2 +- data/2026/CVE-2026-7482.json | 2 +- data/2026/CVE-2026-7585.json | 2 +- data/2026/CVE-2026-7586.json | 2 +- data/2026/CVE-2026-7587.json | 2 +- data/2026/CVE-2026-7598.json | 2 +- data/2026/CVE-2026-7768.json | 2 +- data/2026/CVE-2026-8080.json | 2 +- data/2026/CVE-2026-8119.json | 2 +- data/2026/CVE-2026-8120.json | 2 +- data/2026/CVE-2026-8121.json | 2 +- data/2026/CVE-2026-8122.json | 2 +- data/2026/CVE-2026-8123.json | 2 +- data/2026/CVE-2026-8124.json | 2 +- state/sync.json | 2 +- 803 files changed, 803 insertions(+), 710 deletions(-) create mode 100644 data/2026/CVE-2026-107922.json create mode 100644 data/2026/CVE-2026-125637.json create mode 100644 data/2026/CVE-2026-126757.json create mode 100644 data/2026/CVE-2026-126758.json create mode 100644 data/2026/CVE-2026-126759.json create mode 100644 data/2026/CVE-2026-126840.json create mode 100644 data/2026/CVE-2026-126841.json create mode 100644 data/2026/CVE-2026-126842.json create mode 100644 data/2026/CVE-2026-126843.json create mode 100644 data/2026/CVE-2026-126844.json create mode 100644 data/2026/CVE-2026-126845.json create mode 100644 data/2026/CVE-2026-126846.json create mode 100644 data/2026/CVE-2026-126847.json create mode 100644 data/2026/CVE-2026-126848.json create mode 100644 data/2026/CVE-2026-126849.json create mode 100644 data/2026/CVE-2026-126850.json create mode 100644 data/2026/CVE-2026-126851.json create mode 100644 data/2026/CVE-2026-126852.json create mode 100644 data/2026/CVE-2026-126853.json create mode 100644 data/2026/CVE-2026-126854.json create mode 100644 data/2026/CVE-2026-126855.json create mode 100644 data/2026/CVE-2026-126856.json create mode 100644 data/2026/CVE-2026-126857.json create mode 100644 data/2026/CVE-2026-126858.json create mode 100644 data/2026/CVE-2026-126859.json create mode 100644 data/2026/CVE-2026-126860.json create mode 100644 data/2026/CVE-2026-126861.json create mode 100644 data/2026/CVE-2026-126862.json create mode 100644 data/2026/CVE-2026-126863.json create mode 100644 data/2026/CVE-2026-126864.json create mode 100644 data/2026/CVE-2026-126865.json create mode 100644 data/2026/CVE-2026-126866.json create mode 100644 data/2026/CVE-2026-126867.json create mode 100644 data/2026/CVE-2026-126868.json create mode 100644 data/2026/CVE-2026-126869.json create mode 100644 data/2026/CVE-2026-126870.json create mode 100644 data/2026/CVE-2026-126871.json create mode 100644 data/2026/CVE-2026-126872.json create mode 100644 data/2026/CVE-2026-126873.json create mode 100644 data/2026/CVE-2026-126874.json create mode 100644 data/2026/CVE-2026-126875.json create mode 100644 data/2026/CVE-2026-126876.json create mode 100644 data/2026/CVE-2026-126877.json create mode 100644 data/2026/CVE-2026-126878.json create mode 100644 data/2026/CVE-2026-126879.json create mode 100644 data/2026/CVE-2026-126880.json create mode 100644 data/2026/CVE-2026-126881.json create mode 100644 data/2026/CVE-2026-126882.json create mode 100644 data/2026/CVE-2026-126883.json create mode 100644 data/2026/CVE-2026-126884.json create mode 100644 data/2026/CVE-2026-126885.json create mode 100644 data/2026/CVE-2026-126886.json create mode 100644 data/2026/CVE-2026-126887.json create mode 100644 data/2026/CVE-2026-126888.json create mode 100644 data/2026/CVE-2026-126889.json create mode 100644 data/2026/CVE-2026-126890.json create mode 100644 data/2026/CVE-2026-126891.json create mode 100644 data/2026/CVE-2026-126892.json create mode 100644 data/2026/CVE-2026-126893.json create mode 100644 data/2026/CVE-2026-126894.json create mode 100644 data/2026/CVE-2026-126895.json create mode 100644 data/2026/CVE-2026-126896.json create mode 100644 data/2026/CVE-2026-126897.json create mode 100644 data/2026/CVE-2026-126898.json create mode 100644 data/2026/CVE-2026-126899.json create mode 100644 data/2026/CVE-2026-126900.json create mode 100644 data/2026/CVE-2026-126901.json create mode 100644 data/2026/CVE-2026-126902.json create mode 100644 data/2026/CVE-2026-126903.json create mode 100644 data/2026/CVE-2026-126904.json create mode 100644 data/2026/CVE-2026-126905.json create mode 100644 data/2026/CVE-2026-126906.json create mode 100644 data/2026/CVE-2026-126907.json create mode 100644 data/2026/CVE-2026-126908.json create mode 100644 data/2026/CVE-2026-126909.json create mode 100644 data/2026/CVE-2026-126910.json create mode 100644 data/2026/CVE-2026-126911.json create mode 100644 data/2026/CVE-2026-126912.json create mode 100644 data/2026/CVE-2026-126913.json create mode 100644 data/2026/CVE-2026-126914.json create mode 100644 data/2026/CVE-2026-126915.json create mode 100644 data/2026/CVE-2026-126916.json create mode 100644 data/2026/CVE-2026-126917.json create mode 100644 data/2026/CVE-2026-126918.json create mode 100644 data/2026/CVE-2026-126919.json create mode 100644 data/2026/CVE-2026-126920.json create mode 100644 data/2026/CVE-2026-126921.json create mode 100644 data/2026/CVE-2026-126922.json create mode 100644 data/2026/CVE-2026-126932.json create mode 100644 data/2026/CVE-2026-126933.json create mode 100644 data/2026/CVE-2026-126934.json create mode 100644 data/2026/CVE-2026-126935.json create mode 100644 data/2026/CVE-2026-68549.json diff --git a/data/2022/CVE-2022-23851.json b/data/2022/CVE-2022-23851.json index 63c5465ba4..dda8c089c2 100644 --- a/data/2022/CVE-2022-23851.json +++ b/data/2022/CVE-2022-23851.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:netaxis:api_orchestrator:*:*:*:*:*:*:*:*","matchCriteriaId":"12A3E8F5-1ADF-4DED-B338-371F782DDCC8","versionEndExcluding":"0.19.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI)."}],"id":"CVE-2022-23851","lastModified":"2026-06-17T04:30:52.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-23851","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-12-17T15:48:34.583321Z","version":"2.0.3"}}]},"published":"2025-12-17T15:15:48.387","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://blog.tig00r.me/post/CVE-2022-23851"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://www.netaxis.be/products/apio/"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1336"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:netaxis:api_orchestrator:*:*:*:*:*:*:*:*","matchCriteriaId":"12A3E8F5-1ADF-4DED-B338-371F782DDCC8","versionEndExcluding":"0.19.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI)."},{"lang":"es","value":"Netaxis API Orchestrator (APIO) antes de 0.19.3 permite inyección de plantillas del lado del servidor (SSTI)."}],"id":"CVE-2022-23851","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-23851","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-12-17T15:48:34.583321Z","version":"2.0.3"}}]},"published":"2025-12-17T15:15:48.387","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://blog.tig00r.me/post/CVE-2022-23851"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://www.netaxis.be/products/apio/"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1336"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2022/CVE-2022-45899.json b/data/2022/CVE-2022-45899.json index 7c40679559..ee0c348723 100644 --- a/data/2022/CVE-2022-45899.json +++ b/data/2022/CVE-2022-45899.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:nokia:broadcast_message_center:*:*:*:*:*:*:*:*","matchCriteriaId":"CBA2333F-E79A-458C-BA94-9FDDA5AD61E4","versionEndExcluding":"13.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field."}],"id":"CVE-2022-45899","lastModified":"2026-08-12T15:36:13.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-45899","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-08T13:47:21.855358Z","version":"2.0.3"}}]},"published":"2026-05-08T05:16:09.183","references":[{"source":"cve@mitre.org","tags":["Not Applicable"],"url":"https://nokia.com"},{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://www.exploit-db.com/exploits/51896"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://www.exploit-db.com/exploits/51896"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:nokia:broadcast_message_center:*:*:*:*:*:*:*:*","matchCriteriaId":"CBA2333F-E79A-458C-BA94-9FDDA5AD61E4","versionEndExcluding":"13.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the Log Scanner Search Pattern field."},{"lang":"es","value":"Nokia Broadcast Message Center (BMC) antes de la versión 13.1 permite a un atacante remoto no autenticado realizar una inyección de comandos del sistema operativo como root a través de metacaracteres de shell en el campo ’Log Scanner Search Pattern’."}],"id":"CVE-2022-45899","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-45899","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-08T13:47:21.855358Z","version":"2.0.3"}}]},"published":"2026-05-08T05:16:09.183","references":[{"source":"cve@mitre.org","tags":["Not Applicable"],"url":"https://nokia.com"},{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://www.exploit-db.com/exploits/51896"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://www.exploit-db.com/exploits/51896"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2022/CVE-2022-4997.json b/data/2022/CVE-2022-4997.json index d1dda91f45..7c1a08ae91 100644 --- a/data/2022/CVE-2022-4997.json +++ b/data/2022/CVE-2022-4997.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jet-form-builder-stripe-gateway","vendor":"Unknown","versions":[{"lessThan":"1.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes."}],"id":"CVE-2022-4997","lastModified":"2026-09-23T18:13:31.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-4997","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-23T10:44:01.446471Z","version":"2.0.3"}}]},"published":"2026-09-23T06:16:59.060","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/368c38af-66c3-4500-ad50-87ada3abecd1/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"jet-form-builder-stripe-gateway","vendor":"Unknown","versions":[{"lessThan":"1.1.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes."},{"lang":"es","value":"La extensión de WordPress jet-form-builder-stripe-gateway antes de la versión 1.1.0 no sanitiza ni escape un token de pago antes de utilizarlo en una sentencia SQL, lo que permite a los usuarios no autenticados extraer datos arbitrarios de la base de datos, incluyendo hashes de contraseñas."}],"id":"CVE-2022-4997","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2022-4997","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-23T10:44:01.446471Z","version":"2.0.3"}}]},"published":"2026-09-23T06:16:59.060","references":[{"source":"contact@wpscan.com","url":"https://wpscan.com/vulnerability/368c38af-66c3-4500-ad50-87ada3abecd1/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2022/CVE-2022-50617.json b/data/2022/CVE-2022-50617.json index f968b58f2b..e6f2fc0f95 100644 --- a/data/2022/CVE-2022-50617.json +++ b/data/2022/CVE-2022-50617.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1caed03305b560bafea8eaa57f1847791658b3ff","status":"affected","version":"902bc65de0b3d72c481b45cbac3e97ab8cb399c2","versionType":"git"},{"lessThan":"7cb8932644438bee992dc898a36ffe155fdc1bfa","status":"affected","version":"902bc65de0b3d72c481b45cbac3e97ab8cb399c2","versionType":"git"},{"lessThan":"1c65f8f98148709e08bd6157a807c443ba91f0ac","status":"affected","version":"902bc65de0b3d72c481b45cbac3e97ab8cb399c2","versionType":"git"},{"lessThan":"8f8033d5663b18e6efb33feb61f2287a04605ab5","status":"affected","version":"902bc65de0b3d72c481b45cbac3e97ab8cb399c2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.11"},{"lessThan":"5.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.86","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/powerplay/psm: Fix memory leak in power state init\n\nCommit 902bc65de0b3 (\"drm/amdgpu/powerplay/psm: return an error in power\nstate init\") made the power state init function return early in case of\nfailure to get an entry from the powerplay table, but it missed to clean up\nthe allocated memory for the current power state before returning."}],"id":"CVE-2022-50617","lastModified":"2026-06-17T05:23:52.530","metrics":{},"published":"2025-12-08T02:15:47.457","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1c65f8f98148709e08bd6157a807c443ba91f0ac"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1caed03305b560bafea8eaa57f1847791658b3ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7cb8932644438bee992dc898a36ffe155fdc1bfa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8f8033d5663b18e6efb33feb61f2287a04605ab5"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1caed03305b560bafea8eaa57f1847791658b3ff","status":"affected","version":"902bc65de0b3d72c481b45cbac3e97ab8cb399c2","versionType":"git"},{"lessThan":"7cb8932644438bee992dc898a36ffe155fdc1bfa","status":"affected","version":"902bc65de0b3d72c481b45cbac3e97ab8cb399c2","versionType":"git"},{"lessThan":"1c65f8f98148709e08bd6157a807c443ba91f0ac","status":"affected","version":"902bc65de0b3d72c481b45cbac3e97ab8cb399c2","versionType":"git"},{"lessThan":"8f8033d5663b18e6efb33feb61f2287a04605ab5","status":"affected","version":"902bc65de0b3d72c481b45cbac3e97ab8cb399c2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/pm/powerplay/hwmgr/pp_psm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.11"},{"lessThan":"5.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.86","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/powerplay/psm: Fix memory leak in power state init\n\nCommit 902bc65de0b3 (\"drm/amdgpu/powerplay/psm: return an error in power\nstate init\") made the power state init function return early in case of\nfailure to get an entry from the powerplay table, but it missed to clean up\nthe allocated memory for the current power state before returning."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amdgpu/powerplay/psm: Corrección de fuga de memoria en la inicialización del estado de energía\n\nEl commit 902bc65de0b3 (’drm/amdgpu/powerplay/psm: devolver un error en la inicialización del estado de energía’) hizo que la función de inicialización del estado de energía retornara anticipadamente en caso de fallo al obtener una entrada de la tabla powerplay, pero omitió limpiar la memoria asignada para el estado de energía actual antes de retornar."}],"id":"CVE-2022-50617","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-08T02:15:47.457","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1c65f8f98148709e08bd6157a807c443ba91f0ac"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1caed03305b560bafea8eaa57f1847791658b3ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7cb8932644438bee992dc898a36ffe155fdc1bfa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8f8033d5663b18e6efb33feb61f2287a04605ab5"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50618.json b/data/2022/CVE-2022-50618.json index e8c0060303..543ce77ed6 100644 --- a/data/2022/CVE-2022-50618.json +++ b/data/2022/CVE-2022-50618.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mmc/host/meson-gx-mmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f5506e0bbb25102bd8ef2e1a3b483a0b934e454e","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"},{"lessThan":"9e11c6bb745be4e9b325cf96031b4ea34801342d","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"},{"lessThan":"64b2c441171febf075bd9632aca579afda8ab9fb","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"},{"lessThan":"e0cfe7aa41f3965f5224affd88afd48c60f6ad1f","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"},{"lessThan":"42343e3c6195e934b9cb4c08b7ff84a3778d77f9","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"},{"lessThan":"f5ce76aeddf01ca8f2a80fc37119388d59db7c10","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"},{"lessThan":"90935f16f2650ab7416fa2ffbe5c28cb39cf3f1e","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mmc/host/meson-gx-mmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.270","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.229","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.163","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.86","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: meson-gx: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value,\nit will lead two issues:\n1. The memory that allocated in mmc_alloc_host() is leaked.\n2. In the remove() path, mmc_remove_host() will be called to\n delete device, but it's not added yet, it will lead a kernel\n crash because of null-ptr-deref in device_del().\n\nFix this by checking the return value and goto error path which\nwill call mmc_free_host()."}],"id":"CVE-2022-50618","lastModified":"2026-06-17T05:23:52.630","metrics":{},"published":"2025-12-08T02:15:47.590","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/42343e3c6195e934b9cb4c08b7ff84a3778d77f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/64b2c441171febf075bd9632aca579afda8ab9fb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/90935f16f2650ab7416fa2ffbe5c28cb39cf3f1e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9e11c6bb745be4e9b325cf96031b4ea34801342d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e0cfe7aa41f3965f5224affd88afd48c60f6ad1f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f5506e0bbb25102bd8ef2e1a3b483a0b934e454e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f5ce76aeddf01ca8f2a80fc37119388d59db7c10"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mmc/host/meson-gx-mmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f5506e0bbb25102bd8ef2e1a3b483a0b934e454e","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"},{"lessThan":"9e11c6bb745be4e9b325cf96031b4ea34801342d","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"},{"lessThan":"64b2c441171febf075bd9632aca579afda8ab9fb","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"},{"lessThan":"e0cfe7aa41f3965f5224affd88afd48c60f6ad1f","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"},{"lessThan":"42343e3c6195e934b9cb4c08b7ff84a3778d77f9","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"},{"lessThan":"f5ce76aeddf01ca8f2a80fc37119388d59db7c10","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"},{"lessThan":"90935f16f2650ab7416fa2ffbe5c28cb39cf3f1e","status":"affected","version":"51c5d8447bd71b7e539c19c46a03b73c0e91fa66","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mmc/host/meson-gx-mmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.270","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.229","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.163","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.86","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: meson-gx: fix return value check of mmc_add_host()\n\nmmc_add_host() may return error, if we ignore its return value,\nit will lead two issues:\n1. The memory that allocated in mmc_alloc_host() is leaked.\n2. In the remove() path, mmc_remove_host() will be called to\n delete device, but it's not added yet, it will lead a kernel\n crash because of null-ptr-deref in device_del().\n\nFix this by checking the return value and goto error path which\nwill call mmc_free_host()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmmc: meson-gx: corregir la verificación del valor de retorno de mmc_add_host()\n\nmmc_add_host() puede devolver un error; si ignoramos su valor de retorno, esto conducirá a dos problemas:\n1. La memoria que se asignó en mmc_alloc_host() se filtra.\n2. En la ruta de remove(), se llamará a mmc_remove_host() para eliminar el dispositivo, pero aún no se ha añadido, lo que conducirá a un fallo del kernel debido a una desreferencia de puntero nulo en device_del().\n\nSolucione esto verificando el valor de retorno y yendo a la ruta de error que llamará a mmc_free_host()."}],"id":"CVE-2022-50618","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-08T02:15:47.590","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/42343e3c6195e934b9cb4c08b7ff84a3778d77f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/64b2c441171febf075bd9632aca579afda8ab9fb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/90935f16f2650ab7416fa2ffbe5c28cb39cf3f1e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9e11c6bb745be4e9b325cf96031b4ea34801342d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e0cfe7aa41f3965f5224affd88afd48c60f6ad1f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f5506e0bbb25102bd8ef2e1a3b483a0b934e454e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f5ce76aeddf01ca8f2a80fc37119388d59db7c10"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50619.json b/data/2022/CVE-2022-50619.json index 1e4a259e9a..e8a8992e00 100644 --- a/data/2022/CVE-2022-50619.json +++ b/data/2022/CVE-2022-50619.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"304a10161696d86300ceab1cbe72b2d74b8cdd94","status":"affected","version":"264fb4d332f5e76743818480e482464437837c52","versionType":"git"},{"lessThan":"c6dc4c9ba093829ebe1450d5fb101da6fb7a2a58","status":"affected","version":"264fb4d332f5e76743818480e482464437837c52","versionType":"git"},{"lessThan":"90bfee142af0f0e9d3bec80e7acd5f49b230acf7","status":"affected","version":"264fb4d332f5e76743818480e482464437837c52","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.77","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr()\n\nIf the number of pages from the userptr BO differs from the SG BO then the\nallocated memory for the SG table doesn't get freed before returning\n-EINVAL, which may lead to a memory leak in some error paths. Fix this by\nchecking the number of pages before allocating memory for the SG table."}],"id":"CVE-2022-50619","lastModified":"2026-06-17T05:23:52.740","metrics":{},"published":"2025-12-08T02:15:47.727","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/304a10161696d86300ceab1cbe72b2d74b8cdd94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/90bfee142af0f0e9d3bec80e7acd5f49b230acf7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c6dc4c9ba093829ebe1450d5fb101da6fb7a2a58"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"304a10161696d86300ceab1cbe72b2d74b8cdd94","status":"affected","version":"264fb4d332f5e76743818480e482464437837c52","versionType":"git"},{"lessThan":"c6dc4c9ba093829ebe1450d5fb101da6fb7a2a58","status":"affected","version":"264fb4d332f5e76743818480e482464437837c52","versionType":"git"},{"lessThan":"90bfee142af0f0e9d3bec80e7acd5f49b230acf7","status":"affected","version":"264fb4d332f5e76743818480e482464437837c52","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.77","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr()\n\nIf the number of pages from the userptr BO differs from the SG BO then the\nallocated memory for the SG table doesn't get freed before returning\n-EINVAL, which may lead to a memory leak in some error paths. Fix this by\nchecking the number of pages before allocating memory for the SG table."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amdkfd: Corrección de fuga de memoria en kfd_mem_dmamap_userptr()\n\nSi el número de páginas del BO userptr difiere del BO SG, entonces la memoria asignada para la tabla SG no se libera antes de devolver -EINVAL, lo que puede provocar una fuga de memoria en algunas rutas de error. Esto se corrige comprobando el número de páginas antes de asignar memoria para la tabla SG."}],"id":"CVE-2022-50619","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-08T02:15:47.727","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/304a10161696d86300ceab1cbe72b2d74b8cdd94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/90bfee142af0f0e9d3bec80e7acd5f49b230acf7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c6dc4c9ba093829ebe1450d5fb101da6fb7a2a58"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50620.json b/data/2022/CVE-2022-50620.json index a8be7f44f7..5aead14bd5 100644 --- a/data/2022/CVE-2022-50620.json +++ b/data/2022/CVE-2022-50620.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/f2fs/segment.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"865bb7b5a7deeb0e5afbd82381d52d38825dc64d","status":"affected","version":"4d67490498acb4ffcef5ba7bc44990d46e66a44c","versionType":"git"},{"lessThan":"a3e517a6ba695d683ee63615e1ea6e6b4c7d2732","status":"affected","version":"4d67490498acb4ffcef5ba7bc44990d46e66a44c","versionType":"git"},{"lessThan":"ae6c960a82c52c3bda5adc82d90643d6c12d308e","status":"affected","version":"4d67490498acb4ffcef5ba7bc44990d46e66a44c","versionType":"git"},{"lessThan":"91586ce0d39a05f88795aa8814fb99b1387236b3","status":"affected","version":"4d67490498acb4ffcef5ba7bc44990d46e66a44c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/f2fs/segment.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.86","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to invalidate dcc->f2fs_issue_discard in error path\n\nSyzbot reports a NULL pointer dereference issue as below:\n\n __refcount_add include/linux/refcount.h:193 [inline]\n __refcount_inc include/linux/refcount.h:250 [inline]\n refcount_inc include/linux/refcount.h:267 [inline]\n get_task_struct include/linux/sched/task.h:110 [inline]\n kthread_stop+0x34/0x1c0 kernel/kthread.c:703\n f2fs_stop_discard_thread+0x3c/0x5c fs/f2fs/segment.c:1638\n kill_f2fs_super+0x5c/0x194 fs/f2fs/super.c:4522\n deactivate_locked_super+0x70/0xe8 fs/super.c:332\n deactivate_super+0xd0/0xd4 fs/super.c:363\n cleanup_mnt+0x1f8/0x234 fs/namespace.c:1186\n __cleanup_mnt+0x20/0x30 fs/namespace.c:1193\n task_work_run+0xc4/0x14c kernel/task_work.c:177\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0x26c/0xbe0 kernel/exit.c:795\n do_group_exit+0x60/0xe8 kernel/exit.c:925\n __do_sys_exit_group kernel/exit.c:936 [inline]\n __se_sys_exit_group kernel/exit.c:934 [inline]\n __wake_up_parent+0x0/0x40 kernel/exit.c:934\n __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]\n invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]\n el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142\n do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206\n el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636\n el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654\n el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581\n\nThe root cause of this issue is in error path of f2fs_start_discard_thread(),\nit missed to invalidate dcc->f2fs_issue_discard, later kthread_stop() may\naccess invalid pointer."}],"id":"CVE-2022-50620","lastModified":"2026-06-17T05:23:52.840","metrics":{},"published":"2025-12-08T02:15:47.870","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/865bb7b5a7deeb0e5afbd82381d52d38825dc64d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/91586ce0d39a05f88795aa8814fb99b1387236b3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a3e517a6ba695d683ee63615e1ea6e6b4c7d2732"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ae6c960a82c52c3bda5adc82d90643d6c12d308e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/f2fs/segment.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"865bb7b5a7deeb0e5afbd82381d52d38825dc64d","status":"affected","version":"4d67490498acb4ffcef5ba7bc44990d46e66a44c","versionType":"git"},{"lessThan":"a3e517a6ba695d683ee63615e1ea6e6b4c7d2732","status":"affected","version":"4d67490498acb4ffcef5ba7bc44990d46e66a44c","versionType":"git"},{"lessThan":"ae6c960a82c52c3bda5adc82d90643d6c12d308e","status":"affected","version":"4d67490498acb4ffcef5ba7bc44990d46e66a44c","versionType":"git"},{"lessThan":"91586ce0d39a05f88795aa8814fb99b1387236b3","status":"affected","version":"4d67490498acb4ffcef5ba7bc44990d46e66a44c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/f2fs/segment.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.86","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to invalidate dcc->f2fs_issue_discard in error path\n\nSyzbot reports a NULL pointer dereference issue as below:\n\n __refcount_add include/linux/refcount.h:193 [inline]\n __refcount_inc include/linux/refcount.h:250 [inline]\n refcount_inc include/linux/refcount.h:267 [inline]\n get_task_struct include/linux/sched/task.h:110 [inline]\n kthread_stop+0x34/0x1c0 kernel/kthread.c:703\n f2fs_stop_discard_thread+0x3c/0x5c fs/f2fs/segment.c:1638\n kill_f2fs_super+0x5c/0x194 fs/f2fs/super.c:4522\n deactivate_locked_super+0x70/0xe8 fs/super.c:332\n deactivate_super+0xd0/0xd4 fs/super.c:363\n cleanup_mnt+0x1f8/0x234 fs/namespace.c:1186\n __cleanup_mnt+0x20/0x30 fs/namespace.c:1193\n task_work_run+0xc4/0x14c kernel/task_work.c:177\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0x26c/0xbe0 kernel/exit.c:795\n do_group_exit+0x60/0xe8 kernel/exit.c:925\n __do_sys_exit_group kernel/exit.c:936 [inline]\n __se_sys_exit_group kernel/exit.c:934 [inline]\n __wake_up_parent+0x0/0x40 kernel/exit.c:934\n __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]\n invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]\n el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142\n do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206\n el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636\n el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654\n el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581\n\nThe root cause of this issue is in error path of f2fs_start_discard_thread(),\nit missed to invalidate dcc->f2fs_issue_discard, later kthread_stop() may\naccess invalid pointer."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nf2fs: corrección para invalidar dcc -> f2fs_issue_discard en la ruta de error\n\nSyzbot informa un problema de desreferencia de puntero NULL como se muestra a continuación:\n\n __refcount_add include/linux/refcount.h:193 [inline]\n __refcount_inc include/linux/refcount.h:250 [inline]\n refcount_inc include/linux/refcount.h:267 [inline]\n get_task_struct include/linux/sched/task.h:110 [inline]\n kthread_stop+0x34/0x1c0 kernel/kthread.c:703\n f2fs_stop_discard_thread+0x3c/0x5c fs/f2fs/segment.c:1638\n kill_f2fs_super+0x5c/0x194 fs/f2fs/super.c:4522\n deactivate_locked_super+0x70/0xe8 fs/super.c:332\n deactivate_super+0xd0/0xd4 fs/super.c:363\n cleanup_mnt+0x1f8/0x234 fs/namespace.c:1186\n __cleanup_mnt+0x20/0x30 fs/namespace.c:1193\n task_work_run+0xc4/0x14c kernel/task_work.c:177\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0x26c/0xbe0 kernel/exit.c:795\n do_group_exit+0x60/0xe8 kernel/exit.c:925\n __do_sys_exit_group kernel/exit.c:936 [inline]\n __se_sys_exit_group kernel/exit.c:934 [inline]\n __wake_up_parent+0x0/0x40 kernel/exit.c:934\n __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]\n invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]\n el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142\n do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206\n el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636\n el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654\n el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581\n\nLa causa raíz de este problema está en la ruta de error de f2fs_start_discard_thread(), omitió invalidar dcc -> f2fs_issue_discard, posteriormente kthread_stop() podría acceder a un puntero inválido."}],"id":"CVE-2022-50620","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-08T02:15:47.870","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/865bb7b5a7deeb0e5afbd82381d52d38825dc64d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/91586ce0d39a05f88795aa8814fb99b1387236b3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a3e517a6ba695d683ee63615e1ea6e6b4c7d2732"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ae6c960a82c52c3bda5adc82d90643d6c12d308e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50621.json b/data/2022/CVE-2022-50621.json index 39d9cce71d..e7dcecb11c 100644 --- a/data/2022/CVE-2022-50621.json +++ b/data/2022/CVE-2022-50621.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/md/dm-verity-loadpin.c","drivers/md/dm-verity-target.c","drivers/md/dm-verity.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cb1f5b76e39d86c98722696bdf632987aa777b83","status":"affected","version":"b6c1c5745ccc68ac5d57c7ffb51ea25a86d0e97b","versionType":"git"},{"lessThan":"916ef6232cc4b84db7082b4c3d3cf1753d9462ba","status":"affected","version":"b6c1c5745ccc68ac5d57c7ffb51ea25a86d0e97b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/md/dm-verity-loadpin.c","drivers/md/dm-verity-target.c","drivers/md/dm-verity.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.0"},{"lessThan":"6.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm: verity-loadpin: Only trust verity targets with enforcement\n\nVerity targets can be configured to ignore corrupted data blocks.\nLoadPin must only trust verity targets that are configured to\nperform some kind of enforcement when data corruption is detected,\nlike returning an error, restarting the system or triggering a\npanic."}],"id":"CVE-2022-50621","lastModified":"2026-06-17T05:23:52.977","metrics":{},"published":"2025-12-08T02:15:48.000","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/916ef6232cc4b84db7082b4c3d3cf1753d9462ba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/cb1f5b76e39d86c98722696bdf632987aa777b83"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/md/dm-verity-loadpin.c","drivers/md/dm-verity-target.c","drivers/md/dm-verity.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cb1f5b76e39d86c98722696bdf632987aa777b83","status":"affected","version":"b6c1c5745ccc68ac5d57c7ffb51ea25a86d0e97b","versionType":"git"},{"lessThan":"916ef6232cc4b84db7082b4c3d3cf1753d9462ba","status":"affected","version":"b6c1c5745ccc68ac5d57c7ffb51ea25a86d0e97b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/md/dm-verity-loadpin.c","drivers/md/dm-verity-target.c","drivers/md/dm-verity.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.0"},{"lessThan":"6.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm: verity-loadpin: Only trust verity targets with enforcement\n\nVerity targets can be configured to ignore corrupted data blocks.\nLoadPin must only trust verity targets that are configured to\nperform some kind of enforcement when data corruption is detected,\nlike returning an error, restarting the system or triggering a\npanic."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndm: verity-loadpin: Solo confiar en objetivos de verity con aplicación\n\nLos objetivos de verity pueden configurarse para ignorar bloques de datos corruptos. LoadPin solo debe confiar en objetivos de verity que están configurados para realizar algún tipo de aplicación cuando se detecta corrupción de datos, como devolver un error, reiniciar el sistema o desencadenar un pánico."}],"id":"CVE-2022-50621","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-08T02:15:48.000","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/916ef6232cc4b84db7082b4c3d3cf1753d9462ba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/cb1f5b76e39d86c98722696bdf632987aa777b83"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50622.json b/data/2022/CVE-2022-50622.json index 21d54845ba..074635e5d8 100644 --- a/data/2022/CVE-2022-50622.json +++ b/data/2022/CVE-2022-50622.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/fast_commit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c9ce7766dc4e88e624c62a68221a3bbe8f06e856","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"9b5eb368a86f97eb9831f5b53b8e43ec69bc7cd4","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"c0be17635f039f864b1108efec0015c73736e414","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"24d39affc6be1acf6df86a8c3e2413b8a73749c7","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"9305721a309fa1bd7c194e0d4a2335bf3b29dca4","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/fast_commit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.10"},{"lessThan":"5.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.150","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.75","versionType":"semver"},{"lessThanOrEqual":"5.19.*","status":"unaffected","version":"5.19.17","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix potential memory leak in ext4_fc_record_modified_inode()\n\nAs krealloc may return NULL, in this case 'state->fc_modified_inodes'\nmay not be freed by krealloc, but 'state->fc_modified_inodes' already\nset NULL. Then will lead to 'state->fc_modified_inodes' memory leak."}],"id":"CVE-2022-50622","lastModified":"2026-06-17T05:23:53.100","metrics":{},"published":"2025-12-08T02:15:48.120","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/24d39affc6be1acf6df86a8c3e2413b8a73749c7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9305721a309fa1bd7c194e0d4a2335bf3b29dca4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9b5eb368a86f97eb9831f5b53b8e43ec69bc7cd4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c0be17635f039f864b1108efec0015c73736e414"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c9ce7766dc4e88e624c62a68221a3bbe8f06e856"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/fast_commit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c9ce7766dc4e88e624c62a68221a3bbe8f06e856","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"9b5eb368a86f97eb9831f5b53b8e43ec69bc7cd4","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"c0be17635f039f864b1108efec0015c73736e414","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"24d39affc6be1acf6df86a8c3e2413b8a73749c7","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"},{"lessThan":"9305721a309fa1bd7c194e0d4a2335bf3b29dca4","status":"affected","version":"8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/fast_commit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.10"},{"lessThan":"5.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.150","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.75","versionType":"semver"},{"lessThanOrEqual":"5.19.*","status":"unaffected","version":"5.19.17","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix potential memory leak in ext4_fc_record_modified_inode()\n\nAs krealloc may return NULL, in this case 'state->fc_modified_inodes'\nmay not be freed by krealloc, but 'state->fc_modified_inodes' already\nset NULL. Then will lead to 'state->fc_modified_inodes' memory leak."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: corrección de una posible fuga de memoria en ext4_fc_record_modified_inode()\n\nDado que krealloc puede devolver NULL, en este caso ’state -> fc_modified_inodes’ puede no ser liberado por krealloc, pero ’state -> fc_modified_inodes’ ya se estableció en NULL. Esto conducirá a una fuga de memoria de ’state -> fc_modified_inodes’."}],"id":"CVE-2022-50622","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-08T02:15:48.120","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/24d39affc6be1acf6df86a8c3e2413b8a73749c7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9305721a309fa1bd7c194e0d4a2335bf3b29dca4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9b5eb368a86f97eb9831f5b53b8e43ec69bc7cd4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c0be17635f039f864b1108efec0015c73736e414"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c9ce7766dc4e88e624c62a68221a3bbe8f06e856"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50624.json b/data/2022/CVE-2022-50624.json index f31c02126d..f1f7f9e885 100644 --- a/data/2022/CVE-2022-50624.json +++ b/data/2022/CVE-2022-50624.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/socionext/netsec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"728884b22d83148a330b23f9472f1e118b589211","status":"affected","version":"533dd11a12f698c571a12271b20f235792d3e148","versionType":"git"},{"lessThan":"fda2d07234a21be4d71ebfe97a45f499726902d6","status":"affected","version":"533dd11a12f698c571a12271b20f235792d3e148","versionType":"git"},{"lessThan":"62f0a08e82a6312efd7df7f595c0b11d4ffde610","status":"affected","version":"533dd11a12f698c571a12271b20f235792d3e148","versionType":"git"},{"lessThan":"1e0bee973ef6fc3c1e3acb014515eaea37c8fa17","status":"affected","version":"533dd11a12f698c571a12271b20f235792d3e148","versionType":"git"},{"lessThan":"846e677daf51220d7975c61a20e440a88473951e","status":"affected","version":"533dd11a12f698c571a12271b20f235792d3e148","versionType":"git"},{"lessThan":"94423589689124e8cd145b38a1034be7f25835b2","status":"affected","version":"533dd11a12f698c571a12271b20f235792d3e148","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/socionext/netsec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.264","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.223","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.153","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.77","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: netsec: fix error handling in netsec_register_mdio()\n\nIf phy_device_register() fails, phy_device_free() need be called to\nput refcount, so memory of phy device and device name can be freed\nin callback function.\n\nIf get_phy_device() fails, mdiobus_unregister() need be called,\nor it will cause warning in mdiobus_free() and kobject is leaked."}],"id":"CVE-2022-50624","lastModified":"2026-06-17T05:23:53.320","metrics":{},"published":"2025-12-08T02:15:48.377","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1e0bee973ef6fc3c1e3acb014515eaea37c8fa17"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/62f0a08e82a6312efd7df7f595c0b11d4ffde610"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/728884b22d83148a330b23f9472f1e118b589211"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/846e677daf51220d7975c61a20e440a88473951e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/94423589689124e8cd145b38a1034be7f25835b2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fda2d07234a21be4d71ebfe97a45f499726902d6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/socionext/netsec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"728884b22d83148a330b23f9472f1e118b589211","status":"affected","version":"533dd11a12f698c571a12271b20f235792d3e148","versionType":"git"},{"lessThan":"fda2d07234a21be4d71ebfe97a45f499726902d6","status":"affected","version":"533dd11a12f698c571a12271b20f235792d3e148","versionType":"git"},{"lessThan":"62f0a08e82a6312efd7df7f595c0b11d4ffde610","status":"affected","version":"533dd11a12f698c571a12271b20f235792d3e148","versionType":"git"},{"lessThan":"1e0bee973ef6fc3c1e3acb014515eaea37c8fa17","status":"affected","version":"533dd11a12f698c571a12271b20f235792d3e148","versionType":"git"},{"lessThan":"846e677daf51220d7975c61a20e440a88473951e","status":"affected","version":"533dd11a12f698c571a12271b20f235792d3e148","versionType":"git"},{"lessThan":"94423589689124e8cd145b38a1034be7f25835b2","status":"affected","version":"533dd11a12f698c571a12271b20f235792d3e148","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/socionext/netsec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.264","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.223","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.153","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.77","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: netsec: fix error handling in netsec_register_mdio()\n\nIf phy_device_register() fails, phy_device_free() need be called to\nput refcount, so memory of phy device and device name can be freed\nin callback function.\n\nIf get_phy_device() fails, mdiobus_unregister() need be called,\nor it will cause warning in mdiobus_free() and kobject is leaked."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: netsec: corregir el manejo de errores en netsec_register_mdio()\n\nSi phy_device_register() falla, phy_device_free() debe ser llamada para disminuir el contador de referencias, de modo que la memoria del dispositivo phy y el nombre del dispositivo puedan ser liberados en la función de callback.\n\nSi get_phy_device() falla, mdiobus_unregister() debe ser llamada, o causará una advertencia en mdiobus_free() y se producirá una fuga de kobject."}],"id":"CVE-2022-50624","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-08T02:15:48.377","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1e0bee973ef6fc3c1e3acb014515eaea37c8fa17"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/62f0a08e82a6312efd7df7f595c0b11d4ffde610"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/728884b22d83148a330b23f9472f1e118b589211"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/846e677daf51220d7975c61a20e440a88473951e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/94423589689124e8cd145b38a1034be7f25835b2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fda2d07234a21be4d71ebfe97a45f499726902d6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50625.json b/data/2022/CVE-2022-50625.json index 547cd8144c..52294d0e78 100644 --- a/data/2022/CVE-2022-50625.json +++ b/data/2022/CVE-2022-50625.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/tty/serial/amba-pl011.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1c5f0d3f480abd8c26761b6b1f486822e77faea3","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"a4ea20ab82aa2b197dc7b08f51e1d615578276a0","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"78d837ce20517e0c1ff3ebe08ad64636e02c2e48","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"965f07ea5fd1b9591bcccc825a93ad883e56222c","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"d5b16eb076f46c88d02d41ece5bec4e0d89158bb","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"d71a611fca1984c0765f9317ff471ac8cd0e3e2f","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"38a10fdd54d17590d45cb1c43b9889da383b6b1a","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"64bc5dbc3260230e2f022288c71e5c680059384a","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"94cdb9f33698478b0e7062586633c42c6158a786","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/tty/serial/amba-pl011.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.2"},{"lessThan":"4.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.9.*","status":"unaffected","version":"4.9.337","versionType":"semver"},{"lessThanOrEqual":"4.14.*","status":"unaffected","version":"4.14.303","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.270","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.229","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.163","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.86","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: amba-pl011: avoid SBSA UART accessing DMACR register\n\nChapter \"B Generic UART\" in \"ARM Server Base System Architecture\" [1]\ndocumentation describes a generic UART interface. Such generic UART\ndoes not support DMA. In current code, sbsa_uart_pops and\namba_pl011_pops share the same stop_rx operation, which will invoke\npl011_dma_rx_stop, leading to an access of the DMACR register. This\ncommit adds a using_rx_dma check in pl011_dma_rx_stop to avoid the\naccess to DMACR register for SBSA UARTs which does not support DMA.\n\nWhen the kernel enables DMA engine with \"CONFIG_DMA_ENGINE=y\", Linux\nSBSA PL011 driver will access PL011 DMACR register in some functions.\nFor most real SBSA Pl011 hardware implementations, the DMACR write\nbehaviour will be ignored. So these DMACR operations will not cause\nobvious problems. But for some virtual SBSA PL011 hardware, like Xen\nvirtual SBSA PL011 (vpl011) device, the behaviour might be different.\nXen vpl011 emulation will inject a data abort to guest, when guest is\naccessing an unimplemented UART register. As Xen VPL011 is SBSA\ncompatible, it will not implement DMACR register. So when Linux SBSA\nPL011 driver access DMACR register, it will get an unhandled data abort\nfault and the application will get a segmentation fault:\nUnhandled fault at 0xffffffc00944d048\nMem abort info:\n ESR = 0x96000000\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x00: ttbr address size fault\nData abort info:\n ISV = 0, ISS = 0x00000000\n CM = 0, WnR = 0\nswapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000020e2e000\n[ffffffc00944d048] pgd=100000003ffff803, p4d=100000003ffff803, pud=100000003ffff803, pmd=100000003fffa803, pte=006800009c090f13\nInternal error: ttbr address size fault: 96000000 [#1] PREEMPT SMP\n...\nCall trace:\n pl011_stop_rx+0x70/0x80\n tty_port_shutdown+0x7c/0xb4\n tty_port_close+0x60/0xcc\n uart_close+0x34/0x8c\n tty_release+0x144/0x4c0\n __fput+0x78/0x220\n ____fput+0x1c/0x30\n task_work_run+0x88/0xc0\n do_notify_resume+0x8d0/0x123c\n el0_svc+0xa8/0xc0\n el0t_64_sync_handler+0xa4/0x130\n el0t_64_sync+0x1a0/0x1a4\nCode: b9000083 b901f001 794038a0 8b000042 (b9000041)\n---[ end trace 83dd93df15c3216f ]---\nnote: bootlogd[132] exited with preempt_count 1\n/etc/rcS.d/S07bootlogd: line 47: 132 Segmentation fault start-stop-daemon\n\nThis has been discussed in the Xen community, and we think it should fix\nthis in Linux. See [2] for more information.\n\n[1] https://developer.arm.com/documentation/den0094/c/?lang=en\n[2] https://lists.xenproject.org/archives/html/xen-devel/2022-11/msg00543.html"}],"id":"CVE-2022-50625","lastModified":"2026-06-17T05:23:53.417","metrics":{},"published":"2025-12-08T02:15:48.510","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1c5f0d3f480abd8c26761b6b1f486822e77faea3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/38a10fdd54d17590d45cb1c43b9889da383b6b1a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/64bc5dbc3260230e2f022288c71e5c680059384a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/78d837ce20517e0c1ff3ebe08ad64636e02c2e48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/94cdb9f33698478b0e7062586633c42c6158a786"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/965f07ea5fd1b9591bcccc825a93ad883e56222c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a4ea20ab82aa2b197dc7b08f51e1d615578276a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d5b16eb076f46c88d02d41ece5bec4e0d89158bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d71a611fca1984c0765f9317ff471ac8cd0e3e2f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/tty/serial/amba-pl011.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1c5f0d3f480abd8c26761b6b1f486822e77faea3","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"a4ea20ab82aa2b197dc7b08f51e1d615578276a0","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"78d837ce20517e0c1ff3ebe08ad64636e02c2e48","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"965f07ea5fd1b9591bcccc825a93ad883e56222c","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"d5b16eb076f46c88d02d41ece5bec4e0d89158bb","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"d71a611fca1984c0765f9317ff471ac8cd0e3e2f","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"38a10fdd54d17590d45cb1c43b9889da383b6b1a","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"64bc5dbc3260230e2f022288c71e5c680059384a","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"},{"lessThan":"94cdb9f33698478b0e7062586633c42c6158a786","status":"affected","version":"0dd1e247fd39aed20fd2baacc62ca44d82534798","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/tty/serial/amba-pl011.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.2"},{"lessThan":"4.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.9.*","status":"unaffected","version":"4.9.337","versionType":"semver"},{"lessThanOrEqual":"4.14.*","status":"unaffected","version":"4.14.303","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.270","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.229","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.163","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.86","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: amba-pl011: avoid SBSA UART accessing DMACR register\n\nChapter \"B Generic UART\" in \"ARM Server Base System Architecture\" [1]\ndocumentation describes a generic UART interface. Such generic UART\ndoes not support DMA. In current code, sbsa_uart_pops and\namba_pl011_pops share the same stop_rx operation, which will invoke\npl011_dma_rx_stop, leading to an access of the DMACR register. This\ncommit adds a using_rx_dma check in pl011_dma_rx_stop to avoid the\naccess to DMACR register for SBSA UARTs which does not support DMA.\n\nWhen the kernel enables DMA engine with \"CONFIG_DMA_ENGINE=y\", Linux\nSBSA PL011 driver will access PL011 DMACR register in some functions.\nFor most real SBSA Pl011 hardware implementations, the DMACR write\nbehaviour will be ignored. So these DMACR operations will not cause\nobvious problems. But for some virtual SBSA PL011 hardware, like Xen\nvirtual SBSA PL011 (vpl011) device, the behaviour might be different.\nXen vpl011 emulation will inject a data abort to guest, when guest is\naccessing an unimplemented UART register. As Xen VPL011 is SBSA\ncompatible, it will not implement DMACR register. So when Linux SBSA\nPL011 driver access DMACR register, it will get an unhandled data abort\nfault and the application will get a segmentation fault:\nUnhandled fault at 0xffffffc00944d048\nMem abort info:\n ESR = 0x96000000\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x00: ttbr address size fault\nData abort info:\n ISV = 0, ISS = 0x00000000\n CM = 0, WnR = 0\nswapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000020e2e000\n[ffffffc00944d048] pgd=100000003ffff803, p4d=100000003ffff803, pud=100000003ffff803, pmd=100000003fffa803, pte=006800009c090f13\nInternal error: ttbr address size fault: 96000000 [#1] PREEMPT SMP\n...\nCall trace:\n pl011_stop_rx+0x70/0x80\n tty_port_shutdown+0x7c/0xb4\n tty_port_close+0x60/0xcc\n uart_close+0x34/0x8c\n tty_release+0x144/0x4c0\n __fput+0x78/0x220\n ____fput+0x1c/0x30\n task_work_run+0x88/0xc0\n do_notify_resume+0x8d0/0x123c\n el0_svc+0xa8/0xc0\n el0t_64_sync_handler+0xa4/0x130\n el0t_64_sync+0x1a0/0x1a4\nCode: b9000083 b901f001 794038a0 8b000042 (b9000041)\n---[ end trace 83dd93df15c3216f ]---\nnote: bootlogd[132] exited with preempt_count 1\n/etc/rcS.d/S07bootlogd: line 47: 132 Segmentation fault start-stop-daemon\n\nThis has been discussed in the Xen community, and we think it should fix\nthis in Linux. See [2] for more information.\n\n[1] https://developer.arm.com/documentation/den0094/c/?lang=en\n[2] https://lists.xenproject.org/archives/html/xen-devel/2022-11/msg00543.html"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nserial: amba-pl011: evitar que la UART SBSA acceda al registro DMACR\n\nEl capítulo ’B Generic UART’ en la documentación ’ARM Server Base System Architecture’ [1] describe una interfaz UART genérica. Dicha UART genérica no es compatible con DMA. En el código actual, sbsa_uart_pops y amba_pl011_pops comparten la misma operación stop_rx, lo que invocará pl011_dma_rx_stop, lo que lleva a un acceso al registro DMACR. Este commit añade una comprobación using_rx_dma en pl011_dma_rx_stop para evitar el acceso al registro DMACR para las UART SBSA que no son compatibles con DMA.\n\nCuando el kernel habilita el motor DMA con ’CONFIG_DMA_ENGINE=y’, el controlador Linux SBSA PL011 accederá al registro PL011 DMACR en algunas funciones. Para la mayoría de las implementaciones de hardware SBSA PL011 reales, el comportamiento de escritura del DMACR será ignorado. Por lo tanto, estas operaciones DMACR no causarán problemas obvios. Pero para algunos hardware SBSA PL011 virtuales, como el dispositivo Xen virtual SBSA PL011 (vpl011), el comportamiento podría ser diferente. La emulación Xen vpl011 inyectará un aborto de datos al invitado, cuando el invitado esté accediendo a un registro UART no implementado. Como Xen VPL011 es compatible con SBSA, no implementará el registro DMACR. Así que cuando el controlador Linux SBSA PL011 acceda al registro DMACR, obtendrá un fallo de aborto de datos no manejado y la aplicación obtendrá un fallo de segmentación:\nFallo no manejado en 0x ffffffc00944d048\nInformación de aborto de memoria:\n ESR = 0x 96000000\n EC = 0x25: DABT (EL actual), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x00: fallo de tamaño de dirección ttbr\nInformación de aborto de datos:\n ISV = 0, ISS = 0x 00000000\n CM = 0, WnR = 0\ntabla de páginas del swapper: páginas de 4k, VAs de 39 bits, pgdp=0000000020e2e000\n[ffffffc00944d048] pgd=100000003ffff803, p4d=100000003ffff803, pud=100000003ffff803, pmd=100000003fffa803, pte=006800009c090f13\nError interno: fallo de tamaño de dirección ttbr: 96000000 [#1] PREEMPT SMP\n...\nRastro de llamada:\n pl011_stop_rx+0x70/0x80\n tty_port_shutdown+0x7c/0xb4\n tty_port_close+0x60/0xcc\n uart_close+0x34/0x8c\n tty_release+0x144/0x4c0\n __fput+0x78/0x220\n ____fput+0x1c/0x30\n task_work_run+0x88/0xc0\n do_notify_resume+0x8d0/0x 123c\n el0_svc+0xa8/0xc0\n el0t_64_sync_handler+0xa4/0x130\n el0t_64_sync+0x1a0/0x1a4\nCódigo: b9000083 b901f001 794038a0 8b000042 (b9000041)\n- --[ fin del rastro 83dd93df15c3216f ]- --\nnota: bootlogd[132] salió con preempt_count 1\n/etc/rcS.d/S07bootlogd: línea 47: 132 Fallo de segmentación start-stop-daemon\n\nEsto ha sido discutido en la comunidad Xen, y creemos que debería solucionarse en Linux. Consulte [2] para más información.\n\n[1] https://developer.arm.com/documentation/den0094/c/?lang=en\n[2] https://lists.xenproject.org/archives/html/xen-devel/2022-11/msg00543.html"}],"id":"CVE-2022-50625","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-08T02:15:48.510","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1c5f0d3f480abd8c26761b6b1f486822e77faea3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/38a10fdd54d17590d45cb1c43b9889da383b6b1a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/64bc5dbc3260230e2f022288c71e5c680059384a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/78d837ce20517e0c1ff3ebe08ad64636e02c2e48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/94cdb9f33698478b0e7062586633c42c6158a786"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/965f07ea5fd1b9591bcccc825a93ad883e56222c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a4ea20ab82aa2b197dc7b08f51e1d615578276a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d5b16eb076f46c88d02d41ece5bec4e0d89158bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d71a611fca1984c0765f9317ff471ac8cd0e3e2f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50626.json b/data/2022/CVE-2022-50626.json index 9216659cdb..928bf6b66a 100644 --- a/data/2022/CVE-2022-50626.json +++ b/data/2022/CVE-2022-50626.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/usb/dvb-usb/dvb-usb-init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"733bc9e226da2a7f43b10031b8ebfc26d89ec4bd","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"e5a49140035591d13ff57a7537c65217e5af0d15","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"21b6b0c9f3796e6917e90db403dae9e74025fc40","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"17217737c174883dd975885ab4bee4b00f517239","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"7d7ab25ead969594df05fb09ee46ca931d46c5c8","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"d0af6220bb1eed8225a5511de5a3bd386b94afa4","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"e5d01eb6dc2f699a395d3e731c58a9b3bb4e269f","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"93bbf2ed428142aa9a9693721230b28571678bf8","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"94d90fb06b94a90c176270d38861bcba34ce377d","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/usb/dvb-usb/dvb-usb-init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.19"},{"lessThan":"2.6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.9.*","status":"unaffected","version":"4.9.337","versionType":"semver"},{"lessThanOrEqual":"4.14.*","status":"unaffected","version":"4.14.303","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.270","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.229","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.163","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.86","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-usb: fix memory leak in dvb_usb_adapter_init()\n\nSyzbot reports a memory leak in \"dvb_usb_adapter_init()\".\nThe leak is due to not accounting for and freeing current iteration's\nadapter->priv in case of an error. Currently if an error occurs,\nit will exit before incrementing \"num_adapters_initalized\",\nwhich is used as a reference counter to free all adap->priv\nin \"dvb_usb_adapter_exit()\". There are multiple error paths that\ncan exit from before incrementing the counter. Including the\nerror handling paths for \"dvb_usb_adapter_stream_init()\",\n\"dvb_usb_adapter_dvb_init()\" and \"dvb_usb_adapter_frontend_init()\"\nwithin \"dvb_usb_adapter_init()\".\n\nThis means that in case of an error in any of these functions the\ncurrent iteration is not accounted for and the current iteration's\nadap->priv is not freed.\n\nFix this by freeing the current iteration's adap->priv in the\n\"stream_init_err:\" label in the error path. The rest of the\n(accounted for) adap->priv objects are freed in dvb_usb_adapter_exit()\nas expected using the num_adapters_initalized variable.\n\nSyzbot report:\n\nBUG: memory leak\nunreferenced object 0xffff8881172f1a00 (size 512):\n comm \"kworker/0:2\", pid 139, jiffies 4294994873 (age 10.960s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\nbacktrace:\n [] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline]\n [] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline]\n [] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308\n [] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883\n [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n [] call_driver_probe drivers/base/dd.c:542 [inline]\n [] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621\n [] really_probe drivers/base/dd.c:583 [inline]\n [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752\n [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782\n [] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899\n [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427\n [] __device_attach+0x122/0x260 drivers/base/dd.c:970\n [] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487\n [] device_add+0x5fb/0xdf0 drivers/base/core.c:3405\n [] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170\n [] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n [] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n [] call_driver_probe drivers/base/dd.c:542 [inline]\n [] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621\n [] really_probe drivers/base/dd.c:583 [inline]\n [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752"}],"id":"CVE-2022-50626","lastModified":"2026-06-17T05:23:53.550","metrics":{},"published":"2025-12-08T02:15:48.653","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/17217737c174883dd975885ab4bee4b00f517239"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/21b6b0c9f3796e6917e90db403dae9e74025fc40"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/733bc9e226da2a7f43b10031b8ebfc26d89ec4bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7d7ab25ead969594df05fb09ee46ca931d46c5c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/93bbf2ed428142aa9a9693721230b28571678bf8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/94d90fb06b94a90c176270d38861bcba34ce377d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d0af6220bb1eed8225a5511de5a3bd386b94afa4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e5a49140035591d13ff57a7537c65217e5af0d15"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e5d01eb6dc2f699a395d3e731c58a9b3bb4e269f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/usb/dvb-usb/dvb-usb-init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"733bc9e226da2a7f43b10031b8ebfc26d89ec4bd","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"e5a49140035591d13ff57a7537c65217e5af0d15","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"21b6b0c9f3796e6917e90db403dae9e74025fc40","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"17217737c174883dd975885ab4bee4b00f517239","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"7d7ab25ead969594df05fb09ee46ca931d46c5c8","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"d0af6220bb1eed8225a5511de5a3bd386b94afa4","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"e5d01eb6dc2f699a395d3e731c58a9b3bb4e269f","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"93bbf2ed428142aa9a9693721230b28571678bf8","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"},{"lessThan":"94d90fb06b94a90c176270d38861bcba34ce377d","status":"affected","version":"4d43e13f723e12734257277cc38497fab1efc605","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/usb/dvb-usb/dvb-usb-init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.19"},{"lessThan":"2.6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.9.*","status":"unaffected","version":"4.9.337","versionType":"semver"},{"lessThanOrEqual":"4.14.*","status":"unaffected","version":"4.14.303","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.270","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.229","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.163","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.86","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-usb: fix memory leak in dvb_usb_adapter_init()\n\nSyzbot reports a memory leak in \"dvb_usb_adapter_init()\".\nThe leak is due to not accounting for and freeing current iteration's\nadapter->priv in case of an error. Currently if an error occurs,\nit will exit before incrementing \"num_adapters_initalized\",\nwhich is used as a reference counter to free all adap->priv\nin \"dvb_usb_adapter_exit()\". There are multiple error paths that\ncan exit from before incrementing the counter. Including the\nerror handling paths for \"dvb_usb_adapter_stream_init()\",\n\"dvb_usb_adapter_dvb_init()\" and \"dvb_usb_adapter_frontend_init()\"\nwithin \"dvb_usb_adapter_init()\".\n\nThis means that in case of an error in any of these functions the\ncurrent iteration is not accounted for and the current iteration's\nadap->priv is not freed.\n\nFix this by freeing the current iteration's adap->priv in the\n\"stream_init_err:\" label in the error path. The rest of the\n(accounted for) adap->priv objects are freed in dvb_usb_adapter_exit()\nas expected using the num_adapters_initalized variable.\n\nSyzbot report:\n\nBUG: memory leak\nunreferenced object 0xffff8881172f1a00 (size 512):\n comm \"kworker/0:2\", pid 139, jiffies 4294994873 (age 10.960s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\nbacktrace:\n [] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline]\n [] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline]\n [] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308\n [] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883\n [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n [] call_driver_probe drivers/base/dd.c:542 [inline]\n [] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621\n [] really_probe drivers/base/dd.c:583 [inline]\n [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752\n [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782\n [] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899\n [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427\n [] __device_attach+0x122/0x260 drivers/base/dd.c:970\n [] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487\n [] device_add+0x5fb/0xdf0 drivers/base/core.c:3405\n [] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170\n [] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n [] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n [] call_driver_probe drivers/base/dd.c:542 [inline]\n [] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621\n [] really_probe drivers/base/dd.c:583 [inline]\n [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: dvb-usb: corrección de fuga de memoria en dvb_usb_adapter_init()\n\nSyzbot informa una fuga de memoria en ’dvb_usb_adapter_init()’.\nLa fuga se debe a no contabilizar y liberar el adapter -> priv de la iteración actual en caso de un error. Actualmente, si ocurre un error, saldrá antes de incrementar ’num_adapters_initalized’, que se utiliza como contador de referencia para liberar todos los adap -> priv en ’dvb_usb_adapter_exit()’. Existen múltiples rutas de error que pueden salir antes de incrementar el contador. Incluyendo las rutas de manejo de errores para ’dvb_usb_adapter_stream_init()’, ’dvb_usb_adapter_dvb_init()’ y ’dvb_usb_adapter_frontend_init()’ dentro de ’dvb_usb_adapter_init()’.\n\nEsto significa que en caso de un error en cualquiera de estas funciones, la iteración actual no se contabiliza y el adap -> priv de la iteración actual no se libera.\n\nSe corrige esto liberando el adap -> priv de la iteración actual en la etiqueta ’stream_init_err:’ en la ruta de error. El resto de los objetos adap -> priv (contabilizados) se liberan en dvb_usb_adapter_exit() como se espera utilizando la variable num_adapters_initalized.\n\nInforme de Syzbot:\n\nERROR: fuga de memoria\nobjeto sin referencia 0x ffff8881172f1a00 (tamaño 512):\n comm ’kworker/0:2’, pid 139, jiffies 4294994873 (antigüedad 10.960s)\n volcado hexadecimal (primeros 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\nrastreo de pila:\n [[ffffffff844af012]] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline]\n [[ffffffff844af012]] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline]\n [[ffffffff844af012]] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308\n [[ffffffff830db21d]] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883\n [[ffffffff82d3fdc7]] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n [[ffffffff8274ab37]] call_driver_probe drivers/base/dd.c:542 [inline]\n [[ffffffff8274ab37]] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621\n [[ffffffff8274ae6c]] really_probe drivers/base/dd.c:583 [inline]\n [[ffffffff8274ae6c]] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752\n [[ffffffff8274af6a]] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782\n [[ffffffff8274b786]] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899\n [[ffffffff82747c87]] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427\n [[ffffffff8274b352]] __device_attach+0x122/0x260 drivers/base/dd.c:970\n [[ffffffff827498f6]] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487\n [[ffffffff82745cdb]] device_add+0x5fb/0xdf0 drivers/base/core.c:3405\n [[ffffffff82d3d202]] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170\n [[ffffffff82d4dbfc]] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n [[ffffffff82d3f49c]] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n [[ffffffff8274ab37]] call_driver_probe drivers/base/dd.c:542 [inline]\n [[ffffffff8274ab37]] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621\n [[ffffffff8274ae6c]] really_probe drivers/base/dd.c:583 [inline]\n [[ffffffff8274ae6c]] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752"}],"id":"CVE-2022-50626","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-08T02:15:48.653","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/17217737c174883dd975885ab4bee4b00f517239"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/21b6b0c9f3796e6917e90db403dae9e74025fc40"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/733bc9e226da2a7f43b10031b8ebfc26d89ec4bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7d7ab25ead969594df05fb09ee46ca931d46c5c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/93bbf2ed428142aa9a9693721230b28571678bf8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/94d90fb06b94a90c176270d38861bcba34ce377d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d0af6220bb1eed8225a5511de5a3bd386b94afa4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e5a49140035591d13ff57a7537c65217e5af0d15"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e5d01eb6dc2f699a395d3e731c58a9b3bb4e269f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50627.json b/data/2022/CVE-2022-50627.json index 503ac4c760..a638481278 100644 --- a/data/2022/CVE-2022-50627.json +++ b/data/2022/CVE-2022-50627.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d6ea1ca1d456bb661e5a9d104e69d2c261161115","status":"affected","version":"01d2f285e3e5b629df9c61514e7ee07a54d0eed9","versionType":"git"},{"lessThan":"9089c3080a98f1452335e08b8014a28003a211ce","status":"affected","version":"01d2f285e3e5b629df9c61514e7ee07a54d0eed9","versionType":"git"},{"lessThan":"950b43f8bd8a4d476d2da6d2a083a89bcd3c90d7","status":"affected","version":"01d2f285e3e5b629df9c61514e7ee07a54d0eed9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.16","versionType":"semver"},{"lessThanOrEqual":"6.2.*","status":"unaffected","version":"6.2.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix monitor mode bringup crash\n\nWhen the interface is brought up in monitor mode, it leads\nto NULL pointer dereference crash. This crash happens when\nthe packet type is extracted for a SKB. This extraction\nwhich is present in the received msdu delivery path,is\nnot needed for the monitor ring packets since they are\nall RAW packets. Hence appending the flags with\n\"RX_FLAG_ONLY_MONITOR\" to skip that extraction.\n\nObserved calltrace:\n\nUnable to handle kernel NULL pointer dereference at virtual address\n0000000000000064\nMem abort info:\n ESR = 0x0000000096000004\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x04: level 0 translation fault\nData abort info:\n ISV = 0, ISS = 0x00000004\n CM = 0, WnR = 0\nuser pgtable: 4k pages, 48-bit VAs, pgdp=0000000048517000\n[0000000000000064] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1] PREEMPT SMP\nModules linked in: ath11k_pci ath11k qmi_helpers\nCPU: 2 PID: 1781 Comm: napi/-271 Not tainted\n6.1.0-rc5-wt-ath-656295-gef907406320c-dirty #6\nHardware name: Qualcomm Technologies, Inc. IPQ8074/AP-HK10-C2 (DT)\npstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k]\nlr : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x5c/0x60 [ath11k]\nsp : ffff80000ef5bb10\nx29: ffff80000ef5bb10 x28: 0000000000000000 x27: ffff000007baafa0\nx26: ffff000014a91ed0 x25: 0000000000000000 x24: 0000000000000000\nx23: ffff800002b77378 x22: ffff000014a91ec0 x21: ffff000006c8d600\nx20: 0000000000000000 x19: ffff800002b77740 x18: 0000000000000006\nx17: 736564203634343a x16: 656e694c20657079 x15: 0000000000000143\nx14: 00000000ffffffea x13: ffff80000ef5b8b8 x12: ffff80000ef5b8c8\nx11: ffff80000a591d30 x10: ffff80000a579d40 x9 : c0000000ffffefff\nx8 : 0000000000000003 x7 : 0000000000017fe8 x6 : ffff80000a579ce8\nx5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\nx2 : 3a35ec12ed7f8900 x1 : 0000000000000000 x0 : 0000000000000052\nCall trace:\n ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k]\n ath11k_dp_rx_deliver_msdu.isra.42+0xa4/0x3d0 [ath11k]\n ath11k_dp_rx_mon_deliver.isra.43+0x2f8/0x458 [ath11k]\n ath11k_dp_rx_process_mon_rings+0x310/0x4c0 [ath11k]\n ath11k_dp_service_srng+0x234/0x338 [ath11k]\n ath11k_pcic_ext_grp_napi_poll+0x30/0xb8 [ath11k]\n __napi_poll+0x5c/0x190\n napi_threaded_poll+0xf0/0x118\n kthread+0xf4/0x110\n ret_from_fork+0x10/0x20\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1"}],"id":"CVE-2022-50627","lastModified":"2026-08-15T13:17:38.983","metrics":{},"published":"2025-12-08T02:15:48.797","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9089c3080a98f1452335e08b8014a28003a211ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/950b43f8bd8a4d476d2da6d2a083a89bcd3c90d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d6ea1ca1d456bb661e5a9d104e69d2c261161115"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d6ea1ca1d456bb661e5a9d104e69d2c261161115","status":"affected","version":"01d2f285e3e5b629df9c61514e7ee07a54d0eed9","versionType":"git"},{"lessThan":"9089c3080a98f1452335e08b8014a28003a211ce","status":"affected","version":"01d2f285e3e5b629df9c61514e7ee07a54d0eed9","versionType":"git"},{"lessThan":"950b43f8bd8a4d476d2da6d2a083a89bcd3c90d7","status":"affected","version":"01d2f285e3e5b629df9c61514e7ee07a54d0eed9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.16","versionType":"semver"},{"lessThanOrEqual":"6.2.*","status":"unaffected","version":"6.2.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix monitor mode bringup crash\n\nWhen the interface is brought up in monitor mode, it leads\nto NULL pointer dereference crash. This crash happens when\nthe packet type is extracted for a SKB. This extraction\nwhich is present in the received msdu delivery path,is\nnot needed for the monitor ring packets since they are\nall RAW packets. Hence appending the flags with\n\"RX_FLAG_ONLY_MONITOR\" to skip that extraction.\n\nObserved calltrace:\n\nUnable to handle kernel NULL pointer dereference at virtual address\n0000000000000064\nMem abort info:\n ESR = 0x0000000096000004\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x04: level 0 translation fault\nData abort info:\n ISV = 0, ISS = 0x00000004\n CM = 0, WnR = 0\nuser pgtable: 4k pages, 48-bit VAs, pgdp=0000000048517000\n[0000000000000064] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1] PREEMPT SMP\nModules linked in: ath11k_pci ath11k qmi_helpers\nCPU: 2 PID: 1781 Comm: napi/-271 Not tainted\n6.1.0-rc5-wt-ath-656295-gef907406320c-dirty #6\nHardware name: Qualcomm Technologies, Inc. IPQ8074/AP-HK10-C2 (DT)\npstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k]\nlr : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x5c/0x60 [ath11k]\nsp : ffff80000ef5bb10\nx29: ffff80000ef5bb10 x28: 0000000000000000 x27: ffff000007baafa0\nx26: ffff000014a91ed0 x25: 0000000000000000 x24: 0000000000000000\nx23: ffff800002b77378 x22: ffff000014a91ec0 x21: ffff000006c8d600\nx20: 0000000000000000 x19: ffff800002b77740 x18: 0000000000000006\nx17: 736564203634343a x16: 656e694c20657079 x15: 0000000000000143\nx14: 00000000ffffffea x13: ffff80000ef5b8b8 x12: ffff80000ef5b8c8\nx11: ffff80000a591d30 x10: ffff80000a579d40 x9 : c0000000ffffefff\nx8 : 0000000000000003 x7 : 0000000000017fe8 x6 : ffff80000a579ce8\nx5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\nx2 : 3a35ec12ed7f8900 x1 : 0000000000000000 x0 : 0000000000000052\nCall trace:\n ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k]\n ath11k_dp_rx_deliver_msdu.isra.42+0xa4/0x3d0 [ath11k]\n ath11k_dp_rx_mon_deliver.isra.43+0x2f8/0x458 [ath11k]\n ath11k_dp_rx_process_mon_rings+0x310/0x4c0 [ath11k]\n ath11k_dp_service_srng+0x234/0x338 [ath11k]\n ath11k_pcic_ext_grp_napi_poll+0x30/0xb8 [ath11k]\n __napi_poll+0x5c/0x190\n napi_threaded_poll+0xf0/0x118\n kthread+0xf4/0x110\n ret_from_fork+0x10/0x20\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: ath11k: corregir fallo al iniciar el modo monitor\n\nCuando la interfaz se inicia en modo monitor, provoca un fallo por desreferencia de puntero NULL. Este fallo ocurre cuando el tipo de paquete se extrae para un SKB. Esta extracción, que está presente en la ruta de entrega de msdu recibidos, no es necesaria para los paquetes del anillo de monitor, ya que todos son paquetes RAW. Por lo tanto, se añaden las banderas con ’RX_FLAG_ONLY_MONITOR’ para omitir esa extracción.\n\nRastreo de llamadas observado:\n\nNo se puede manejar la desreferencia de puntero NULL del kernel en la dirección virtual 0000000000000064\nInformación de aborto de memoria:\n ESR = 0x 0000000096000004\n EC = 0x25: DABT (EL actual), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x04: fallo de traducción de nivel 0\nInformación de aborto de datos:\n ISV = 0, ISS = 0x 00000004\n CM = 0, WnR = 0\npgtable de usuario: páginas de 4k, VAs de 48 bits, pgdp=0000000048517000\n[0000000000000064] pgd=0000000000000000, p4d=0000000000000000\nError interno: Oops: 0000000096000004 [#1] PREEMPT SMP\nMódulos enlazados: ath11k_pci ath11k qmi_helpers\nCPU: 2 PID: 1781 Comm: napi/-271 No contaminado\n6.1.0-rc5-wt-ath-656295-gef907406320c-dirty #6\nNombre del hardware: Qualcomm Technologies, Inc. IPQ8074/AP-HK10-C2 (DT)\npstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=- -)\npc : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k]\nlr : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x5c/0x60 [ath11k]\nsp : ffff80000ef5bb10\nx29: ffff80000ef5bb10 x28: 0000000000000000 x27: ffff000007baafa0\nx26: ffff000014a91ed0 x25: 0000000000000000 x24: 0000000000000000\nx23: ffff800002b77378 x22: ffff000014a91ec0 x21: ffff000006c8d600\nx20: 0000000000000000 x19: ffff800002b77740 x18: 0000000000000006\nx17: 736564203634343a x16: 656e694c20657079 x15: 0000000000000143\nx14: 00000000ffffffea x13: ffff80000ef5b8b8 x12: ffff80000ef5b8c8\nx11: ffff80000a591d30 x10: ffff80000a579d40 x9 : c0000000ffffefff\nx8 : 0000000000000003 x7 : 0000000000017fe8 x6 : ffff80000a579ce8\nx5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\nx2 : 3a35ec12ed7f8900 x1 : 0000000000000000 x0 : 0000000000000052\nRastreo de llamadas:\n ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k]\n ath11k_dp_rx_deliver_msdu.isra.42+0xa4/0x3d0 [ath11k]\n ath11k_dp_rx_mon_deliver.isra.43+0x2f8/0x458 [ath11k]\n ath11k_dp_rx_process_mon_rings+0x310/0x4c0 [ath11k]\n ath11k_dp_service_srng+0x234/0x338 [ath11k]\n ath11k_pcic_ext_grp_napi_poll+0x30/0xb8 [ath11k]\n __napi_poll+0x5c/0x190\n napi_threaded_poll+0xf0/0x118\n kthread+0xf4/0x110\n ret_from_fork+0x10/0x20\n\nProbado en: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1"}],"id":"CVE-2022-50627","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-08T02:15:48.797","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9089c3080a98f1452335e08b8014a28003a211ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/950b43f8bd8a4d476d2da6d2a083a89bcd3c90d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d6ea1ca1d456bb661e5a9d104e69d2c261161115"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50628.json b/data/2022/CVE-2022-50628.json index b67080c162..e67fbde462 100644 --- a/data/2022/CVE-2022-50628.json +++ b/data/2022/CVE-2022-50628.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/gud/gud_pipe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"832f861a46039d50536dcfda0a9fb334b48d0f8b","status":"affected","version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","versionType":"git"},{"lessThan":"e1078b270d218f8d58efb4d78ea25a4d16ba3490","status":"affected","version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","versionType":"git"},{"lessThan":"951df98024f7272f85df5044eca7374f5b5b24ef","status":"affected","version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/gud/gud_pipe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.16","versionType":"semver"},{"lessThanOrEqual":"6.2.*","status":"unaffected","version":"6.2.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gud: Fix UBSAN warning\n\nUBSAN complains about invalid value for bool:\n\n[ 101.165172] [drm] Initialized gud 1.0.0 20200422 for 2-3.2:1.0 on minor 1\n[ 101.213360] gud 2-3.2:1.0: [drm] fb1: guddrmfb frame buffer device\n[ 101.213426] usbcore: registered new interface driver gud\n[ 101.989431] ================================================================================\n[ 101.989441] UBSAN: invalid-load in linux/include/linux/iosys-map.h:253:9\n[ 101.989447] load of value 121 is not a valid value for type '_Bool'\n[ 101.989451] CPU: 1 PID: 455 Comm: kworker/1:6 Not tainted 5.18.0-rc5-gud-5.18-rc5 #3\n[ 101.989456] Hardware name: Hewlett-Packard HP EliteBook 820 G1/1991, BIOS L71 Ver. 01.44 04/12/2018\n[ 101.989459] Workqueue: events_long gud_flush_work [gud]\n[ 101.989471] Call Trace:\n[ 101.989474] \n[ 101.989479] dump_stack_lvl+0x49/0x5f\n[ 101.989488] dump_stack+0x10/0x12\n[ 101.989493] ubsan_epilogue+0x9/0x3b\n[ 101.989498] __ubsan_handle_load_invalid_value.cold+0x44/0x49\n[ 101.989504] dma_buf_vmap.cold+0x38/0x3d\n[ 101.989511] ? find_busiest_group+0x48/0x300\n[ 101.989520] drm_gem_shmem_vmap+0x76/0x1b0 [drm_shmem_helper]\n[ 101.989528] drm_gem_shmem_object_vmap+0x9/0xb [drm_shmem_helper]\n[ 101.989535] drm_gem_vmap+0x26/0x60 [drm]\n[ 101.989594] drm_gem_fb_vmap+0x47/0x150 [drm_kms_helper]\n[ 101.989630] gud_prep_flush+0xc1/0x710 [gud]\n[ 101.989639] ? _raw_spin_lock+0x17/0x40\n[ 101.989648] gud_flush_work+0x1e0/0x430 [gud]\n[ 101.989653] ? __switch_to+0x11d/0x470\n[ 101.989664] process_one_work+0x21f/0x3f0\n[ 101.989673] worker_thread+0x200/0x3e0\n[ 101.989679] ? rescuer_thread+0x390/0x390\n[ 101.989684] kthread+0xfd/0x130\n[ 101.989690] ? kthread_complete_and_exit+0x20/0x20\n[ 101.989696] ret_from_fork+0x22/0x30\n[ 101.989706] \n[ 101.989708] ================================================================================\n\nThe source of this warning is in iosys_map_clear() called from\ndma_buf_vmap(). It conditionally sets values based on map->is_iomem. The\niosys_map variables are allocated uninitialized on the stack leading to\n->is_iomem having all kinds of values and not only 0/1.\n\nFix this by zeroing the iosys_map variables."}],"id":"CVE-2022-50628","lastModified":"2026-06-17T05:23:53.790","metrics":{},"published":"2025-12-08T02:15:48.927","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/832f861a46039d50536dcfda0a9fb334b48d0f8b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/951df98024f7272f85df5044eca7374f5b5b24ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e1078b270d218f8d58efb4d78ea25a4d16ba3490"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/gud/gud_pipe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"832f861a46039d50536dcfda0a9fb334b48d0f8b","status":"affected","version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","versionType":"git"},{"lessThan":"e1078b270d218f8d58efb4d78ea25a4d16ba3490","status":"affected","version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","versionType":"git"},{"lessThan":"951df98024f7272f85df5044eca7374f5b5b24ef","status":"affected","version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/gud/gud_pipe.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.16","versionType":"semver"},{"lessThanOrEqual":"6.2.*","status":"unaffected","version":"6.2.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gud: Fix UBSAN warning\n\nUBSAN complains about invalid value for bool:\n\n[ 101.165172] [drm] Initialized gud 1.0.0 20200422 for 2-3.2:1.0 on minor 1\n[ 101.213360] gud 2-3.2:1.0: [drm] fb1: guddrmfb frame buffer device\n[ 101.213426] usbcore: registered new interface driver gud\n[ 101.989431] ================================================================================\n[ 101.989441] UBSAN: invalid-load in linux/include/linux/iosys-map.h:253:9\n[ 101.989447] load of value 121 is not a valid value for type '_Bool'\n[ 101.989451] CPU: 1 PID: 455 Comm: kworker/1:6 Not tainted 5.18.0-rc5-gud-5.18-rc5 #3\n[ 101.989456] Hardware name: Hewlett-Packard HP EliteBook 820 G1/1991, BIOS L71 Ver. 01.44 04/12/2018\n[ 101.989459] Workqueue: events_long gud_flush_work [gud]\n[ 101.989471] Call Trace:\n[ 101.989474] \n[ 101.989479] dump_stack_lvl+0x49/0x5f\n[ 101.989488] dump_stack+0x10/0x12\n[ 101.989493] ubsan_epilogue+0x9/0x3b\n[ 101.989498] __ubsan_handle_load_invalid_value.cold+0x44/0x49\n[ 101.989504] dma_buf_vmap.cold+0x38/0x3d\n[ 101.989511] ? find_busiest_group+0x48/0x300\n[ 101.989520] drm_gem_shmem_vmap+0x76/0x1b0 [drm_shmem_helper]\n[ 101.989528] drm_gem_shmem_object_vmap+0x9/0xb [drm_shmem_helper]\n[ 101.989535] drm_gem_vmap+0x26/0x60 [drm]\n[ 101.989594] drm_gem_fb_vmap+0x47/0x150 [drm_kms_helper]\n[ 101.989630] gud_prep_flush+0xc1/0x710 [gud]\n[ 101.989639] ? _raw_spin_lock+0x17/0x40\n[ 101.989648] gud_flush_work+0x1e0/0x430 [gud]\n[ 101.989653] ? __switch_to+0x11d/0x470\n[ 101.989664] process_one_work+0x21f/0x3f0\n[ 101.989673] worker_thread+0x200/0x3e0\n[ 101.989679] ? rescuer_thread+0x390/0x390\n[ 101.989684] kthread+0xfd/0x130\n[ 101.989690] ? kthread_complete_and_exit+0x20/0x20\n[ 101.989696] ret_from_fork+0x22/0x30\n[ 101.989706] \n[ 101.989708] ================================================================================\n\nThe source of this warning is in iosys_map_clear() called from\ndma_buf_vmap(). It conditionally sets values based on map->is_iomem. The\niosys_map variables are allocated uninitialized on the stack leading to\n->is_iomem having all kinds of values and not only 0/1.\n\nFix this by zeroing the iosys_map variables."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/gud: Corregir advertencia de UBSAN\n\nUBSAN se queja de un valor no válido para bool:\n\n[ 101.165172] [drm] Initialized gud 1.0.0 20200422 for 2-3.2:1.0 on minor 1\n[ 101.213360] gud 2-3.2:1.0: [drm] fb1: guddrmfb frame buffer device\n[ 101.213426] usbcore: registered new interface driver gud\n[ 101.989431] ================================================================================\n[ 101.989441] UBSAN: invalid-load in linux/include/linux/iosys-map.h:253:9\n[ 101.989447] load of value 121 is not a valid value for type ’_Bool’\n[ 101.989451] CPU: 1 PID: 455 Comm: kworker/1:6 Not tainted 5.18.0-rc5-gud-5.18-rc5 #3\n[ 101.989456] Hardware name: Hewlett-Packard HP EliteBook 820 G1/1991, BIOS L71 Ver. 01.44 04/12/2018\n[ 101.989459] Workqueue: events_long gud_flush_work [gud]\n[ 101.989471] Call Trace:\n[ 101.989474] [TASK]\n[ 101.989479] dump_stack_lvl+0x49/0x5f\n[ 101.989488] dump_stack+0x10/0x12\n[ 101.989493] ubsan_epilogue+0x9/0x3b\n[ 101.989498] __ubsan_handle_load_invalid_value.cold+0x44/0x49\n[ 101.989504] dma_buf_vmap.cold+0x38/0x3d\n[ 101.989511] ? find_busiest_group+0x48/0x300\n[ 101.989520] drm_gem_shmem_vmap+0x76/0x1b0 [drm_shmem_helper]\n[ 101.989528] drm_gem_shmem_object_vmap+0x9/0xb [drm_shmem_helper]\n[ 101.989535] drm_gem_vmap+0x26/0x60 [drm]\n[ 101.989594] drm_gem_fb_vmap+0x47/0x150 [drm_kms_helper]\n[ 101.989630] gud_prep_flush+0xc1/0x710 [gud]\n[ 101.989639] ? _raw_spin_lock+0x17/0x40\n[ 101.989648] gud_flush_work+0x1e0/0x430 [gud]\n[ 101.989653] ? __switch_to+0x11d/0x470\n[ 101.989664] process_one_work+0x21f/0x3f0\n[ 101.989673] worker_thread+0x200/0x3e0\n[ 101.989679] ? rescuer_thread+0x390/0x390\n[ 101.989684] kthread+0xfd/0x130\n[ 101.989690] ? kthread_complete_and_exit+0x20/0x20\n[ 101.989696] ret_from_fork+0x22/0x30\n[ 101.989706] [/TASK]\n[ 101.989708] ================================================================================\n\nLa fuente de esta advertencia está en iosys_map_clear() llamada desde dma_buf_vmap(). Establece valores condicionalmente basándose en map -> is_iomem. Las variables iosys_map se asignan sin inicializar en la pila, lo que lleva a que -> is_iomem tenga todo tipo de valores y no solo 0/1.\n\nSolucione esto poniendo a cero las variables iosys_map."}],"id":"CVE-2022-50628","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-08T02:15:48.927","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/832f861a46039d50536dcfda0a9fb334b48d0f8b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/951df98024f7272f85df5044eca7374f5b5b24ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e1078b270d218f8d58efb4d78ea25a4d16ba3490"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50629.json b/data/2022/CVE-2022-50629.json index e47c8088a7..72b956911f 100644 --- a/data/2022/CVE-2022-50629.json +++ b/data/2022/CVE-2022-50629.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/rsi/rsi_91x_coex.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"98259e0b6cf7f021da9fe4e11fbcce6ad6705ffe","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"},{"lessThan":"fe4d7280cf4ddbea6536b596297c07662c7856fc","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"},{"lessThan":"efc8df970561ff708379b89b348e16d3b410cc7b","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"},{"lessThan":"b56e60b3b158a93bc713437e8e466f401ff8cc9f","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"},{"lessThan":"c4f1ded67a90fb3b2e679e2c90b78921d9246044","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"},{"lessThan":"ace789b1d465fae104cd37e49f6e1bcd1c8ff417","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"},{"lessThan":"956fb851a6e19da5ab491e19c1bc323bb2c2cf6f","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/rsi/rsi_91x_coex.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.17"},{"lessThan":"4.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.276","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.235","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.173","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.99","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.16","versionType":"semver"},{"lessThanOrEqual":"6.2.*","status":"unaffected","version":"6.2.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: Fix memory leak in rsi_coex_attach()\n\nThe coex_cb needs to be freed when rsi_create_kthread() failed in\nrsi_coex_attach()."}],"id":"CVE-2022-50629","lastModified":"2026-06-17T05:23:53.890","metrics":{},"published":"2025-12-08T02:15:49.063","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/956fb851a6e19da5ab491e19c1bc323bb2c2cf6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/98259e0b6cf7f021da9fe4e11fbcce6ad6705ffe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ace789b1d465fae104cd37e49f6e1bcd1c8ff417"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b56e60b3b158a93bc713437e8e466f401ff8cc9f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c4f1ded67a90fb3b2e679e2c90b78921d9246044"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/efc8df970561ff708379b89b348e16d3b410cc7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fe4d7280cf4ddbea6536b596297c07662c7856fc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/rsi/rsi_91x_coex.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"98259e0b6cf7f021da9fe4e11fbcce6ad6705ffe","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"},{"lessThan":"fe4d7280cf4ddbea6536b596297c07662c7856fc","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"},{"lessThan":"efc8df970561ff708379b89b348e16d3b410cc7b","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"},{"lessThan":"b56e60b3b158a93bc713437e8e466f401ff8cc9f","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"},{"lessThan":"c4f1ded67a90fb3b2e679e2c90b78921d9246044","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"},{"lessThan":"ace789b1d465fae104cd37e49f6e1bcd1c8ff417","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"},{"lessThan":"956fb851a6e19da5ab491e19c1bc323bb2c2cf6f","status":"affected","version":"2108df3c4b1856588ca2e7f641900c2bbf38467e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/rsi/rsi_91x_coex.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.17"},{"lessThan":"4.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.276","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.235","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.173","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.99","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.16","versionType":"semver"},{"lessThanOrEqual":"6.2.*","status":"unaffected","version":"6.2.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.3","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: Fix memory leak in rsi_coex_attach()\n\nThe coex_cb needs to be freed when rsi_create_kthread() failed in\nrsi_coex_attach()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: rsi: Corrección de fuga de memoria en rsi_coex_attach()\n\nEl coex_cb necesita ser liberado cuando rsi_create_kthread() falló en rsi_coex_attach()."}],"id":"CVE-2022-50629","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-08T02:15:49.063","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/956fb851a6e19da5ab491e19c1bc323bb2c2cf6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/98259e0b6cf7f021da9fe4e11fbcce6ad6705ffe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ace789b1d465fae104cd37e49f6e1bcd1c8ff417"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b56e60b3b158a93bc713437e8e466f401ff8cc9f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c4f1ded67a90fb3b2e679e2c90b78921d9246044"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/efc8df970561ff708379b89b348e16d3b410cc7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fe4d7280cf4ddbea6536b596297c07662c7856fc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50631.json b/data/2022/CVE-2022-50631.json index 73fe98aeb6..7f7dd2fb3a 100644 --- a/data/2022/CVE-2022-50631.json +++ b/data/2022/CVE-2022-50631.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/riscv/include/asm/kexec.h","arch/riscv/kernel/elf_kexec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c66ad198b6497dee8f45d7ed5c03629c4525c7d0","status":"affected","version":"6261586e0c91db14c34f894f4bc48f2300cff1d4","versionType":"git"},{"lessThan":"dc387c34d8dd10b02a333df098f8fd9bba177a45","status":"affected","version":"6261586e0c91db14c34f894f4bc48f2300cff1d4","versionType":"git"},{"lessThan":"96df59b1ae23f5c11698c3c2159aeb2ecd4944a4","status":"affected","version":"6261586e0c91db14c34f894f4bc48f2300cff1d4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/riscv/include/asm/kexec.h","arch/riscv/kernel/elf_kexec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.18","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: kexec: Fix memory leak of fdt buffer\n\nThis is reported by kmemleak detector:\n\nunreferenced object 0xff60000082864000 (size 9588):\n comm \"kexec\", pid 146, jiffies 4294900634 (age 64.788s)\n hex dump (first 32 bytes):\n d0 0d fe ed 00 00 12 ed 00 00 00 48 00 00 11 40 ...........H...@\n 00 00 00 28 00 00 00 11 00 00 00 02 00 00 00 00 ...(............\n backtrace:\n [<00000000f95b17c4>] kmemleak_alloc+0x34/0x3e\n [<00000000b9ec8e3e>] kmalloc_order+0x9c/0xc4\n [<00000000a95cf02e>] kmalloc_order_trace+0x34/0xb6\n [<00000000f01e68b4>] __kmalloc+0x5c2/0x62a\n [<000000002bd497b2>] kvmalloc_node+0x66/0xd6\n [<00000000906542fa>] of_kexec_alloc_and_setup_fdt+0xa6/0x6ea\n [<00000000e1166bde>] elf_kexec_load+0x206/0x4ec\n [<0000000036548e09>] kexec_image_load_default+0x40/0x4c\n [<0000000079fbe1b4>] sys_kexec_file_load+0x1c4/0x322\n [<0000000040c62c03>] ret_from_syscall+0x0/0x2\n\nIn elf_kexec_load(), a buffer is allocated via kvmalloc() to store fdt.\nWhile it's not freed back to system when kexec kernel is reloaded or\nunloaded. Then memory leak is caused. Fix it by introducing riscv\nspecific function arch_kimage_file_post_load_cleanup(), and freeing the\nbuffer there."}],"id":"CVE-2022-50631","lastModified":"2026-06-17T05:23:54.080","metrics":{},"published":"2025-12-09T01:16:44.490","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/96df59b1ae23f5c11698c3c2159aeb2ecd4944a4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c66ad198b6497dee8f45d7ed5c03629c4525c7d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dc387c34d8dd10b02a333df098f8fd9bba177a45"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/riscv/include/asm/kexec.h","arch/riscv/kernel/elf_kexec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c66ad198b6497dee8f45d7ed5c03629c4525c7d0","status":"affected","version":"6261586e0c91db14c34f894f4bc48f2300cff1d4","versionType":"git"},{"lessThan":"dc387c34d8dd10b02a333df098f8fd9bba177a45","status":"affected","version":"6261586e0c91db14c34f894f4bc48f2300cff1d4","versionType":"git"},{"lessThan":"96df59b1ae23f5c11698c3c2159aeb2ecd4944a4","status":"affected","version":"6261586e0c91db14c34f894f4bc48f2300cff1d4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/riscv/include/asm/kexec.h","arch/riscv/kernel/elf_kexec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.18","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.4","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: kexec: Fix memory leak of fdt buffer\n\nThis is reported by kmemleak detector:\n\nunreferenced object 0xff60000082864000 (size 9588):\n comm \"kexec\", pid 146, jiffies 4294900634 (age 64.788s)\n hex dump (first 32 bytes):\n d0 0d fe ed 00 00 12 ed 00 00 00 48 00 00 11 40 ...........H...@\n 00 00 00 28 00 00 00 11 00 00 00 02 00 00 00 00 ...(............\n backtrace:\n [<00000000f95b17c4>] kmemleak_alloc+0x34/0x3e\n [<00000000b9ec8e3e>] kmalloc_order+0x9c/0xc4\n [<00000000a95cf02e>] kmalloc_order_trace+0x34/0xb6\n [<00000000f01e68b4>] __kmalloc+0x5c2/0x62a\n [<000000002bd497b2>] kvmalloc_node+0x66/0xd6\n [<00000000906542fa>] of_kexec_alloc_and_setup_fdt+0xa6/0x6ea\n [<00000000e1166bde>] elf_kexec_load+0x206/0x4ec\n [<0000000036548e09>] kexec_image_load_default+0x40/0x4c\n [<0000000079fbe1b4>] sys_kexec_file_load+0x1c4/0x322\n [<0000000040c62c03>] ret_from_syscall+0x0/0x2\n\nIn elf_kexec_load(), a buffer is allocated via kvmalloc() to store fdt.\nWhile it's not freed back to system when kexec kernel is reloaded or\nunloaded. Then memory leak is caused. Fix it by introducing riscv\nspecific function arch_kimage_file_post_load_cleanup(), and freeing the\nbuffer there."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRISC-V: kexec: Corrección de fuga de memoria del búfer fdt\n\nEsto es reportado por el detector kmemleak:\n\nobjeto sin referencia 0x ff60000082864000 (tamaño 9588):\n comm ’kexec’, pid 146, jiffies 4294900634 (antigüedad 64.788s)\n volcado hexadecimal (primeros 32 bytes):\n d0 0d fe ed 00 00 12 ed 00 00 00 48 00 00 11 40 ...........H...@\n 00 00 00 28 00 00 00 11 00 00 00 02 00 00 00 00 ...(............\n rastreo inverso:\n [[00000000f95b17c4]] kmemleak_alloc+0x34/0x3e\n [[00000000b9ec8e3e]] kmalloc_order+0x9c/0xc4\n [[00000000a95cf02e]] kmalloc_order_trace+0x34/0xb6\n [[00000000f01e68b4]] __kmalloc+0x5c2/0x62a\n [[000000002bd497b2]] kvmalloc_node+0x66/0xd6\n [[00000000906542fa]] of_kexec_alloc_and_setup_fdt+0xa6/0x6ea\n [[00000000e1166bde]] elf_kexec_load+0x206/0x4ec\n [[0000000036548e09]] kexec_image_load_default+0x40/0x4c\n [[0000000079fbe1b4]] sys_kexec_file_load+0x1c4/0x322\n [[0000000040c62c03]] ret_from_syscall+0x0/0x2\n\nEn elf_kexec_load(), se asigna un búfer mediante kvmalloc() para almacenar fdt. Sin embargo, no se libera de nuevo al sistema cuando el kernel kexec es recargado o descargado. Entonces se causa una fuga de memoria. Se corrige introduciendo la función específica de riscv arch_kimage_file_post_load_cleanup(), y liberando el búfer allí."}],"id":"CVE-2022-50631","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-09T01:16:44.490","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/96df59b1ae23f5c11698c3c2159aeb2ecd4944a4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c66ad198b6497dee8f45d7ed5c03629c4525c7d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/dc387c34d8dd10b02a333df098f8fd9bba177a45"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50632.json b/data/2022/CVE-2022-50632.json index f352119bb0..ea8991e8a7 100644 --- a/data/2022/CVE-2022-50632.json +++ b/data/2022/CVE-2022-50632.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/perf/marvell_cn10k_tad_pmu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"367404bfd1aa87b2a50059cd8edc6c12c367cd15","status":"affected","version":"036a7584bede317d0df6b854e4f531b7a2dd8b33","versionType":"git"},{"lessThan":"7772f4de934123ccd7c7cdc1dc4e46fdd5d767fb","status":"affected","version":"036a7584bede317d0df6b854e4f531b7a2dd8b33","versionType":"git"},{"lessThan":"973ae93d80d9d262f695eb485a1902b74c4b9098","status":"affected","version":"036a7584bede317d0df6b854e4f531b7a2dd8b33","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/perf/marvell_cn10k_tad_pmu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: perf: marvell_cn10k: Fix hotplug callback leak in tad_pmu_init()\n\ntad_pmu_init() won't remove the callback added by cpuhp_setup_state_multi()\nwhen platform_driver_register() failed. Remove the callback by\ncpuhp_remove_multi_state() in fail path.\n\nSimilar to the handling of arm_ccn_init() in commit 26242b330093 (\"bus:\narm-ccn: Prevent hotplug callback leak\")"}],"id":"CVE-2022-50632","lastModified":"2026-06-17T05:23:54.173","metrics":{},"published":"2025-12-09T01:16:45.330","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/367404bfd1aa87b2a50059cd8edc6c12c367cd15"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7772f4de934123ccd7c7cdc1dc4e46fdd5d767fb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/973ae93d80d9d262f695eb485a1902b74c4b9098"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/perf/marvell_cn10k_tad_pmu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"367404bfd1aa87b2a50059cd8edc6c12c367cd15","status":"affected","version":"036a7584bede317d0df6b854e4f531b7a2dd8b33","versionType":"git"},{"lessThan":"7772f4de934123ccd7c7cdc1dc4e46fdd5d767fb","status":"affected","version":"036a7584bede317d0df6b854e4f531b7a2dd8b33","versionType":"git"},{"lessThan":"973ae93d80d9d262f695eb485a1902b74c4b9098","status":"affected","version":"036a7584bede317d0df6b854e4f531b7a2dd8b33","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/perf/marvell_cn10k_tad_pmu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: perf: marvell_cn10k: Fix hotplug callback leak in tad_pmu_init()\n\ntad_pmu_init() won't remove the callback added by cpuhp_setup_state_multi()\nwhen platform_driver_register() failed. Remove the callback by\ncpuhp_remove_multi_state() in fail path.\n\nSimilar to the handling of arm_ccn_init() in commit 26242b330093 (\"bus:\narm-ccn: Prevent hotplug callback leak\")"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrivers: perf: marvell_cn10k: Corrección de fuga de callback de hotplug en tad_pmu_init()\n\ntad_pmu_init() no elimina el callback añadido por cpuhp_setup_state_multi() cuando platform_driver_register() falló. Eliminar el callback mediante cpuhp_remove_multi_state() en la ruta de fallo.\n\nSimilar al manejo de arm_ccn_init() en el commit 26242b330093 (’bus: arm-ccn: Prevent hotplug callback leak’)"}],"id":"CVE-2022-50632","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-09T01:16:45.330","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/367404bfd1aa87b2a50059cd8edc6c12c367cd15"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7772f4de934123ccd7c7cdc1dc4e46fdd5d767fb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/973ae93d80d9d262f695eb485a1902b74c4b9098"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50633.json b/data/2022/CVE-2022-50633.json index c63c9011ca..03eed83744 100644 --- a/data/2022/CVE-2022-50633.json +++ b/data/2022/CVE-2022-50633.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/dwc3/dwc3-qcom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f9089b95548f0272e02a89989c511e235561d051","status":"affected","version":"bea46b9815154ac47baf16b64022d791a4471375","versionType":"git"},{"lessThan":"56f6de394f0f57928cd401255a5c7866b68a77e3","status":"affected","version":"bea46b9815154ac47baf16b64022d791a4471375","versionType":"git"},{"lessThan":"8c39c8d23ff9fb1beb6e16cf0ae929c764538625","status":"affected","version":"bea46b9815154ac47baf16b64022d791a4471375","versionType":"git"},{"lessThan":"2f3b51189f7a7be5d822fb8c537d778c57eb9821","status":"affected","version":"bea46b9815154ac47baf16b64022d791a4471375","versionType":"git"},{"lessThan":"97a48da1619ba6bd42a0e5da0a03aa490a9496b1","status":"affected","version":"bea46b9815154ac47baf16b64022d791a4471375","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/dwc3/dwc3-qcom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.10"},{"lessThan":"5.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.163","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.87","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.17","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init\n\nof_icc_get() alloc resources for path handle, we should release it when not\nneed anymore. Like the release in dwc3_qcom_interconnect_exit() function.\nAdd icc_put() in error handling to fix this."}],"id":"CVE-2022-50633","lastModified":"2026-06-17T05:23:54.257","metrics":{},"published":"2025-12-09T01:16:45.460","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2f3b51189f7a7be5d822fb8c537d778c57eb9821"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/56f6de394f0f57928cd401255a5c7866b68a77e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8c39c8d23ff9fb1beb6e16cf0ae929c764538625"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/97a48da1619ba6bd42a0e5da0a03aa490a9496b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f9089b95548f0272e02a89989c511e235561d051"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/dwc3/dwc3-qcom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f9089b95548f0272e02a89989c511e235561d051","status":"affected","version":"bea46b9815154ac47baf16b64022d791a4471375","versionType":"git"},{"lessThan":"56f6de394f0f57928cd401255a5c7866b68a77e3","status":"affected","version":"bea46b9815154ac47baf16b64022d791a4471375","versionType":"git"},{"lessThan":"8c39c8d23ff9fb1beb6e16cf0ae929c764538625","status":"affected","version":"bea46b9815154ac47baf16b64022d791a4471375","versionType":"git"},{"lessThan":"2f3b51189f7a7be5d822fb8c537d778c57eb9821","status":"affected","version":"bea46b9815154ac47baf16b64022d791a4471375","versionType":"git"},{"lessThan":"97a48da1619ba6bd42a0e5da0a03aa490a9496b1","status":"affected","version":"bea46b9815154ac47baf16b64022d791a4471375","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/dwc3/dwc3-qcom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.10"},{"lessThan":"5.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.163","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.87","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.17","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init\n\nof_icc_get() alloc resources for path handle, we should release it when not\nneed anymore. Like the release in dwc3_qcom_interconnect_exit() function.\nAdd icc_put() in error handling to fix this."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: dwc3: qcom: Corrección de fuga de memoria en dwc3_qcom_interconnect_init\n\nof_icc_get() asigna recursos para el manejador de ruta, debemos liberarlos cuando ya no sean necesarios. Como la liberación en la función dwc3_qcom_interconnect_exit(). Añadir icc_put() en el manejo de errores para corregir esto."}],"id":"CVE-2022-50633","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-09T01:16:45.460","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2f3b51189f7a7be5d822fb8c537d778c57eb9821"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/56f6de394f0f57928cd401255a5c7866b68a77e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8c39c8d23ff9fb1beb6e16cf0ae929c764538625"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/97a48da1619ba6bd42a0e5da0a03aa490a9496b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f9089b95548f0272e02a89989c511e235561d051"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50634.json b/data/2022/CVE-2022-50634.json index 5f8c296372..af4cb8fa1f 100644 --- a/data/2022/CVE-2022-50634.json +++ b/data/2022/CVE-2022-50634.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/power/supply/cw2015_battery.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f7e2ba8ed08138102f21f3fe6414498c93177fd8","status":"affected","version":"b4c7715c10c106a041b0b3fabd26151c214ea394","versionType":"git"},{"lessThan":"5150b76aa2eb8bb8feb7f7a048417f9d39c3dd04","status":"affected","version":"b4c7715c10c106a041b0b3fabd26151c214ea394","versionType":"git"},{"lessThan":"97f2b4ddb0aa700d673691a7d5e44d226d22bab7","status":"affected","version":"b4c7715c10c106a041b0b3fabd26151c214ea394","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/power/supply/cw2015_battery.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: cw2015: Fix potential null-ptr-deref in cw_bat_probe()\n\ncw_bat_probe() calls create_singlethread_workqueue() and not checked the\nret value, which may return NULL. And a null-ptr-deref may happen:\n\ncw_bat_probe()\n create_singlethread_workqueue() # failed, cw_bat->wq is NULL\n queue_delayed_work()\n queue_delayed_work_on()\n __queue_delayed_work() # warning here, but continue\n __queue_work() # access wq->flags, null-ptr-deref\n\nCheck the ret value and return -ENOMEM if it is NULL."}],"id":"CVE-2022-50634","lastModified":"2026-06-17T05:23:54.343","metrics":{},"published":"2025-12-09T01:16:45.590","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5150b76aa2eb8bb8feb7f7a048417f9d39c3dd04"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/97f2b4ddb0aa700d673691a7d5e44d226d22bab7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f7e2ba8ed08138102f21f3fe6414498c93177fd8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/power/supply/cw2015_battery.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f7e2ba8ed08138102f21f3fe6414498c93177fd8","status":"affected","version":"b4c7715c10c106a041b0b3fabd26151c214ea394","versionType":"git"},{"lessThan":"5150b76aa2eb8bb8feb7f7a048417f9d39c3dd04","status":"affected","version":"b4c7715c10c106a041b0b3fabd26151c214ea394","versionType":"git"},{"lessThan":"97f2b4ddb0aa700d673691a7d5e44d226d22bab7","status":"affected","version":"b4c7715c10c106a041b0b3fabd26151c214ea394","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/power/supply/cw2015_battery.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.16","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: cw2015: Fix potential null-ptr-deref in cw_bat_probe()\n\ncw_bat_probe() calls create_singlethread_workqueue() and not checked the\nret value, which may return NULL. And a null-ptr-deref may happen:\n\ncw_bat_probe()\n create_singlethread_workqueue() # failed, cw_bat->wq is NULL\n queue_delayed_work()\n queue_delayed_work_on()\n __queue_delayed_work() # warning here, but continue\n __queue_work() # access wq->flags, null-ptr-deref\n\nCheck the ret value and return -ENOMEM if it is NULL."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\npower: supply: cw2015: Corregir posible desreferencia de puntero nulo en cw_bat_probe()\n\ncw_bat_probe() llama a create_singlethread_workqueue() y no verificó el valor de retorno, el cual puede devolver NULL. Y una desreferencia de puntero nulo puede ocurrir:\n\ncw_bat_probe()\n create_singlethread_workqueue() # falló, cw_bat -> wq es NULL\n queue_delayed_work()\n queue_delayed_work_on()\n __queue_delayed_work() # advertencia aquí, pero continúa\n __queue_work() # acceso a wq -> flags, desreferencia de puntero nulo\n\nVerificar el valor de retorno y devolver -ENOMEM si es NULL."}],"id":"CVE-2022-50634","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-09T01:16:45.590","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5150b76aa2eb8bb8feb7f7a048417f9d39c3dd04"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/97f2b4ddb0aa700d673691a7d5e44d226d22bab7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f7e2ba8ed08138102f21f3fe6414498c93177fd8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2022/CVE-2022-50739.json b/data/2022/CVE-2022-50739.json index 37b617370e..07d3c941e4 100644 --- a/data/2022/CVE-2022-50739.json +++ b/data/2022/CVE-2022-50739.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ntfs3/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f62506f5e45afbb01c84c3f28a2878b320a0b0f7","status":"affected","version":"82cae269cfa953032fbb8980a7d554d60fb00b17","versionType":"git"},{"lessThan":"9f24743ddcdd3683b0a6b16e1439ad091dc3489b","status":"affected","version":"82cae269cfa953032fbb8980a7d554d60fb00b17","versionType":"git"},{"lessThan":"a7b23037b38b577d9a4372e0c6b7c9fe808070c1","status":"affected","version":"82cae269cfa953032fbb8980a7d554d60fb00b17","versionType":"git"},{"lessThan":"c1ca8ef0262b25493631ecbd9cb8c9893e1481a1","status":"affected","version":"82cae269cfa953032fbb8980a7d554d60fb00b17","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ntfs3/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.87","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.17","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Add null pointer check for inode operations\n\nThis adds a sanity check for the i_op pointer of the inode which is\nreturned after reading Root directory MFT record. We should check the\ni_op is valid before trying to create the root dentry, otherwise we may\nencounter a NPD while mounting a image with a funny Root directory MFT\nrecord.\n\n[ 114.484325] BUG: kernel NULL pointer dereference, address: 0000000000000008\n[ 114.484811] #PF: supervisor read access in kernel mode\n[ 114.485084] #PF: error_code(0x0000) - not-present page\n[ 114.485606] PGD 0 P4D 0\n[ 114.485975] Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI\n[ 114.486570] CPU: 0 PID: 237 Comm: mount Tainted: G B 6.0.0-rc4 #28\n[ 114.486977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[ 114.488169] RIP: 0010:d_flags_for_inode+0xe0/0x110\n[ 114.488816] Code: 24 f7 ff 49 83 3e 00 74 41 41 83 cd 02 66 44 89 6b 02 eb 92 48 8d 7b 20 e8 6d 24 f7 ff 4c 8b 73 20 49 8d 7e 08 e8 60 241\n[ 114.490326] RSP: 0018:ffff8880065e7aa8 EFLAGS: 00000296\n[ 114.490695] RAX: 0000000000000001 RBX: ffff888008ccd750 RCX: ffffffff84af2aea\n[ 114.490986] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff87abd020\n[ 114.491364] RBP: ffff8880065e7ac8 R08: 0000000000000001 R09: fffffbfff0f57a05\n[ 114.491675] R10: ffffffff87abd027 R11: fffffbfff0f57a04 R12: 0000000000000000\n[ 114.491954] R13: 0000000000000008 R14: 0000000000000000 R15: ffff888008ccd750\n[ 114.492397] FS: 00007fdc8a627e40(0000) GS:ffff888058200000(0000) knlGS:0000000000000000\n[ 114.492797] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 114.493150] CR2: 0000000000000008 CR3: 00000000013ba000 CR4: 00000000000006f0\n[ 114.493671] Call Trace:\n[ 114.493890] \n[ 114.494075] __d_instantiate+0x24/0x1c0\n[ 114.494505] d_instantiate.part.0+0x35/0x50\n[ 114.494754] d_make_root+0x53/0x80\n[ 114.494998] ntfs_fill_super+0x1232/0x1b50\n[ 114.495260] ? put_ntfs+0x1d0/0x1d0\n[ 114.495499] ? vsprintf+0x20/0x20\n[ 114.495723] ? set_blocksize+0x95/0x150\n[ 114.495964] get_tree_bdev+0x232/0x370\n[ 114.496272] ? put_ntfs+0x1d0/0x1d0\n[ 114.496502] ntfs_fs_get_tree+0x15/0x20\n[ 114.496859] vfs_get_tree+0x4c/0x130\n[ 114.497099] path_mount+0x654/0xfe0\n[ 114.497507] ? putname+0x80/0xa0\n[ 114.497933] ? finish_automount+0x2e0/0x2e0\n[ 114.498362] ? putname+0x80/0xa0\n[ 114.498571] ? kmem_cache_free+0x1c4/0x440\n[ 114.498819] ? putname+0x80/0xa0\n[ 114.499069] do_mount+0xd6/0xf0\n[ 114.499343] ? path_mount+0xfe0/0xfe0\n[ 114.499683] ? __kasan_check_write+0x14/0x20\n[ 114.500133] __x64_sys_mount+0xca/0x110\n[ 114.500592] do_syscall_64+0x3b/0x90\n[ 114.500930] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[ 114.501294] RIP: 0033:0x7fdc898e948a\n[ 114.501542] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008\n[ 114.502716] RSP: 002b:00007ffd793e58f8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5\n[ 114.503175] RAX: ffffffffffffffda RBX: 0000564b2228f060 RCX: 00007fdc898e948a\n[ 114.503588] RDX: 0000564b2228f260 RSI: 0000564b2228f2e0 RDI: 0000564b22297ce0\n[ 114.504925] RBP: 0000000000000000 R08: 0000564b2228f280 R09: 0000000000000020\n[ 114.505484] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 0000564b22297ce0\n[ 114.505823] R13: 0000564b2228f260 R14: 0000000000000000 R15: 00000000ffffffff\n[ 114.506562] \n[ 114.506887] Modules linked in:\n[ 114.507648] CR2: 0000000000000008\n[ 114.508884] ---[ end trace 0000000000000000 ]---\n[ 114.509675] RIP: 0010:d_flags_for_inode+0xe0/0x110\n[ 114.510140] Code: 24 f7 ff 49 83 3e 00 74 41 41 83 cd 02 66 44 89 6b 02 eb 92 48 8d 7b 20 e8 6d 24 f7 ff 4c 8b 73 20 49 8d 7e 08 e8 60 241\n[ 114.511762] RSP: 0018:ffff8880065e7aa8 EFLAGS: 00000296\n[ 114.512401] RAX: 0000000000000001 RBX: ffff888008ccd750 RCX: ffffffff84af2aea\n[ 114.51\n---truncated---"}],"id":"CVE-2022-50739","lastModified":"2026-06-17T05:24:05.760","metrics":{},"published":"2025-12-24T13:16:00.603","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9f24743ddcdd3683b0a6b16e1439ad091dc3489b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a7b23037b38b577d9a4372e0c6b7c9fe808070c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c1ca8ef0262b25493631ecbd9cb8c9893e1481a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f62506f5e45afbb01c84c3f28a2878b320a0b0f7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ntfs3/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f62506f5e45afbb01c84c3f28a2878b320a0b0f7","status":"affected","version":"82cae269cfa953032fbb8980a7d554d60fb00b17","versionType":"git"},{"lessThan":"9f24743ddcdd3683b0a6b16e1439ad091dc3489b","status":"affected","version":"82cae269cfa953032fbb8980a7d554d60fb00b17","versionType":"git"},{"lessThan":"a7b23037b38b577d9a4372e0c6b7c9fe808070c1","status":"affected","version":"82cae269cfa953032fbb8980a7d554d60fb00b17","versionType":"git"},{"lessThan":"c1ca8ef0262b25493631ecbd9cb8c9893e1481a1","status":"affected","version":"82cae269cfa953032fbb8980a7d554d60fb00b17","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ntfs3/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.87","versionType":"semver"},{"lessThanOrEqual":"6.0.*","status":"unaffected","version":"6.0.17","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Add null pointer check for inode operations\n\nThis adds a sanity check for the i_op pointer of the inode which is\nreturned after reading Root directory MFT record. We should check the\ni_op is valid before trying to create the root dentry, otherwise we may\nencounter a NPD while mounting a image with a funny Root directory MFT\nrecord.\n\n[ 114.484325] BUG: kernel NULL pointer dereference, address: 0000000000000008\n[ 114.484811] #PF: supervisor read access in kernel mode\n[ 114.485084] #PF: error_code(0x0000) - not-present page\n[ 114.485606] PGD 0 P4D 0\n[ 114.485975] Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI\n[ 114.486570] CPU: 0 PID: 237 Comm: mount Tainted: G B 6.0.0-rc4 #28\n[ 114.486977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[ 114.488169] RIP: 0010:d_flags_for_inode+0xe0/0x110\n[ 114.488816] Code: 24 f7 ff 49 83 3e 00 74 41 41 83 cd 02 66 44 89 6b 02 eb 92 48 8d 7b 20 e8 6d 24 f7 ff 4c 8b 73 20 49 8d 7e 08 e8 60 241\n[ 114.490326] RSP: 0018:ffff8880065e7aa8 EFLAGS: 00000296\n[ 114.490695] RAX: 0000000000000001 RBX: ffff888008ccd750 RCX: ffffffff84af2aea\n[ 114.490986] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff87abd020\n[ 114.491364] RBP: ffff8880065e7ac8 R08: 0000000000000001 R09: fffffbfff0f57a05\n[ 114.491675] R10: ffffffff87abd027 R11: fffffbfff0f57a04 R12: 0000000000000000\n[ 114.491954] R13: 0000000000000008 R14: 0000000000000000 R15: ffff888008ccd750\n[ 114.492397] FS: 00007fdc8a627e40(0000) GS:ffff888058200000(0000) knlGS:0000000000000000\n[ 114.492797] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 114.493150] CR2: 0000000000000008 CR3: 00000000013ba000 CR4: 00000000000006f0\n[ 114.493671] Call Trace:\n[ 114.493890] \n[ 114.494075] __d_instantiate+0x24/0x1c0\n[ 114.494505] d_instantiate.part.0+0x35/0x50\n[ 114.494754] d_make_root+0x53/0x80\n[ 114.494998] ntfs_fill_super+0x1232/0x1b50\n[ 114.495260] ? put_ntfs+0x1d0/0x1d0\n[ 114.495499] ? vsprintf+0x20/0x20\n[ 114.495723] ? set_blocksize+0x95/0x150\n[ 114.495964] get_tree_bdev+0x232/0x370\n[ 114.496272] ? put_ntfs+0x1d0/0x1d0\n[ 114.496502] ntfs_fs_get_tree+0x15/0x20\n[ 114.496859] vfs_get_tree+0x4c/0x130\n[ 114.497099] path_mount+0x654/0xfe0\n[ 114.497507] ? putname+0x80/0xa0\n[ 114.497933] ? finish_automount+0x2e0/0x2e0\n[ 114.498362] ? putname+0x80/0xa0\n[ 114.498571] ? kmem_cache_free+0x1c4/0x440\n[ 114.498819] ? putname+0x80/0xa0\n[ 114.499069] do_mount+0xd6/0xf0\n[ 114.499343] ? path_mount+0xfe0/0xfe0\n[ 114.499683] ? __kasan_check_write+0x14/0x20\n[ 114.500133] __x64_sys_mount+0xca/0x110\n[ 114.500592] do_syscall_64+0x3b/0x90\n[ 114.500930] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[ 114.501294] RIP: 0033:0x7fdc898e948a\n[ 114.501542] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008\n[ 114.502716] RSP: 002b:00007ffd793e58f8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5\n[ 114.503175] RAX: ffffffffffffffda RBX: 0000564b2228f060 RCX: 00007fdc898e948a\n[ 114.503588] RDX: 0000564b2228f260 RSI: 0000564b2228f2e0 RDI: 0000564b22297ce0\n[ 114.504925] RBP: 0000000000000000 R08: 0000564b2228f280 R09: 0000000000000020\n[ 114.505484] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 0000564b22297ce0\n[ 114.505823] R13: 0000564b2228f260 R14: 0000000000000000 R15: 00000000ffffffff\n[ 114.506562] \n[ 114.506887] Modules linked in:\n[ 114.507648] CR2: 0000000000000008\n[ 114.508884] ---[ end trace 0000000000000000 ]---\n[ 114.509675] RIP: 0010:d_flags_for_inode+0xe0/0x110\n[ 114.510140] Code: 24 f7 ff 49 83 3e 00 74 41 41 83 cd 02 66 44 89 6b 02 eb 92 48 8d 7b 20 e8 6d 24 f7 ff 4c 8b 73 20 49 8d 7e 08 e8 60 241\n[ 114.511762] RSP: 0018:ffff8880065e7aa8 EFLAGS: 00000296\n[ 114.512401] RAX: 0000000000000001 RBX: ffff888008ccd750 RCX: ffffffff84af2aea\n[ 114.51\n---truncated---"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: fs/ntfs3: Añadir comprobación de puntero nulo para operaciones de inodo Esto añade una comprobación de cordura para el puntero i_op del inodo que es devuelto después de leer el registro MFT del directorio raíz. Deberíamos comprobar que el i_op es válido antes de intentar crear el dentry raíz, de lo contrario, podríamos encontrar un NPD mientras se monta una imagen con un registro MFT del directorio raíz extraño. [ 114.484325] BUG: desreferencia de puntero NULL del kernel, dirección: 0000000000000008\n[ 114.484811] #PF: acceso de lectura de supervisor en modo kernel\n[ 114.485084] #PF: código_de_error(0x 0000) - página no presente\n[ 114.485606] PGD 0 P4D 0\n[ 114.485975] Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI\n[ 114.486570] CPU: 0 PID: 237 Comm: mount Tainted: G B 6.0.0-rc4 #28\n[ 114.486977] Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[ 114.488169] RIP: 0010:d_flags_for_inode+0xe0/0x110\n[ 114.488816] Código: 24 f7 ff 49 83 3e 00 74 41 41 83 cd 02 66 44 89 6b 02 eb 92 48 8d 7b 20 e8 6d 24 f7 ff 4c 8b 73 20 49 8d 7e 08 e8 60 241\n[ 114.490326] RSP: 0018:ffff8880065e7aa8 EFLAGS: 00000296\n[ 114.490695] RAX: 0000000000000001 RBX: ffff888008ccd750 RCX: ffffffff84af2aea\n[ 114.490986] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff87abd020\n[ 114.491364] RBP: ffff8880065e7ac8 R08: 0000000000000001 R09: fffffbfff0f57a05\n[ 114.491675] R10: ffffffff87abd027 R11: fffffbfff0f57a04 R12: 0000000000000000\n[ 114.491954] R13: 0000000000000008 R14: 0000000000000000 R15: ffff888008ccd750\n[ 114.492397] FS: 00007fdc8a627e40(0000) GS:ffff888058200000(0000) knlGS:0000000000000000\n[ 114.492797] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 114.493150] CR2: 0000000000000008 CR3: 00000000013ba000 CR4: 00000000000006f0\n[ 114.493671] Rastro de llamada:\n[ 114.493890] [TAREA]\n[ 114.494075] __d_instantiate+0x24/0x1c0\n[ 114.494505] d_instantiate.part.0+0x35/0x50\n[ 114.494754] d_make_root+0x53/0x80\n[ 114.494998] ntfs_fill_super+0x 1232/0x 1b50\n[ 114.495260] ? put_ntfs+0x1d0/0x1d0\n[ 114.495499] ? vsprintf+0x20/0x20\n[ 114.495723] ? set_blocksize+0x95/0x150\n[ 114.495964] get_tree_bdev+0x232/0x370\n[ 114.496272] ? put_ntfs+0x1d0/0x1d0\n[ 114.496502] ntfs_fs_get_tree+0x15/0x20\n[ 114.496859] vfs_get_tree+0x4c/0x130\n[ 114.497099] path_mount+0x654/0xfe0\n[ 114.497507] ? putname+0x80/0xa0\n[ 114.497933] ? finish_automount+0x2e0/0x2e0\n[ 114.498362] ? putname+0x80/0xa0\n[ 114.498571] ? kmem_cache_free+0x1c4/0x440\n[ 114.498819] ? putname+0x80/0xa0\n[ 114.499069] do_mount+0xd6/0xf0\n[ 114.499343] ? path_mount+0xfe0/0xfe0\n[ 114.499683] ? __kasan_check_write+0x14/0x20\n[ 114.500133] __x64_sys_mount+0xca/0x110\n[ 114.500592] do_syscall_64+0x3b/0x90\n[ 114.500930] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[ 114.501294] RIP: 0033:0x 7fdc898e948a\n[ 114.501542] Código: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008\n[ 114.502716] RSP: 002b:00007ffd793e58f8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5\n[ 114.503175] RAX: ffffffffffffffda RBX: 0000564b2228f060 RCX: 00007fdc898e948a\n[ 114.503588] RDX: 0000564b2228f260 RSI: 0000564b2228f2e0 RDI: 0000564b22297ce0\n[ 114.504925] RBP: 0000000000000000 R08: 0000564b2228f280 R09: 0000000000000020\n[ 114.505484] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 0000564b22297ce0\n[ 114.505823] R13: 0000564b2228f260 R14: 0000000000000000 R15: 00000000ffffffff\n[ 114.506562] [/TAREA]\n[ 114.506887] Módulos enlazados:\n[ 114.507648] CR2: 0000000000000008\n[ 114.508884] - - -[ fin del rastro 0000000000000000 ]- - -\n[ 114.509675] RIP: 0010:d_flags_for_inode+0xe0/0x110\n[ 114.510140] Código: 24 f7 ff 49 83 3e 00 74 41 41 83 cd 02 66 44 89 6b 02 eb 92 48 8d 7b 20 e8 6d 24 f7 ff 4c 8b 73 20 49 8d 7e 08 e8 60 241\n[ 114.511762] RSP: 0018:ffff8880065e7aa8 EFLAGS: 00000296\n[ 114.512401] RAX: 0000000000000001 RBX: ffff888008ccd750 RCX: ffffffff84af2aea\n[ 114.51\n- --truncado-- -"}],"id":"CVE-2022-50739","lastModified":"2026-11-11T23:10:00.263","metrics":{},"published":"2025-12-24T13:16:00.603","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9f24743ddcdd3683b0a6b16e1439ad091dc3489b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a7b23037b38b577d9a4372e0c6b7c9fe808070c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c1ca8ef0262b25493631ecbd9cb8c9893e1481a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f62506f5e45afbb01c84c3f28a2878b320a0b0f7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Deferred"} diff --git a/data/2025/CVE-2025-0166.json b/data/2025/CVE-2025-0166.json index 331721c516..c2d740fb61 100644 --- a/data/2025/CVE-2025-0166.json +++ b/data/2025/CVE-2025-0166.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:*"],"product":"watsonx Orchestrate Cartridge for Cloud Pak for Data","vendor":"IBM","versions":[{"lessThanOrEqual":"4.8.5","status":"affected","version":"4.8.4","versionType":"semver"},{"lessThanOrEqual":"5.4.2","status":"affected","version":"5.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible."}],"id":"CVE-2025-0166","lastModified":"2026-11-09T15:17:04.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0166","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T14:14:55.542618Z","version":"2.0.3"}}]},"published":"2026-11-08T16:16:35.597","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7293785"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-540"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:*"],"product":"watsonx Orchestrate Cartridge for Cloud Pak for Data","vendor":"IBM","versions":[{"lessThanOrEqual":"4.8.5","status":"affected","version":"4.8.4","versionType":"semver"},{"lessThanOrEqual":"5.4.2","status":"affected","version":"5.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible."},{"lang":"es","value":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data, desde la versión 4.8.4 hasta la 4.8.5 incluida, y desde la versión 5.0.0 hasta la 5.4.2 incluida, podría divulgar información sensible del código fuente que no debería ser accesible."}],"id":"CVE-2025-0166","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0166","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T14:14:55.542618Z","version":"2.0.3"}}]},"published":"2026-11-08T16:16:35.597","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7293785"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-540"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-11395.json b/data/2025/CVE-2025-11395.json index 58470ca6c6..7f56f629db 100644 --- a/data/2025/CVE-2025-11395.json +++ b/data/2025/CVE-2025-11395.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"buildah","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:1.43.1-7.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"skopeo","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:1.22.2-6.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"7:5.8.2-12.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"buildah","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:1.43.3-2.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"skopeo","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:1.22.2-8.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"6:5.8.2-8.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"buildah","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:1.43.4-2.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"skopeo","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:1.22.2-9.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"buildah","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"container-tools:rhel8/podman","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"skopeo","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"buildah","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"skopeo","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman."},{"lang":"es","value":"Se encontró una vulnerabilidad en Podman. Si un atacante puede pasar un archivo tar personalizado al comando 'podman load', pueden crear archivos en la máquina host con las privilegias del usuario que ejecuta Podman."}],"id":"CVE-2025-11395","lastModified":"2026-11-05T15:17:08.467","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.1,"impactScore":3.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-11395","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-16T19:44:06.242490Z","version":"2.0.3"}}]},"published":"2026-09-15T23:16:59.933","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:70640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:70641"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88262"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89761"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90362"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90424"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90462"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93464"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2025-11395"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2402034"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-277"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"buildah","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:1.43.1-7.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"skopeo","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:1.22.2-6.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"7:5.8.2-12.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"buildah","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:1.43.3-2.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"skopeo","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:1.22.2-8.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"6:5.8.2-8.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"buildah","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:1.43.4-2.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"skopeo","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"2:1.22.2-9.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.8::appstream"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Enterprise Linux 9.8 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"6:5.8.2-10.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"buildah","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"container-tools:rhel8/podman","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"skopeo","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat Hardened Images","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"buildah","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"podman","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"],"defaultStatus":"unaffected","packageName":"skopeo","product":"Red Hat OpenShift Container Platform 4","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-base-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_devspaces:3"],"defaultStatus":"affected","packageName":"devspaces/udi-rhel9","product":"Red Hat OpenShift Dev Spaces","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman."},{"lang":"es","value":"Se encontró una vulnerabilidad en Podman. Si un atacante puede pasar un archivo tar personalizado al comando 'podman load', pueden crear archivos en la máquina host con las privilegias del usuario que ejecuta Podman."}],"id":"CVE-2025-11395","lastModified":"2026-11-11T23:17:09.000","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":2.1,"impactScore":3.4,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-11395","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-09-16T19:44:06.242490Z","version":"2.0.3"}}]},"published":"2026-09-15T23:16:59.933","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:70640"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:70641"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:88262"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:89761"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90362"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90424"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:90462"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:93464"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99093"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2025-11395"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2402034"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-277"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-12848.json b/data/2025/CVE-2025-12848.json index e245c754b0..64589fde74 100644 --- a/data/2025/CVE-2025-12848.json +++ b/data/2025/CVE-2025-12848.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://www.drupal.org/project/webform_multifile","defaultStatus":"unaffected","packageName":"Webform Multifile Upload","product":"Drupal","repo":"https://git.drupalcode.org/project/webform_multifile","vendor":"Drupal","versions":[{"lessThanOrEqual":"7.x-1.6","status":"affected","version":"7.x-1.0","versionType":"custom"}]}],"source":"mlhess@drupal.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.2:*:*:*:*:drupal:*:*","matchCriteriaId":"36B05E21-D024-4BDD-8278-D41CB19AC1E1","vulnerable":true},{"criteria":"cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.3:*:*:*:*:drupal:*:*","matchCriteriaId":"E5483807-EF6D-49EB-BA44-B87F687B13C7","vulnerable":true},{"criteria":"cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.4:*:*:*:*:drupal:*:*","matchCriteriaId":"AF414458-4EF4-4C86-84E2-22D3AAED513E","vulnerable":true},{"criteria":"cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.5:*:*:*:*:drupal:*:*","matchCriteriaId":"379AA449-C4C9-475F-8614-A7654BE530EA","vulnerable":true},{"criteria":"cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.6:*:*:*:*:drupal:*:*","matchCriteriaId":"B4B38B66-E62F-42EF-8979-4BDE49B5EEDC","vulnerable":true},{"criteria":"cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.x:dev:*:*:*:drupal:*:*","matchCriteriaId":"BC4FEB91-00A6-40BD-A9AC-368E6AADBA45","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious\nfilename containing JavaScript code (e.g., \"\") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts\nin the context of the victim's browser.\n \nThe issue is present in a third-party library and has been addressed in a patch available at  https://github.com/fyneworks/multifile/pull/44 . Users are advised to apply the provided patch or update to a fixed version of the module."}],"id":"CVE-2025-12848","lastModified":"2026-06-17T08:33:04.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:U/V:D/RE:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"LOW"},"source":"mlhess@drupal.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-12848","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-11-26T14:18:51.075955Z","version":"2.0.3"}}]},"published":"2025-11-26T02:15:48.817","references":[{"source":"mlhess@drupal.org","url":"https://d7es.tag1.com/security-advisories/webform-multiple-file-upload-critical-cross-site-scripting"},{"source":"mlhess@drupal.org","url":"https://www.d7security.org/security-advisories/D7SECURITY-SA-CONTRIB-2025-001/"},{"source":"mlhess@drupal.org","tags":["Patch","Vendor Advisory"],"url":"https://www.drupal.org/node/3105204"},{"source":"mlhess@drupal.org","url":"https://www.herodevs.com/vulnerability-directory/cve-2025-12848"}],"sourceIdentifier":"mlhess@drupal.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"mlhess@drupal.org","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://www.drupal.org/project/webform_multifile","defaultStatus":"unaffected","packageName":"Webform Multifile Upload","product":"Drupal","repo":"https://git.drupalcode.org/project/webform_multifile","vendor":"Drupal","versions":[{"lessThanOrEqual":"7.x-1.6","status":"affected","version":"7.x-1.0","versionType":"custom"}]}],"source":"mlhess@drupal.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.2:*:*:*:*:drupal:*:*","matchCriteriaId":"36B05E21-D024-4BDD-8278-D41CB19AC1E1","vulnerable":true},{"criteria":"cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.3:*:*:*:*:drupal:*:*","matchCriteriaId":"E5483807-EF6D-49EB-BA44-B87F687B13C7","vulnerable":true},{"criteria":"cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.4:*:*:*:*:drupal:*:*","matchCriteriaId":"AF414458-4EF4-4C86-84E2-22D3AAED513E","vulnerable":true},{"criteria":"cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.5:*:*:*:*:drupal:*:*","matchCriteriaId":"379AA449-C4C9-475F-8614-A7654BE530EA","vulnerable":true},{"criteria":"cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.6:*:*:*:*:drupal:*:*","matchCriteriaId":"B4B38B66-E62F-42EF-8979-4BDE49B5EEDC","vulnerable":true},{"criteria":"cpe:2.3:a:webform_multiple_file_upload_project:webform_multiple_file_upload:7.x-1.x:dev:*:*:*:drupal:*:*","matchCriteriaId":"BC4FEB91-00A6-40BD-A9AC-368E6AADBA45","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious\nfilename containing JavaScript code (e.g., \"\") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts\nin the context of the victim's browser.\n \nThe issue is present in a third-party library and has been addressed in a patch available at  https://github.com/fyneworks/multifile/pull/44 . Users are advised to apply the provided patch or update to a fixed version of the module."},{"lang":"es","value":"El módulo Webform Multiple File Upload para Drupal 7.x contiene una vulnerabilidad de Cross-site Scripting (XSS) en el renderizador de nombres de archivo. Un atacante no autenticado puede explotar esta vulnerabilidad al subir un archivo con un nombre de archivo malicioso que contenga código JavaScript (por ejemplo, ’[img src=1 onerror_disabled=alert( document.domain )]’) a un nodo de Webform con un campo Multifile donde la validación del tipo de archivo está deshabilitada. Esto permite la ejecución de scripts arbitrarios en el contexto del navegador de la víctima.\n\nEl problema está presente en una biblioteca de terceros y se ha abordado en un parche disponible en https://github.com/fyneworks/multifile/pull/44. Se recomienda a los usuarios aplicar el parche proporcionado o actualizar a una versión corregida del módulo."}],"id":"CVE-2025-12848","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"USER","Safety":"NEGLIGIBLE","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"AMBER","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:U/V:D/RE:L/U:Amber","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"LOW"},"source":"mlhess@drupal.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-12848","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-11-26T14:18:51.075955Z","version":"2.0.3"}}]},"published":"2025-11-26T02:15:48.817","references":[{"source":"mlhess@drupal.org","url":"https://d7es.tag1.com/security-advisories/webform-multiple-file-upload-critical-cross-site-scripting"},{"source":"mlhess@drupal.org","url":"https://www.d7security.org/security-advisories/D7SECURITY-SA-CONTRIB-2025-001/"},{"source":"mlhess@drupal.org","tags":["Patch","Vendor Advisory"],"url":"https://www.drupal.org/node/3105204"},{"source":"mlhess@drupal.org","url":"https://www.herodevs.com/vulnerability-directory/cve-2025-12848"}],"sourceIdentifier":"mlhess@drupal.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"mlhess@drupal.org","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-1837.json b/data/2025/CVE-2025-1837.json index a65705d86b..d849394b7d 100644 --- a/data/2025/CVE-2025-1837.json +++ b/data/2025/CVE-2025-1837.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:*"],"product":"watsonx Orchestrate Cartridge for Cloud Pak for Data","vendor":"IBM","versions":[{"lessThanOrEqual":"4.8.5","status":"affected","version":"4.8.4","versionType":"semver"},{"lessThanOrEqual":"5.4.2","status":"affected","version":"5.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods."}],"id":"CVE-2025-1837","lastModified":"2026-11-09T17:17:04.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-1837","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:09:17.662202Z","version":"2.0.3"}}]},"published":"2026-11-08T16:16:35.760","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7293785"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-650"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:*"],"product":"watsonx Orchestrate Cartridge for Cloud Pak for Data","vendor":"IBM","versions":[{"lessThanOrEqual":"4.8.5","status":"affected","version":"4.8.4","versionType":"semver"},{"lessThanOrEqual":"5.4.2","status":"affected","version":"5.0.0","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods."},{"lang":"es","value":"IBM watsonx Orchestrate Cartridge para Cloud Pak for Data 4.8.4 hasta la versión 4.8.5 incluida, y 5.0.0 hasta la versión 5.4.2 incluida, podría permitir a un usuario autenticado realizar acciones no autorizadas debido a una confianza inadecuada en los métodos de permiso del lado del servidor."}],"id":"CVE-2025-1837","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-1837","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:09:17.662202Z","version":"2.0.3"}}]},"published":"2026-11-08T16:16:35.760","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7293785"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-650"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-36075.json b/data/2025/CVE-2025-36075.json index 150ae8d92c..44856cd54d 100644 --- a/data/2025/CVE-2025-36075.json +++ b/data/2025/CVE-2025-36075.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"Safer Payments","vendor":"IBM","versions":[{"lessThanOrEqual":"6.4.2.11","status":"affected","version":"6.4.0.00","versionType":"semver"},{"lessThanOrEqual":"6.5.0.09","status":"affected","version":"6.5.0.00","versionType":"semver"},{"lessThanOrEqual":"6.6.0.07","status":"affected","version":"6.6.0.00","versionType":"semver"},{"lessThanOrEqual":"6.7.0.03","status":"affected","version":"6.7.0.00","versionType":"semver"},{"status":"affected","version":"6.8.0.00","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information."}],"id":"CVE-2025-36075","lastModified":"2026-11-09T17:17:04.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-36075","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:10:51.462397Z","version":"2.0.3"}}]},"published":"2026-11-08T16:16:35.930","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7293213"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"Safer Payments","vendor":"IBM","versions":[{"lessThanOrEqual":"6.4.2.11","status":"affected","version":"6.4.0.00","versionType":"semver"},{"lessThanOrEqual":"6.5.0.09","status":"affected","version":"6.5.0.00","versionType":"semver"},{"lessThanOrEqual":"6.6.0.07","status":"affected","version":"6.6.0.00","versionType":"semver"},{"lessThanOrEqual":"6.7.0.03","status":"affected","version":"6.7.0.00","versionType":"semver"},{"status":"affected","version":"6.8.0.00","versionType":"semver"}]}],"source":"psirt@us.ibm.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information."},{"lang":"es","value":"IBM Safer Payments 6.4.0.00 hasta la versión 6.4.2.11 incluida, 6.5.0.00 hasta la versión 6.5.0.09 incluida, 6.6.0.00 hasta la versión 6.6.0.07 incluida, 6.7.0.00 hasta la versión 6.7.0.03 incluida, y 6.8.0.00 podría permitir a un usuario autenticado obtener información sensible, causado por una validación de entrada de usuario incorrecta. Mediante el uso de un conjunto de solicitudes de API, el usuario podría explotar esta vulnerabilidad para descifrar información sensible."}],"id":"CVE-2025-36075","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"psirt@us.ibm.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-36075","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-09T17:10:51.462397Z","version":"2.0.3"}}]},"published":"2026-11-08T16:16:35.930","references":[{"source":"psirt@us.ibm.com","url":"https://www.ibm.com/support/pages/node/7293213"}],"sourceIdentifier":"psirt@us.ibm.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-1287"}],"source":"psirt@us.ibm.com","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-60679.json b/data/2025/CVE-2025-60679.json index badcbb4761..bda9487b9e 100644 --- a/data/2025/CVE-2025-60679.json +++ b/data/2025/CVE-2025-60679.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:dlink:dir-816_firmware:1.10cnb05_r1b011d88210:*:*:*:*:*:*:*","matchCriteriaId":"6494A725-3860-4428-A0F3-076605CAF7F2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:dlink:dir-816:a2:*:*:*:*:*:*:*","matchCriteriaId":"1A3AC507-7219-401E-AC60-12D96382E4B7","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. The vulnerability occurs because /proc/version is read into a 512-byte buffer and then concatenated using sprintf() into another 512-byte buffer containing a 29-byte constant. Input exceeding 481 bytes triggers a stack buffer overflow, allowing an attacker who can control /proc/version content to potentially execute arbitrary code on the device."}],"id":"CVE-2025-60679","lastModified":"2026-07-05T02:17:11.747","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-60679","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-11-14T16:40:45.989591Z","version":"2.0.3"}}]},"published":"2025-11-13T20:15:51.420","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-816/CVE-2025-60679.md"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://www.dlink.com/en"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://www.dlink.com/en/security-bulletin/"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:dlink:dir-816_firmware:1.10cnb05_r1b011d88210:*:*:*:*:*:*:*","matchCriteriaId":"6494A725-3860-4428-A0F3-076605CAF7F2","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:dlink:dir-816:a2:*:*:*:*:*:*:*","matchCriteriaId":"1A3AC507-7219-401E-AC60-12D96382E4B7","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A stack buffer overflow vulnerability exists in the D-Link DIR-816A2 router firmware DIR-816A2_FWv1.10CNB05_R1B011D88210.img in the upload.cgi module, which handles firmware version information. The vulnerability occurs because /proc/version is read into a 512-byte buffer and then concatenated using sprintf() into another 512-byte buffer containing a 29-byte constant. Input exceeding 481 bytes triggers a stack buffer overflow, allowing an attacker who can control /proc/version content to potentially execute arbitrary code on the device."},{"lang":"es","value":"Una vulnerabilidad de desbordamiento de búfer de pila existe en el firmware del router D-Link DIR-816A2 DIR-816A2_FWv1.10CNB05_R1B011D88210.img en el módulo upload.cgi, que maneja la información de la versión del firmware. La vulnerabilidad ocurre porque /proc/ version se lee en un búfer de 512 bytes y luego se concatena usando sprintf() en otro búfer de 512 bytes que contiene una constante de 29 bytes. La entrada que excede los 481 bytes desencadena un desbordamiento de búfer de pila, permitiendo a un atacante que puede controlar el contenido de /proc/ version ejecutar potencialmente código arbitrario en el dispositivo."}],"id":"CVE-2025-60679","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-60679","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-11-14T16:40:45.989591Z","version":"2.0.3"}}]},"published":"2025-11-13T20:15:51.420","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-816/CVE-2025-60679.md"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://www.dlink.com/en"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://www.dlink.com/en/security-bulletin/"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-69993.json b/data/2025/CVE-2025-69993.json index 6ccab17dd6..1c7259f413 100644 --- a/data/2025/CVE-2025-69993.json +++ b/data/2025/CVE-2025-69993.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:leafletjs:leaflet:*:*:*:*:*:node.js:*:*","matchCriteriaId":"840C3800-3D9A-4B7A-96E4-390841CE2AB2","versionEndIncluding":"1.9.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e.g., ). When a victim views an affected map popup, the malicious script executes in the context of the victim's browser session."}],"id":"CVE-2025-69993","lastModified":"2026-06-17T10:00:57.740","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-69993","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T17:45:03.459489Z","version":"2.0.3"}}]},"published":"2026-04-14T15:16:25.477","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/PierfrancescoConti/leaflet-cve-2025-69993/blob/main/ADVISORY.md"},{"source":"cve@mitre.org","url":"https://leafletjs.com/"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:leafletjs:leaflet:*:*:*:*:*:node.js:*:*","matchCriteriaId":"840C3800-3D9A-4B7A-96E4-390841CE2AB2","versionEndIncluding":"1.9.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes (e.g., ). When a victim views an affected map popup, the malicious script executes in the context of the victim's browser session."},{"lang":"es","value":"Las versiones de Leaflet hasta e incluyendo la 1.9.4 son vulnerables a Cross-site Scripting (XSS) a través del método bindPopup( ). Este método renderiza la entrada proporcionada por el usuario como HTML sin procesar sin sanitización, lo que permite a los atacantes inyectar código JavaScript arbitrario a través de atributos de manejador de eventos (por ejemplo, [img src=x onerror_disabled=“alert( ’XSS’ )”]). Cuando una víctima visualiza una ventana emergente de mapa afectada, el script malicioso se ejecuta en el contexto de la sesión del navegador de la víctima."}],"id":"CVE-2025-69993","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-69993","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T17:45:03.459489Z","version":"2.0.3"}}]},"published":"2026-04-14T15:16:25.477","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/PierfrancescoConti/leaflet-cve-2025-69993/blob/main/ADVISORY.md"},{"source":"cve@mitre.org","url":"https://leafletjs.com/"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2025/CVE-2025-71453.json b/data/2025/CVE-2025-71453.json index 5e5f31cca0..a6e7722be1 100644 --- a/data/2025/CVE-2025-71453.json +++ b/data/2025/CVE-2025-71453.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session."}],"id":"CVE-2025-71453","lastModified":"2026-11-05T20:17:36.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71453","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:14:17.919932Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:39.657","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-reflected-xss-via-widgetinfolist-in-homewidgetblocklist"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"vtenext","vendor":"vtenext","versions":[{"lessThan":"25.02.2","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys, executing JavaScript in the victim's vtenext session."},{"lang":"es","value":"vtenext versiones anteriores a la 25.02.2 contiene una vulnerabilidad de Cross-site Scripting (XSS) reflejado en modules/Home/HomeWidgetBlockList.php que devuelve claves ’widgetId’ no saneadas del parámetro JSON ’widgetInfoList’. Los atacantes pueden inducir a un usuario autenticado a enviar una solicitud POST manipulada con HTML en las claves ’widgetId’, ejecutando JavaScript en la sesión de vtenext de la víctima."}],"id":"CVE-2025-71453","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-71453","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T19:14:17.919932Z","version":"2.0.3"}}]},"published":"2026-11-04T21:17:39.657","references":[{"source":"disclosure@vulncheck.com","url":"https://0xbro.red/posts/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/"},{"source":"disclosure@vulncheck.com","url":"https://usermanual.vtenext.com/books/release-notes-history/page/vtenext-25022-release-note"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/vtenext-before-25.02.2-reflected-xss-via-widgetinfolist-in-homewidgetblocklist"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-107922.json b/data/2026/CVE-2026-107922.json new file mode 100644 index 0000000000..ee684c92f1 --- /dev/null +++ b/data/2026/CVE-2026-107922.json @@ -0,0 +1 @@ +{"cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"id":"CVE-2026-107922","lastModified":"2026-11-11T23:17:10.347","metrics":{},"published":"2026-11-11T23:17:10.347","references":[],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Rejected"} diff --git a/data/2026/CVE-2026-108094.json b/data/2026/CVE-2026-108094.json index 3e0f787700..0c513786b1 100644 --- a/data/2026/CVE-2026-108094.json +++ b/data/2026/CVE-2026-108094.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"mutter","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"mutter","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"mutter","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mutter","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process."}],"id":"CVE-2026-108094","lastModified":"2026-11-06T09:16:59.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108094","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-13T18:23:15.091003Z","version":"2.0.3"}}]},"published":"2026-10-12T15:17:07.080","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-108094"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2549511"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"mutter","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:49.4-6.el10_3.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"mutter","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"mutter","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"mutter","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process."}],"id":"CVE-2026-108094","lastModified":"2026-11-11T23:17:10.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-108094","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-13T18:23:15.091003Z","version":"2.0.3"}}]},"published":"2026-10-12T15:17:07.080","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99130"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-108094"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2549511"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-119777.json b/data/2026/CVE-2026-119777.json index 4f667b6049..0895eaebe5 100644 --- a/data/2026/CVE-2026-119777.json +++ b/data/2026/CVE-2026-119777.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.26.7-9.el10_3.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application."}],"id":"CVE-2026-119777","lastModified":"2026-11-11T14:17:30.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119777","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-30T19:16:55.995158Z","version":"2.0.3"}}]},"published":"2026-10-30T18:17:27.427","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98621"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-119777"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2564164"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11241"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.3"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.26.7-9.el10_3.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.2"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 10.2 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.26.7-2.el10_2.8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"unaffected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"gstreamer1-plugins-bad-free","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to execute code in the context of the affected application."}],"id":"CVE-2026-119777","lastModified":"2026-11-11T23:17:10.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-119777","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-30T19:16:55.995158Z","version":"2.0.3"}}]},"published":"2026-10-30T18:17:27.427","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:98621"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99118"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-119777"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2564164"},{"source":"secalert@redhat.com","url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11241"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-125637.json b/data/2026/CVE-2026-125637.json new file mode 100644 index 0000000000..a7de1af31f --- /dev/null +++ b/data/2026/CVE-2026-125637.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"collectionURL":"https://github.com/konflux-ci/konflux-ci","defaultStatus":"unaffected","packageName":"konflux-ci","versions":[{"lessThanOrEqual":"0.2.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Konflux UI proxy. Hostname values defined in the KonfluxUI custom resource are inserted directly into proxy configuration files without adequate validation or sanitization. An authenticated user with permissions to modify the custom resource can inject malicious configuration directives to bypass authentication and authorization controls, potentially exposing internal backend services. In addition, providing malformed input can cause the configuration generator to fail, resulting in a denial of service (DoS) by preventing the proxy from starting."}],"id":"CVE-2026-125637","lastModified":"2026-11-11T23:17:10.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"secalert@redhat.com","type":"Primary"}]},"published":"2026-11-11T23:17:10.750","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125637"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569294"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"secalert@redhat.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-125712.json b/data/2026/CVE-2026-125712.json index e3564c180a..066d7c6d07 100644 --- a/data/2026/CVE-2026-125712.json +++ b/data/2026/CVE-2026-125712.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-base","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.16.1-8.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-base","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"gstreamer-plugins-base","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-base","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer-plugins-base","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-base","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory."}],"id":"CVE-2026-125712","lastModified":"2026-11-11T19:17:36.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125712","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:33:10.793215Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:18.607","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99012"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125712"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569130"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0030.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-base","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.16.1-8.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-base","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:1.22.12-10.el9_9.1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-base","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:6"],"defaultStatus":"unknown","packageName":"gstreamer-plugins-base","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer1-plugins-base","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"gstreamer-plugins-base","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply a malformed SDES entry whose declared length exceeds the received packet. Missing bounds validation can cause the receiver to read beyond the packet buffer, potentially crashing the application or exposing a limited amount of process memory."}],"id":"CVE-2026-125712","lastModified":"2026-11-11T23:17:10.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-125712","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-10T16:33:10.793215Z","version":"2.0.3"}}]},"published":"2026-11-10T12:17:18.607","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99012"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2026:99126"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/security/cve/CVE-2026-125712"},{"source":"secalert@redhat.com","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569130"},{"source":"secalert@redhat.com","url":"https://gstreamer.freedesktop.org/security/sa-2026-0030.html"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"secalert@redhat.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-126757.json b/data/2026/CVE-2026-126757.json new file mode 100644 index 0000000000..1c5540f1c6 --- /dev/null +++ b/data/2026/CVE-2026-126757.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:moonshot_ai:kimi_code:*:*:*:*:*:*:*:*"],"modules":["Web UI"],"product":"Kimi Code","vendor":"Moonshot AI","versions":[{"status":"affected","version":"2.5.0"},{"status":"affected","version":"2.5.1"},{"status":"affected","version":"2.5.2"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"id":"CVE-2026-126757","lastModified":"2026-11-11T23:17:11.253","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.1,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-11T23:17:11.040","references":[{"source":"cna@vuldb.com","url":"https://mcniyfj5bw9b.feishu.cn/docx/IZ43dY0wzoDtnUxGgy7cQ6xcnFh"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-126757"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1033259"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/435867"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/435867/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"cna@vuldb.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126758.json b/data/2026/CVE-2026-126758.json new file mode 100644 index 0000000000..373bb0a414 --- /dev/null +++ b/data/2026/CVE-2026-126758.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:moonshot_ai:kimi_code:*:*:*:*:*:*:*:*"],"modules":["WorkspaceDirsService"],"product":"Kimi Code","vendor":"Moonshot AI","versions":[{"status":"affected","version":"2.0.0"},{"status":"affected","version":"2.0.1"},{"status":"affected","version":"2.0.2"},{"status":"unaffected","version":"2.1.0"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional_dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended."}],"id":"CVE-2026-126758","lastModified":"2026-11-11T23:17:11.500","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"LOW","cvssData":{"accessComplexity":"LOW","accessVector":"LOCAL","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":3.2,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:L/AC:L/Au:S/C:N/I:P/A:P","version":"2.0"},"exploitabilityScore":3.1,"impactScore":4.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":1.9,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-11T23:17:11.320","references":[{"source":"cna@vuldb.com","url":"https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%402.1.0"},{"source":"cna@vuldb.com","url":"https://mcniyfj5bw9b.feishu.cn/docx/LsJldjpjXomkb4xTJ6CcWzdFnvd"},{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-126758"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1033260"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/435868"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/435868/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-807"}],"source":"cna@vuldb.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126759.json b/data/2026/CVE-2026-126759.json new file mode 100644 index 0000000000..14b5628acf --- /dev/null +++ b/data/2026/CVE-2026-126759.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:h:h3c:icg2000_unified_communication_gateway:*:*:*:*:*:*:*:*"],"modules":["Web Management Module"],"product":"ICG2000 Unified Communication Gateway","vendor":"H3C","versions":[{"status":"affected","version":"2023"}]}],"source":"cna@vuldb.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in H3C ICG2000 Unified Communication Gateway 2023. This issue affects some unknown processing of the file /wnm/check.j of the component Web Management Module. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. The researcher claims that the vendor has acknowledged receipt of the vulnerability report. No further response has been received."}],"id":"CVE-2026-126759","lastModified":"2026-11-12T00:17:14.823","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"cna@vuldb.com","type":"Secondary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"cna@vuldb.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cna@vuldb.com","type":"Secondary"}]},"published":"2026-11-12T00:17:14.527","references":[{"source":"cna@vuldb.com","url":"https://vuldb.com/cve/CVE-2026-126759"},{"source":"cna@vuldb.com","url":"https://vuldb.com/submit/1035822"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/435869"},{"source":"cna@vuldb.com","url":"https://vuldb.com/vuln/435869/cti"}],"sourceIdentifier":"cna@vuldb.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}],"source":"cna@vuldb.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126840.json b/data/2026/CVE-2026-126840.json new file mode 100644 index 0000000000..87af2465b5 --- /dev/null +++ b/data/2026/CVE-2026-126840.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds write in Network in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126840","lastModified":"2026-11-11T23:17:11.670","metrics":{},"published":"2026-11-11T23:17:11.553","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578664961"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126841.json b/data/2026/CVE-2026-126841.json new file mode 100644 index 0000000000..b17ca46850 --- /dev/null +++ b/data/2026/CVE-2026-126841.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126841","lastModified":"2026-11-11T23:17:11.820","metrics":{},"published":"2026-11-11T23:17:11.703","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580865537"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126842.json b/data/2026/CVE-2026-126842.json new file mode 100644 index 0000000000..7ffb188a04 --- /dev/null +++ b/data/2026/CVE-2026-126842.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126842","lastModified":"2026-11-11T23:17:11.970","metrics":{},"published":"2026-11-11T23:17:11.860","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574209539"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126843.json b/data/2026/CVE-2026-126843.json new file mode 100644 index 0000000000..2ee33b0a9b --- /dev/null +++ b/data/2026/CVE-2026-126843.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126843","lastModified":"2026-11-11T23:17:12.110","metrics":{},"published":"2026-11-11T23:17:12.000","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578322433"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126844.json b/data/2026/CVE-2026-126844.json new file mode 100644 index 0000000000..accbe8a5af --- /dev/null +++ b/data/2026/CVE-2026-126844.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126844","lastModified":"2026-11-11T23:17:12.247","metrics":{},"published":"2026-11-11T23:17:12.147","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576944655"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126845.json b/data/2026/CVE-2026-126845.json new file mode 100644 index 0000000000..59c5ff4d82 --- /dev/null +++ b/data/2026/CVE-2026-126845.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126845","lastModified":"2026-11-11T23:17:12.373","metrics":{},"published":"2026-11-11T23:17:12.277","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574795295"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126846.json b/data/2026/CVE-2026-126846.json new file mode 100644 index 0000000000..12c5c4d39c --- /dev/null +++ b/data/2026/CVE-2026-126846.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126846","lastModified":"2026-11-11T23:17:12.493","metrics":{},"published":"2026-11-11T23:17:12.403","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580857377"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126847.json b/data/2026/CVE-2026-126847.json new file mode 100644 index 0000000000..2cddb6fde5 --- /dev/null +++ b/data/2026/CVE-2026-126847.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126847","lastModified":"2026-11-11T23:17:12.623","metrics":{},"published":"2026-11-11T23:17:12.527","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/572988453"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126848.json b/data/2026/CVE-2026-126848.json new file mode 100644 index 0000000000..d95e4c1622 --- /dev/null +++ b/data/2026/CVE-2026-126848.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126848","lastModified":"2026-11-11T23:17:12.760","metrics":{},"published":"2026-11-11T23:17:12.650","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578685477"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126849.json b/data/2026/CVE-2026-126849.json new file mode 100644 index 0000000000..0988f44f9e --- /dev/null +++ b/data/2026/CVE-2026-126849.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126849","lastModified":"2026-11-11T23:17:12.907","metrics":{},"published":"2026-11-11T23:17:12.793","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579313193"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126850.json b/data/2026/CVE-2026-126850.json new file mode 100644 index 0000000000..abb5826f93 --- /dev/null +++ b/data/2026/CVE-2026-126850.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126850","lastModified":"2026-11-11T23:17:13.037","metrics":{},"published":"2026-11-11T23:17:12.937","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580853808"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126851.json b/data/2026/CVE-2026-126851.json new file mode 100644 index 0000000000..d46caf7279 --- /dev/null +++ b/data/2026/CVE-2026-126851.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126851","lastModified":"2026-11-11T23:17:13.170","metrics":{},"published":"2026-11-11T23:17:13.070","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574792758"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126852.json b/data/2026/CVE-2026-126852.json new file mode 100644 index 0000000000..7463a184cc --- /dev/null +++ b/data/2026/CVE-2026-126852.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126852","lastModified":"2026-11-11T23:17:13.293","metrics":{},"published":"2026-11-11T23:17:13.200","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580846651"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126853.json b/data/2026/CVE-2026-126853.json new file mode 100644 index 0000000000..5e80bd02d6 --- /dev/null +++ b/data/2026/CVE-2026-126853.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126853","lastModified":"2026-11-11T23:17:13.440","metrics":{},"published":"2026-11-11T23:17:13.327","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/573263421"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126854.json b/data/2026/CVE-2026-126854.json new file mode 100644 index 0000000000..f5992e812c --- /dev/null +++ b/data/2026/CVE-2026-126854.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126854","lastModified":"2026-11-11T23:17:13.580","metrics":{},"published":"2026-11-11T23:17:13.473","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578655807"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126855.json b/data/2026/CVE-2026-126855.json new file mode 100644 index 0000000000..4a4d970d29 --- /dev/null +++ b/data/2026/CVE-2026-126855.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126855","lastModified":"2026-11-11T23:17:13.713","metrics":{},"published":"2026-11-11T23:17:13.610","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579300424"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126856.json b/data/2026/CVE-2026-126856.json new file mode 100644 index 0000000000..399006d31b --- /dev/null +++ b/data/2026/CVE-2026-126856.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in Cache in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126856","lastModified":"2026-11-11T23:17:13.850","metrics":{},"published":"2026-11-11T23:17:13.747","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577260644"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-459"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126857.json b/data/2026/CVE-2026-126857.json new file mode 100644 index 0000000000..5f5d41e0f3 --- /dev/null +++ b/data/2026/CVE-2026-126857.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126857","lastModified":"2026-11-11T23:17:13.977","metrics":{},"published":"2026-11-11T23:17:13.883","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578656869"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126858.json b/data/2026/CVE-2026-126858.json new file mode 100644 index 0000000000..5531d6b3c0 --- /dev/null +++ b/data/2026/CVE-2026-126858.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126858","lastModified":"2026-11-11T23:17:14.110","metrics":{},"published":"2026-11-11T23:17:14.010","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575937643"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126859.json b/data/2026/CVE-2026-126859.json new file mode 100644 index 0000000000..8fe49a34d4 --- /dev/null +++ b/data/2026/CVE-2026-126859.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Link following in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126859","lastModified":"2026-11-11T23:17:14.257","metrics":{},"published":"2026-11-11T23:17:14.153","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/563340397"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126860.json b/data/2026/CVE-2026-126860.json new file mode 100644 index 0000000000..052a811e6c --- /dev/null +++ b/data/2026/CVE-2026-126860.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126860","lastModified":"2026-11-11T23:17:14.390","metrics":{},"published":"2026-11-11T23:17:14.287","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/581785712"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126861.json b/data/2026/CVE-2026-126861.json new file mode 100644 index 0000000000..0ece2d1bec --- /dev/null +++ b/data/2026/CVE-2026-126861.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Media in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126861","lastModified":"2026-11-11T23:17:14.523","metrics":{},"published":"2026-11-11T23:17:14.423","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577171064"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126862.json b/data/2026/CVE-2026-126862.json new file mode 100644 index 0000000000..8a7a00487c --- /dev/null +++ b/data/2026/CVE-2026-126862.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High)"}],"id":"CVE-2026-126862","lastModified":"2026-11-11T23:17:14.650","metrics":{},"published":"2026-11-11T23:17:14.553","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574381704"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126863.json b/data/2026/CVE-2026-126863.json new file mode 100644 index 0000000000..b745426abb --- /dev/null +++ b/data/2026/CVE-2026-126863.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in HTML in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126863","lastModified":"2026-11-11T23:17:14.790","metrics":{},"published":"2026-11-11T23:17:14.687","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575312521"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126864.json b/data/2026/CVE-2026-126864.json new file mode 100644 index 0000000000..11fe5f9502 --- /dev/null +++ b/data/2026/CVE-2026-126864.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126864","lastModified":"2026-11-11T23:17:14.930","metrics":{},"published":"2026-11-11T23:17:14.820","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/567827593"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126865.json b/data/2026/CVE-2026-126865.json new file mode 100644 index 0000000000..3365308fe2 --- /dev/null +++ b/data/2026/CVE-2026-126865.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in DOM in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126865","lastModified":"2026-11-11T23:17:15.070","metrics":{},"published":"2026-11-11T23:17:14.960","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/573335176"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126866.json b/data/2026/CVE-2026-126866.json new file mode 100644 index 0000000000..824f8f3bb0 --- /dev/null +++ b/data/2026/CVE-2026-126866.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: High)"}],"id":"CVE-2026-126866","lastModified":"2026-11-11T23:17:15.200","metrics":{},"published":"2026-11-11T23:17:15.103","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576943246"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126867.json b/data/2026/CVE-2026-126867.json new file mode 100644 index 0000000000..58222c812d --- /dev/null +++ b/data/2026/CVE-2026-126867.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Browser in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126867","lastModified":"2026-11-11T23:17:15.323","metrics":{},"published":"2026-11-11T23:17:15.230","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575086736"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126868.json b/data/2026/CVE-2026-126868.json new file mode 100644 index 0000000000..0e0e8122d1 --- /dev/null +++ b/data/2026/CVE-2026-126868.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126868","lastModified":"2026-11-11T23:17:15.483","metrics":{},"published":"2026-11-11T23:17:15.363","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580867734"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126869.json b/data/2026/CVE-2026-126869.json new file mode 100644 index 0000000000..ca79bc4b63 --- /dev/null +++ b/data/2026/CVE-2026-126869.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126869","lastModified":"2026-11-11T23:17:15.617","metrics":{},"published":"2026-11-11T23:17:15.517","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575533210"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126870.json b/data/2026/CVE-2026-126870.json new file mode 100644 index 0000000000..f4a637124e --- /dev/null +++ b/data/2026/CVE-2026-126870.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in ANGLE in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126870","lastModified":"2026-11-11T23:17:15.750","metrics":{},"published":"2026-11-11T23:17:15.647","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/568906910"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126871.json b/data/2026/CVE-2026-126871.json new file mode 100644 index 0000000000..056feb45c4 --- /dev/null +++ b/data/2026/CVE-2026-126871.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126871","lastModified":"2026-11-11T23:17:15.873","metrics":{},"published":"2026-11-11T23:17:15.780","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574218401"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126872.json b/data/2026/CVE-2026-126872.json new file mode 100644 index 0000000000..173c03bf8b --- /dev/null +++ b/data/2026/CVE-2026-126872.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126872","lastModified":"2026-11-11T23:17:16.010","metrics":{},"published":"2026-11-11T23:17:15.907","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577376424"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126873.json b/data/2026/CVE-2026-126873.json new file mode 100644 index 0000000000..816498fd1a --- /dev/null +++ b/data/2026/CVE-2026-126873.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Extensions in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126873","lastModified":"2026-11-11T23:17:16.130","metrics":{},"published":"2026-11-11T23:17:16.040","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577336494"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126874.json b/data/2026/CVE-2026-126874.json new file mode 100644 index 0000000000..feace7ec0a --- /dev/null +++ b/data/2026/CVE-2026-126874.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126874","lastModified":"2026-11-11T23:17:16.277","metrics":{},"published":"2026-11-11T23:17:16.163","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576439987"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126875.json b/data/2026/CVE-2026-126875.json new file mode 100644 index 0000000000..a4996f4040 --- /dev/null +++ b/data/2026/CVE-2026-126875.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126875","lastModified":"2026-11-11T23:17:16.413","metrics":{},"published":"2026-11-11T23:17:16.310","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574222006"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126876.json b/data/2026/CVE-2026-126876.json new file mode 100644 index 0000000000..3391996713 --- /dev/null +++ b/data/2026/CVE-2026-126876.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126876","lastModified":"2026-11-11T23:17:16.550","metrics":{},"published":"2026-11-11T23:17:16.450","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576664769"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126877.json b/data/2026/CVE-2026-126877.json new file mode 100644 index 0000000000..1fed778991 --- /dev/null +++ b/data/2026/CVE-2026-126877.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Dawn in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126877","lastModified":"2026-11-11T23:17:16.693","metrics":{},"published":"2026-11-11T23:17:16.580","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577377985"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126878.json b/data/2026/CVE-2026-126878.json new file mode 100644 index 0000000000..9767d23e0b --- /dev/null +++ b/data/2026/CVE-2026-126878.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126878","lastModified":"2026-11-11T23:17:16.830","metrics":{},"published":"2026-11-11T23:17:16.723","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/572312779"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126879.json b/data/2026/CVE-2026-126879.json new file mode 100644 index 0000000000..4ecb97264e --- /dev/null +++ b/data/2026/CVE-2026-126879.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126879","lastModified":"2026-11-11T23:17:16.970","metrics":{},"published":"2026-11-11T23:17:16.860","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576736463"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126880.json b/data/2026/CVE-2026-126880.json new file mode 100644 index 0000000000..de1d010494 --- /dev/null +++ b/data/2026/CVE-2026-126880.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126880","lastModified":"2026-11-11T23:17:17.103","metrics":{},"published":"2026-11-11T23:17:17.007","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577366752"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126881.json b/data/2026/CVE-2026-126881.json new file mode 100644 index 0000000000..396e17ab23 --- /dev/null +++ b/data/2026/CVE-2026-126881.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper initialization in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126881","lastModified":"2026-11-11T23:17:17.240","metrics":{},"published":"2026-11-11T23:17:17.137","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575038730"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-665"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126882.json b/data/2026/CVE-2026-126882.json new file mode 100644 index 0000000000..31c9dee0a1 --- /dev/null +++ b/data/2026/CVE-2026-126882.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126882","lastModified":"2026-11-11T23:17:17.367","metrics":{},"published":"2026-11-11T23:17:17.270","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578685706"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126883.json b/data/2026/CVE-2026-126883.json new file mode 100644 index 0000000000..6f05ad69cf --- /dev/null +++ b/data/2026/CVE-2026-126883.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126883","lastModified":"2026-11-11T23:17:17.493","metrics":{},"published":"2026-11-11T23:17:17.400","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578659604"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126884.json b/data/2026/CVE-2026-126884.json new file mode 100644 index 0000000000..b67a84a54c --- /dev/null +++ b/data/2026/CVE-2026-126884.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126884","lastModified":"2026-11-11T23:17:17.620","metrics":{},"published":"2026-11-11T23:17:17.523","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576949530"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126885.json b/data/2026/CVE-2026-126885.json new file mode 100644 index 0000000000..11090ba916 --- /dev/null +++ b/data/2026/CVE-2026-126885.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126885","lastModified":"2026-11-11T23:17:17.747","metrics":{},"published":"2026-11-11T23:17:17.650","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/568699166"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126886.json b/data/2026/CVE-2026-126886.json new file mode 100644 index 0000000000..f6960c1e68 --- /dev/null +++ b/data/2026/CVE-2026-126886.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126886","lastModified":"2026-11-11T23:17:17.880","metrics":{},"published":"2026-11-11T23:17:17.780","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/567611696"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126887.json b/data/2026/CVE-2026-126887.json new file mode 100644 index 0000000000..1e347234f3 --- /dev/null +++ b/data/2026/CVE-2026-126887.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Animation in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126887","lastModified":"2026-11-11T23:17:18.003","metrics":{},"published":"2026-11-11T23:17:17.907","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/567611698"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126888.json b/data/2026/CVE-2026-126888.json new file mode 100644 index 0000000000..2f94ca9e8f --- /dev/null +++ b/data/2026/CVE-2026-126888.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126888","lastModified":"2026-11-11T23:17:18.150","metrics":{},"published":"2026-11-11T23:17:18.033","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577461556"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126889.json b/data/2026/CVE-2026-126889.json new file mode 100644 index 0000000000..cda4edceca --- /dev/null +++ b/data/2026/CVE-2026-126889.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Off-by-one error in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126889","lastModified":"2026-11-11T23:17:18.277","metrics":{},"published":"2026-11-11T23:17:18.180","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/560620348"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126890.json b/data/2026/CVE-2026-126890.json new file mode 100644 index 0000000000..2eb328bebb --- /dev/null +++ b/data/2026/CVE-2026-126890.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126890","lastModified":"2026-11-11T23:17:18.420","metrics":{},"published":"2026-11-11T23:17:18.307","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/581629247"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126891.json b/data/2026/CVE-2026-126891.json new file mode 100644 index 0000000000..64c11ff27d --- /dev/null +++ b/data/2026/CVE-2026-126891.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126891","lastModified":"2026-11-11T23:17:18.580","metrics":{},"published":"2026-11-11T23:17:18.460","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575939904"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126892.json b/data/2026/CVE-2026-126892.json new file mode 100644 index 0000000000..b2cfe8cbca --- /dev/null +++ b/data/2026/CVE-2026-126892.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126892","lastModified":"2026-11-11T23:17:18.733","metrics":{},"published":"2026-11-11T23:17:18.617","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578656065"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126893.json b/data/2026/CVE-2026-126893.json new file mode 100644 index 0000000000..af1eb1088e --- /dev/null +++ b/data/2026/CVE-2026-126893.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds write in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126893","lastModified":"2026-11-11T23:17:18.857","metrics":{},"published":"2026-11-11T23:17:18.760","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579278668"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126894.json b/data/2026/CVE-2026-126894.json new file mode 100644 index 0000000000..3495cb73c7 --- /dev/null +++ b/data/2026/CVE-2026-126894.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126894","lastModified":"2026-11-11T23:17:18.993","metrics":{},"published":"2026-11-11T23:17:18.890","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576950618"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126895.json b/data/2026/CVE-2026-126895.json new file mode 100644 index 0000000000..7655101d0c --- /dev/null +++ b/data/2026/CVE-2026-126895.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126895","lastModified":"2026-11-11T23:17:19.140","metrics":{},"published":"2026-11-11T23:17:19.020","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575524700"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126896.json b/data/2026/CVE-2026-126896.json new file mode 100644 index 0000000000..16f01cdfea --- /dev/null +++ b/data/2026/CVE-2026-126896.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing authorization in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126896","lastModified":"2026-11-11T23:17:19.277","metrics":{},"published":"2026-11-11T23:17:19.170","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/575524702"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126897.json b/data/2026/CVE-2026-126897.json new file mode 100644 index 0000000000..07f5079418 --- /dev/null +++ b/data/2026/CVE-2026-126897.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126897","lastModified":"2026-11-11T23:17:19.417","metrics":{},"published":"2026-11-11T23:17:19.307","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578656106"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126898.json b/data/2026/CVE-2026-126898.json new file mode 100644 index 0000000000..2198de6db2 --- /dev/null +++ b/data/2026/CVE-2026-126898.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126898","lastModified":"2026-11-11T23:17:19.563","metrics":{},"published":"2026-11-11T23:17:19.450","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574216555"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126899.json b/data/2026/CVE-2026-126899.json new file mode 100644 index 0000000000..017fcfdd66 --- /dev/null +++ b/data/2026/CVE-2026-126899.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Elements in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126899","lastModified":"2026-11-11T23:17:19.697","metrics":{},"published":"2026-11-11T23:17:19.600","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/583122799"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126900.json b/data/2026/CVE-2026-126900.json new file mode 100644 index 0000000000..54e8f8a84f --- /dev/null +++ b/data/2026/CVE-2026-126900.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126900","lastModified":"2026-11-11T23:17:19.823","metrics":{},"published":"2026-11-11T23:17:19.730","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574409610"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126901.json b/data/2026/CVE-2026-126901.json new file mode 100644 index 0000000000..538211fb6b --- /dev/null +++ b/data/2026/CVE-2026-126901.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in PDF in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126901","lastModified":"2026-11-11T23:17:19.963","metrics":{},"published":"2026-11-11T23:17:19.857","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579818899"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126902.json b/data/2026/CVE-2026-126902.json new file mode 100644 index 0000000000..58ce67c427 --- /dev/null +++ b/data/2026/CVE-2026-126902.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126902","lastModified":"2026-11-11T23:17:20.100","metrics":{},"published":"2026-11-11T23:17:20.000","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580867480"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-706"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126903.json b/data/2026/CVE-2026-126903.json new file mode 100644 index 0000000000..005b3dbd55 --- /dev/null +++ b/data/2026/CVE-2026-126903.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper state validation in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126903","lastModified":"2026-11-11T23:17:20.237","metrics":{},"published":"2026-11-11T23:17:20.133","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574035865"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-754"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126904.json b/data/2026/CVE-2026-126904.json new file mode 100644 index 0000000000..baa9f7484e --- /dev/null +++ b/data/2026/CVE-2026-126904.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126904","lastModified":"2026-11-11T23:17:20.373","metrics":{},"published":"2026-11-11T23:17:20.273","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574410140"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126905.json b/data/2026/CVE-2026-126905.json new file mode 100644 index 0000000000..33276fe8fb --- /dev/null +++ b/data/2026/CVE-2026-126905.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126905","lastModified":"2026-11-11T23:17:20.507","metrics":{},"published":"2026-11-11T23:17:20.403","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577305517"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-459"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126906.json b/data/2026/CVE-2026-126906.json new file mode 100644 index 0000000000..557f17a403 --- /dev/null +++ b/data/2026/CVE-2026-126906.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via crafted network traffic. (Chromium security severity: High)"}],"id":"CVE-2026-126906","lastModified":"2026-11-11T23:17:20.660","metrics":{},"published":"2026-11-11T23:17:20.553","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/578693038"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126907.json b/data/2026/CVE-2026-126907.json new file mode 100644 index 0000000000..616870a034 --- /dev/null +++ b/data/2026/CVE-2026-126907.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126907","lastModified":"2026-11-11T23:17:20.800","metrics":{},"published":"2026-11-11T23:17:20.697","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574791611"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126908.json b/data/2026/CVE-2026-126908.json new file mode 100644 index 0000000000..782b56f5e9 --- /dev/null +++ b/data/2026/CVE-2026-126908.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126908","lastModified":"2026-11-11T23:17:20.937","metrics":{},"published":"2026-11-11T23:17:20.830","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579313083"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126909.json b/data/2026/CVE-2026-126909.json new file mode 100644 index 0000000000..15728f0b29 --- /dev/null +++ b/data/2026/CVE-2026-126909.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Passwords in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126909","lastModified":"2026-11-11T23:17:21.060","metrics":{},"published":"2026-11-11T23:17:20.963","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/572501958"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126910.json b/data/2026/CVE-2026-126910.json new file mode 100644 index 0000000000..dc3d0e9e03 --- /dev/null +++ b/data/2026/CVE-2026-126910.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126910","lastModified":"2026-11-11T23:17:21.193","metrics":{},"published":"2026-11-11T23:17:21.093","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574059463"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126911.json b/data/2026/CVE-2026-126911.json new file mode 100644 index 0000000000..4e87d2e3dd --- /dev/null +++ b/data/2026/CVE-2026-126911.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)"}],"id":"CVE-2026-126911","lastModified":"2026-11-11T23:17:21.320","metrics":{},"published":"2026-11-11T23:17:21.220","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580921803"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126912.json b/data/2026/CVE-2026-126912.json new file mode 100644 index 0000000000..f32795fbca --- /dev/null +++ b/data/2026/CVE-2026-126912.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Buffer overflow in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126912","lastModified":"2026-11-11T23:17:21.473","metrics":{},"published":"2026-11-11T23:17:21.357","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/569286603"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126913.json b/data/2026/CVE-2026-126913.json new file mode 100644 index 0000000000..31adb54e8b --- /dev/null +++ b/data/2026/CVE-2026-126913.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126913","lastModified":"2026-11-11T23:17:21.630","metrics":{},"published":"2026-11-11T23:17:21.513","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580875215"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126914.json b/data/2026/CVE-2026-126914.json new file mode 100644 index 0000000000..7d35c437ab --- /dev/null +++ b/data/2026/CVE-2026-126914.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126914","lastModified":"2026-11-11T23:17:21.763","metrics":{},"published":"2026-11-11T23:17:21.660","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577346516"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126915.json b/data/2026/CVE-2026-126915.json new file mode 100644 index 0000000000..3e0727c456 --- /dev/null +++ b/data/2026/CVE-2026-126915.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use of uninitialized variable in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126915","lastModified":"2026-11-11T23:17:21.910","metrics":{},"published":"2026-11-11T23:17:21.800","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/579276256"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-457"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126916.json b/data/2026/CVE-2026-126916.json new file mode 100644 index 0000000000..1e235249ae --- /dev/null +++ b/data/2026/CVE-2026-126916.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126916","lastModified":"2026-11-11T23:17:22.070","metrics":{},"published":"2026-11-11T23:17:21.950","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/574025697"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126917.json b/data/2026/CVE-2026-126917.json new file mode 100644 index 0000000000..b76c57e666 --- /dev/null +++ b/data/2026/CVE-2026-126917.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Memory corruption in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126917","lastModified":"2026-11-11T23:17:22.237","metrics":{},"published":"2026-11-11T23:17:22.107","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577242082"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-119"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126918.json b/data/2026/CVE-2026-126918.json new file mode 100644 index 0000000000..07cbd3e28a --- /dev/null +++ b/data/2026/CVE-2026-126918.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126918","lastModified":"2026-11-11T23:17:22.367","metrics":{},"published":"2026-11-11T23:17:22.267","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/576855527"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126919.json b/data/2026/CVE-2026-126919.json new file mode 100644 index 0000000000..29592a3a76 --- /dev/null +++ b/data/2026/CVE-2026-126919.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in BrowserTag in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126919","lastModified":"2026-11-11T23:17:22.500","metrics":{},"published":"2026-11-11T23:17:22.397","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/569674220"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126920.json b/data/2026/CVE-2026-126920.json new file mode 100644 index 0000000000..c32490b70a --- /dev/null +++ b/data/2026/CVE-2026-126920.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126920","lastModified":"2026-11-11T23:17:22.623","metrics":{},"published":"2026-11-11T23:17:22.527","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/581903854"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126921.json b/data/2026/CVE-2026-126921.json new file mode 100644 index 0000000000..a3b348e450 --- /dev/null +++ b/data/2026/CVE-2026-126921.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126921","lastModified":"2026-11-11T23:17:22.767","metrics":{},"published":"2026-11-11T23:17:22.663","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/580869107"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126922.json b/data/2026/CVE-2026-126922.json new file mode 100644 index 0000000000..4773ee716f --- /dev/null +++ b/data/2026/CVE-2026-126922.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"product":"Chrome","vendor":"Google","versions":[{"lessThan":"157.0.8103.78","status":"affected","version":"157.0.8103.78","versionType":"custom"}]}],"source":"chrome-cve-admin@google.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)"}],"id":"CVE-2026-126922","lastModified":"2026-11-11T23:17:22.900","metrics":{},"published":"2026-11-11T23:17:22.800","references":[{"source":"chrome-cve-admin@google.com","url":"https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html"},{"source":"chrome-cve-admin@google.com","url":"https://issues.chromium.org/issues/577341943"}],"sourceIdentifier":"chrome-cve-admin@google.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"chrome-cve-admin@google.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126932.json b/data/2026/CVE-2026-126932.json new file mode 100644 index 0000000000..0d34f7a099 --- /dev/null +++ b/data/2026/CVE-2026-126932.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/diced/zipline","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.8.0","status":"affected","version":"4.6.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type."}],"id":"CVE-2026-126932","lastModified":"2026-11-11T23:17:22.943","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T23:17:22.943","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/user/files/%5Bid%5D/index.ts#L96"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/commit/fc8e886ca841b86a3f677cd7dac1bf9a5bd45b2c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/releases/tag/v4.8.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-rgxm-54cf-whf7"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-4.6.2-before-4.8.0-disabled-mime-type-policy-bypass-via-file-metadata-update"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126933.json b/data/2026/CVE-2026-126933.json new file mode 100644 index 0000000000..345ef1192b --- /dev/null +++ b/data/2026/CVE-2026-126933.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/diced/zipline","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.8.0","status":"affected","version":"4.0.0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undotted disabledExtensions entries, letting authenticated or permitted unauthenticated folder uploaders bypass administrator restrictions."}],"id":"CVE-2026-126933","lastModified":"2026-11-11T23:17:23.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T23:17:23.110","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/index.ts#L170"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/api/upload/partial.ts#L294"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/commit/dbc1fe502130a8ebd95fa04886efec01402e5b5f"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/releases/tag/v4.8.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-wwrw-gq56-7wpj"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-4.0.0-before-4.8.0-disabled-extensions-upload-filter-bypass-via-extension-format-mismatch"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-184"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126934.json b/data/2026/CVE-2026-126934.json new file mode 100644 index 0000000000..b2fa963c52 --- /dev/null +++ b/data/2026/CVE-2026-126934.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/diced/zipline","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.8.0","status":"affected","version":"4.3.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade throttling by spoofing X-Forwarded-For headers when core.trustProxy is enabled. Attackers can send a different X-Forwarded-For value per request to obtain fresh rate-limit buckets, enabling unlimited guessing of login passwords, TOTP codes, and file and URL passwords."}],"id":"CVE-2026-126934","lastModified":"2026-11-11T23:17:23.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T23:17:23.273","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/blob/v4.7.0/src/server/index.ts#L58-L62"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/blob/v4.7.0/src/server/startup/plugins.ts#L70-L73"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/commit/6bac7e6bb18cb37c1d09f91306c1ffbdca00097c"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/releases/tag/v4.8.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-v938-v8wg-9497"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-4.3.2-before-4.8.0-rate-limit-bypass-via-spoofed-x-forwarded-for"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-348"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-126935.json b/data/2026/CVE-2026-126935.json new file mode 100644 index 0000000000..647b4b30b3 --- /dev/null +++ b/data/2026/CVE-2026-126935.json @@ -0,0 +1 @@ +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:github/diced/zipline","product":"zipline","vendor":"diced","versions":[{"lessThan":"4.8.0","status":"affected","version":"0","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the same pre-increment count, viewing view-limited or delete-on-max-views files beyond their limit."}],"id":"CVE-2026-126935","lastModified":"2026-11-11T23:17:23.427","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}]},"published":"2026-11-11T23:17:23.427","references":[{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/blob/v4.7.0/src/server/routes/raw/%5Bid%5D.ts#L101-L133"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/commit/1770479d6795ea8700f0ce6ba08a1654d3644c73"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/releases/tag/v4.8.0"},{"source":"disclosure@vulncheck.com","url":"https://github.com/diced/zipline/security/advisories/GHSA-7xv9-wr46-j578"},{"source":"disclosure@vulncheck.com","url":"https://www.vulncheck.com/advisories/zipline-before-4.8.0-maxviews-limit-bypass-via-race-condition"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"disclosure@vulncheck.com","type":"Primary"}]} diff --git a/data/2026/CVE-2026-1660.json b/data/2026/CVE-2026-1660.json index eb1535d54d..8aadff7419 100644 --- a/data/2026/CVE-2026-1660.json +++ b/data/2026/CVE-2026-1660.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"GitLab","repo":"git://git@gitlab.com:gitlab-org/gitlab.git","vendor":"GitLab","versions":[{"lessThan":"18.9.6","status":"affected","version":"12.3","versionType":"semver"},{"lessThan":"18.10.4","status":"affected","version":"18.10","versionType":"semver"},{"lessThan":"18.11.1","status":"affected","version":"18.11","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"645F1F94-5DB2-4F63-A978-29F67486FD8C","versionEndExcluding":"18.9.6","versionStartIncluding":"12.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"4ED51050-8CA2-4875-AA85-5E2AD7E8C884","versionEndExcluding":"18.9.6","versionStartIncluding":"12.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"98D16D9B-6A45-45F3-934B-3ED95C8371BF","versionEndExcluding":"18.10.4","versionStartIncluding":"18.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"58B8096F-9D7B-403D-B685-E9D4FA24F3E5","versionEndExcluding":"18.10.4","versionStartIncluding":"18.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:18.11.0:*:*:*:community:*:*:*","matchCriteriaId":"A6100523-821F-4F41-872D-AC5A60EECC19","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:18.11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"C78F9577-CDD5-497B-A92F-3C578AC6709E","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to cause denial of service when importing issues due to improper input validation."}],"id":"CVE-2026-1660","lastModified":"2026-06-17T10:16:16.243","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1660","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T17:38:02.392370Z","version":"2.0.3"}}]},"published":"2026-04-22T17:16:33.697","references":[{"source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"],"url":"https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/"},{"source":"cve@gitlab.com","tags":["Broken Link"],"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/588200"},{"source":"cve@gitlab.com","tags":["Permissions Required"],"url":"https://hackerone.com/reports/3518743"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"cve@gitlab.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"GitLab","repo":"git://git@gitlab.com:gitlab-org/gitlab.git","vendor":"GitLab","versions":[{"lessThan":"18.9.6","status":"affected","version":"12.3","versionType":"semver"},{"lessThan":"18.10.4","status":"affected","version":"18.10","versionType":"semver"},{"lessThan":"18.11.1","status":"affected","version":"18.11","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"645F1F94-5DB2-4F63-A978-29F67486FD8C","versionEndExcluding":"18.9.6","versionStartIncluding":"12.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"4ED51050-8CA2-4875-AA85-5E2AD7E8C884","versionEndExcluding":"18.9.6","versionStartIncluding":"12.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","matchCriteriaId":"98D16D9B-6A45-45F3-934B-3ED95C8371BF","versionEndExcluding":"18.10.4","versionStartIncluding":"18.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","matchCriteriaId":"58B8096F-9D7B-403D-B685-E9D4FA24F3E5","versionEndExcluding":"18.10.4","versionStartIncluding":"18.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:18.11.0:*:*:*:community:*:*:*","matchCriteriaId":"A6100523-821F-4F41-872D-AC5A60EECC19","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:18.11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"C78F9577-CDD5-497B-A92F-3C578AC6709E","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to cause denial of service when importing issues due to improper input validation."},{"lang":"es","value":"GitLab ha remediado un problema en GitLab CE/EE que afectaba a todas las versiones desde la 12.3 antes de la 18.9.6, la 18.10 antes de la 18.10.4, y la 18.11 antes de la 18.11.1 que bajo ciertas condiciones podría haber permitido a un usuario autenticado causar denegación de servicio al importar incidencias debido a una validación de entrada incorrecta."}],"id":"CVE-2026-1660","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1660","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T17:38:02.392370Z","version":"2.0.3"}}]},"published":"2026-04-22T17:16:33.697","references":[{"source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"],"url":"https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/"},{"source":"cve@gitlab.com","tags":["Broken Link"],"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/588200"},{"source":"cve@gitlab.com","tags":["Permissions Required"],"url":"https://hackerone.com/reports/3518743"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"cve@gitlab.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-1900.json b/data/2026/CVE-2026-1900.json index 68d8330f92..26e79f08ff 100644 --- a/data/2026/CVE-2026-1900.json +++ b/data/2026/CVE-2026-1900.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Link Whisper Free","vendor":"Unknown","versions":[{"lessThan":"0.9.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:linkwhisper:link_whisper:*:*:*:*:free:wordpress:*:*","matchCriteriaId":"5862AD25-0EE5-4EF5-AD38-999A1BAE2682","versionEndExcluding":"0.9.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates."}],"id":"CVE-2026-1900","lastModified":"2026-06-17T10:16:41.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1900","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-07T16:26:01.391370Z","version":"2.0.3"}}]},"published":"2026-04-07T07:16:23.803","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/dc10b627-7981-4c53-bc9d-e87418f3fcfc/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Link Whisper Free","vendor":"Unknown","versions":[{"lessThan":"0.9.1","status":"affected","version":"0","versionType":"semver"}]}],"source":"contact@wpscan.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:linkwhisper:link_whisper:*:*:*:*:free:wordpress:*:*","matchCriteriaId":"5862AD25-0EE5-4EF5-AD38-999A1BAE2682","versionEndExcluding":"0.9.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates."},{"lang":"es","value":"El plugin de WordPress Link Whisper Free anterior a 0.9.1 tiene un endpoint REST de acceso público que permite actualizaciones de configuración no autenticadas."}],"id":"CVE-2026-1900","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1900","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-07T16:26:01.391370Z","version":"2.0.3"}}]},"published":"2026-04-07T07:16:23.803","references":[{"source":"contact@wpscan.com","tags":["Exploit","Third Party Advisory"],"url":"https://wpscan.com/vulnerability/dc10b627-7981-4c53-bc9d-e87418f3fcfc/"}],"sourceIdentifier":"contact@wpscan.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-306"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-22560.json b/data/2026/CVE-2026-22560.json index 4bc3042a96..925f6c3246 100644 --- a/data/2026/CVE-2026-22560.json +++ b/data/2026/CVE-2026-22560.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Rocket.Chat","vendor":"Rocket.Chat","versions":[{"lessThan":"8.4.0","status":"affected","version":"8.4.0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*","matchCriteriaId":"56DAA79C-714C-4F43-AA4B-FA20A6C95473","versionEndExcluding":"8.4.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML endpoint."}],"id":"CVE-2026-22560","lastModified":"2026-06-17T10:20:04.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-22560","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T19:04:29.881437Z","version":"2.0.3"}}]},"published":"2026-04-10T17:17:01.980","references":[{"source":"support@hackerone.com","tags":["Issue Tracking"],"url":"https://github.com/RocketChat/Rocket.Chat/pull/38994"},{"source":"support@hackerone.com","tags":["Issue Tracking"],"url":"https://hackerone.com/reports/3418031"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Rocket.Chat","vendor":"Rocket.Chat","versions":[{"lessThan":"8.4.0","status":"affected","version":"8.4.0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*","matchCriteriaId":"56DAA79C-714C-4F43-AA4B-FA20A6C95473","versionEndExcluding":"8.4.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML endpoint."},{"lang":"es","value":"Una vulnerabilidad de redirección abierta en versiones de Rocket.Chat anteriores a la 8.4.0 permite que los usuarios sean redirigidos a URLs arbitrarias mediante la manipulación de parámetros dentro de un endpoint SAML."}],"id":"CVE-2026-22560","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-22560","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T19:04:29.881437Z","version":"2.0.3"}}]},"published":"2026-04-10T17:17:01.980","references":[{"source":"support@hackerone.com","tags":["Issue Tracking"],"url":"https://github.com/RocketChat/Rocket.Chat/pull/38994"},{"source":"support@hackerone.com","tags":["Issue Tracking"],"url":"https://hackerone.com/reports/3418031"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-28201.json b/data/2026/CVE-2026-28201.json index 213729c2b4..d87d46025d 100644 --- a/data/2026/CVE-2026-28201.json +++ b/data/2026/CVE-2026-28201.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Open Notebook","vendor":"Open Notebook","versions":[{"lessThanOrEqual":"1.8.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:lfnovo:open-notebook:*:*:*:*:*:*:*:*","matchCriteriaId":"098D8544-AAE9-4880-A866-FCD895172668","versionEndExcluding":"1.8.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration is also possible."}],"id":"CVE-2026-28201","lastModified":"2026-06-17T10:28:19.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-28201","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-07T11:36:54.925593Z","version":"2.0.3"}}]},"published":"2026-05-07T11:16:00.747","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","tags":["Vendor Advisory"],"url":"https://github.com/lfnovo/open-notebook/security/advisories/GHSA-5wj9-f8q5-8f9c"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-917"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Open Notebook","vendor":"Open Notebook","versions":[{"lessThanOrEqual":"1.8.2","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:lfnovo:open-notebook:*:*:*:*:*:*:*:*","matchCriteriaId":"098D8544-AAE9-4880-A866-FCD895172668","versionEndExcluding":"1.8.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user to alter or delete arbitrary database entries via specially crafted malicious URL. Depending on the deployment, data exfiltration is also possible."},{"lang":"es","value":"Una validación de entrada incorrecta, junto con una configuración CORS predeterminada excesivamente permisiva en Open Notebook v1.8.1, permite a un atacante remoto engañar a un usuario legítimo para alterar o eliminar entradas arbitrarias de la base de datos a través de una URL maliciosa especialmente diseñada. Dependiendo del despliegue, la exfiltración de datos también es posible."}],"id":"CVE-2026-28201","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-28201","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-07T11:36:54.925593Z","version":"2.0.3"}}]},"published":"2026-05-07T11:16:00.747","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","tags":["Vendor Advisory"],"url":"https://github.com/lfnovo/open-notebook/security/advisories/GHSA-5wj9-f8q5-8f9c"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-917"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-29080.json b/data/2026/CVE-2026-29080.json index 32b255da5f..2b50718a29 100644 --- a/data/2026/CVE-2026-29080.json +++ b/data/2026/CVE-2026-29080.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rucio","vendor":"rucio","versions":[{"status":"affected","version":">= 1.27.0, < 35.8.5"},{"status":"affected","version":">= 35.9.0, < 38.5.5"},{"status":"affected","version":">= 38.6.0, < 39.4.2"},{"status":"affected","version":">= 40.0.0, < 40.1.1"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"B48ED4BE-0C47-4371-BC91-A51537341CB4","versionEndExcluding":"35.8.5","versionStartIncluding":"1.27.0","vulnerable":true},{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"9569D0A4-E71A-4808-85F3-F342B63564AB","versionEndExcluding":"38.5.5","versionStartIncluding":"36.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"500B49AA-C85E-4124-B66F-B1DE39D075BC","versionEndExcluding":"39.4.2","versionStartIncluding":"39.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"865FB585-4C3B-4D49-A332-CA76C9B3C763","versionEndExcluding":"40.1.1","versionStartIncluding":"40.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids//dids/search`). On Oracle deployments attacker-controlled filter keys and values are interpolated directly into `sqlalchemy.text()` via Python `.format()`, completely bypassing parameterization. This enables full database compromise including extraction of authentication tokens, password hashes, and all managed data identifiers. This affects versions 1.27.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1.\n\nThe vulnerability exists in `lib/rucio/core/did_meta_plugins/filter_engine.py` within the `create_sqla_query()` method. When the database dialect is Oracle, filter expressions for JSON metadata columns are constructed using `text()` with Python string formatting. Both `key` and `value` are attacker-controlled strings derived from HTTP query parameters. The `text()` function creates a raw SQL fragment — it does **not** escape or parameterize its contents.\n\nAny authenticated Rucio user can exploit this through the DID search API to execute arbitrary SQL against the backend database. This can expose all managed data identifiers and sensitive tables such as identities, tokens, accounts, rse_settings, and rules, and may allow modification of database contents. The issue affects Oracle deployments using the default json_meta plugin and does not affect PostgreSQL or MySQL deployments using that plugin. \n\nThis vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1."}],"id":"CVE-2026-29080","lastModified":"2026-06-17T10:29:34.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-29080","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-06T17:21:09.695320Z","version":"2.0.3"}}]},"published":"2026-05-06T17:16:22.457","references":[{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/rucio/rucio/security/advisories/GHSA-vjr5-c9qv-hgm3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"rucio","vendor":"rucio","versions":[{"status":"affected","version":">= 1.27.0, < 35.8.5"},{"status":"affected","version":">= 35.9.0, < 38.5.5"},{"status":"affected","version":">= 38.6.0, < 39.4.2"},{"status":"affected","version":">= 40.0.0, < 40.1.1"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"B48ED4BE-0C47-4371-BC91-A51537341CB4","versionEndExcluding":"35.8.5","versionStartIncluding":"1.27.0","vulnerable":true},{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"9569D0A4-E71A-4808-85F3-F342B63564AB","versionEndExcluding":"38.5.5","versionStartIncluding":"36.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"500B49AA-C85E-4124-B66F-B1DE39D075BC","versionEndExcluding":"39.4.2","versionStartIncluding":"39.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"865FB585-4C3B-4D49-A332-CA76C9B3C763","versionEndExcluding":"40.1.1","versionStartIncluding":"40.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database through the DID search endpoint (`GET /dids//dids/search`). On Oracle deployments attacker-controlled filter keys and values are interpolated directly into `sqlalchemy.text()` via Python `.format()`, completely bypassing parameterization. This enables full database compromise including extraction of authentication tokens, password hashes, and all managed data identifiers. This affects versions 1.27.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1.\n\nThe vulnerability exists in `lib/rucio/core/did_meta_plugins/filter_engine.py` within the `create_sqla_query()` method. When the database dialect is Oracle, filter expressions for JSON metadata columns are constructed using `text()` with Python string formatting. Both `key` and `value` are attacker-controlled strings derived from HTTP query parameters. The `text()` function creates a raw SQL fragment — it does **not** escape or parameterize its contents.\n\nAny authenticated Rucio user can exploit this through the DID search API to execute arbitrary SQL against the backend database. This can expose all managed data identifiers and sensitive tables such as identities, tokens, accounts, rse_settings, and rules, and may allow modification of database contents. The issue affects Oracle deployments using the default json_meta plugin and does not affect PostgreSQL or MySQL deployments using that plugin. \n\nThis vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1."},{"lang":"es","value":"Una vulnerabilidad de inyección SQL en ’FilterEngine.create_sqla_query()’ permite a cualquier usuario Rucio autenticado ejecutar SQL arbitrario contra la base de datos backend a través del endpoint de búsqueda de DID (’GET /dids/[scope]/dids/search’). En despliegues de Oracle, las claves y valores de filtro controlados por el atacante se interpolan directamente en ’sqlalchemy.text()’ a través de Python ’.format()’, omitiendo completamente la parametrización. Esto permite el compromiso total de la base de datos, incluyendo la extracción de tokens de autenticación, hashes de contraseñas y todos los identificadores de datos gestionados. Esto afecta a las versiones 1.27.0 y posteriores anteriores a 35.8.5, 38.5.5, 39.4.2 y 40.1.1.\n\nLa vulnerabilidad existe en ’lib/rucio/core/did_meta_plugins/filter_engine.py’ dentro del método ’create_sqla_query()’. Cuando el dialecto de la base de datos es Oracle, las expresiones de filtro para columnas de metadatos JSON se construyen usando ’text()’ con formato de cadena de Python. Tanto ’key’ como ’value’ son cadenas controladas por el atacante derivadas de parámetros de consulta HTTP. La función ’text()’ crea un fragmento SQL en bruto - no escapa ni parametriza su contenido.\n\nCualquier usuario Rucio autenticado puede explotar esto a través de la API de búsqueda de DID para ejecutar SQL arbitrario contra la base de datos backend. Esto puede exponer todos los identificadores de datos gestionados y tablas sensibles como identidades, tokens, cuentas, rse_settings y reglas, y puede permitir la modificación del contenido de la base de datos. El problema afecta a los despliegues de Oracle que utilizan el plugin json_meta predeterminado y no afecta a los despliegues de PostgreSQL o MySQL que utilizan ese plugin.\n\nEsta vulnerabilidad ha sido corregida en las versiones 35.8.5, 38.5.5, 39.4.2 y 40.1.1."}],"id":"CVE-2026-29080","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-29080","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-06T17:21:09.695320Z","version":"2.0.3"}}]},"published":"2026-05-06T17:16:22.457","references":[{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/rucio/rucio/security/advisories/GHSA-vjr5-c9qv-hgm3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-29090.json b/data/2026/CVE-2026-29090.json index 7fb23636a5..c73fc1b873 100644 --- a/data/2026/CVE-2026-29090.json +++ b/data/2026/CVE-2026-29090.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rucio","vendor":"rucio","versions":[{"status":"affected","version":">= 1.30.0, < 35.8.5"},{"status":"affected","version":">= 35.9.0, < 38.5.5"},{"status":"affected","version":">= 38.6.0, < 39.4.2"},{"status":"affected","version":">= 40.0.0, < 40.1.1"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"D5B90A2B-9818-4D18-9393-A5F929A8BABC","versionEndExcluding":"35.8.5","versionStartIncluding":"1.30.0","vulnerable":true},{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"9569D0A4-E71A-4808-85F3-F342B63564AB","versionEndExcluding":"38.5.5","versionStartIncluding":"36.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"500B49AA-C85E-4124-B66F-B1DE39D075BC","versionEndExcluding":"39.4.2","versionStartIncluding":"39.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"865FB585-4C3B-4D49-A332-CA76C9B3C763","versionEndExcluding":"40.1.1","versionStartIncluding":"40.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"### Summary\n\nA SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET /dids//dids/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Python `.format()`, then passed to `psycopg3`'s `sql.SQL()` which treats the string as trusted SQL syntax. \n\nDepending on the database privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY ... FROM PROGRAM. This issue affects deployments that explicitly use the postgres_meta metadata plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1."}],"id":"CVE-2026-29090","lastModified":"2026-06-17T10:29:34.903","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-29090","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-06T18:17:46.352636Z","version":"2.0.3"}}]},"published":"2026-05-06T18:16:02.953","references":[{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/rucio/rucio/security/advisories/GHSA-6j7p-qjhg-9947"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"rucio","vendor":"rucio","versions":[{"status":"affected","version":">= 1.30.0, < 35.8.5"},{"status":"affected","version":">= 35.9.0, < 38.5.5"},{"status":"affected","version":">= 38.6.0, < 39.4.2"},{"status":"affected","version":">= 40.0.0, < 40.1.1"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"D5B90A2B-9818-4D18-9393-A5F929A8BABC","versionEndExcluding":"35.8.5","versionStartIncluding":"1.30.0","vulnerable":true},{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"9569D0A4-E71A-4808-85F3-F342B63564AB","versionEndExcluding":"38.5.5","versionStartIncluding":"36.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"500B49AA-C85E-4124-B66F-B1DE39D075BC","versionEndExcluding":"39.4.2","versionStartIncluding":"39.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:cern:rucio:*:*:*:*:*:*:*:*","matchCriteriaId":"865FB585-4C3B-4D49-A332-CA76C9B3C763","versionEndExcluding":"40.1.1","versionStartIncluding":"40.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"### Summary\n\nA SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgres_query()`. This allows any authenticated Rucio user to execute arbitrary SQL against the PostgreSQL metadata database through the DID search endpoint (`GET /dids//dids/search`). When the `postgres_meta` metadata plugin is configured, attacker-controlled filter keys and values are interpolated directly into raw SQL strings via Python `.format()`, then passed to `psycopg3`'s `sql.SQL()` which treats the string as trusted SQL syntax. \n\nDepending on the database privileges assigned to the service account, exploitation can expose sensitive tables, modify or delete metadata, access server-side files, or achieve code execution through PostgreSQL features such as COPY ... FROM PROGRAM. This issue affects deployments that explicitly use the postgres_meta metadata plugin. This vulnerability has been fixed in versions 35.8.5, 38.5.5, 39.4.2, and 40.1.1."},{"lang":"es","value":"### Resumen\n\nUna vulnerabilidad de inyección SQL existe en las versiones de Rucio 1.30.0 y posteriores anteriores a la 35.8.5, 38.5.5, 39.4.2 y 40.1.1, en “FilterEngine.create_postgres_query()”. Esto permite a cualquier usuario autenticado de Rucio ejecutar SQL arbitrario contra la base de datos de metadatos de PostgreSQL a través del endpoint de búsqueda de DID (“GET /dids/[scope]/dids/search”). Cuando el plugin de metadatos “postgres_meta” está configurado, las claves y valores de filtro controlados por el atacante se interpolan directamente en cadenas SQL sin procesar a través de Python “.format()”, luego se pasan a “sql.SQL()” de “psycopg3” que trata la cadena como sintaxis SQL de confianza.\n\nDependiendo de los privilegios de la base de datos asignados a la cuenta de servicio, la explotación puede exponer tablas sensibles, modificar o eliminar metadatos, acceder a archivos del servidor o lograr la ejecución de código a través de características de PostgreSQL como COPY ... FROM PROGRAM. Este problema afecta a las implementaciones que utilizan explícitamente el plugin de metadatos postgres_meta. Esta vulnerabilidad ha sido corregida en las versiones 35.8.5, 38.5.5, 39.4.2 y 40.1.1."}],"id":"CVE-2026-29090","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":9.0,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-29090","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-06T18:17:46.352636Z","version":"2.0.3"}}]},"published":"2026-05-06T18:16:02.953","references":[{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/rucio/rucio/security/advisories/GHSA-6j7p-qjhg-9947"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-29199.json b/data/2026/CVE-2026-29199.json index 6f9b562643..7878ab4f56 100644 --- a/data/2026/CVE-2026-29199.json +++ b/data/2026/CVE-2026-29199.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"phpBB","vendor":"phpBB","versions":[{"lessThanOrEqual":"3.3.15","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:phpbb:phpbb:*:*:*:*:*:*:*:*","matchCriteriaId":"A6D3A01D-45B6-40BF-9579-7DF628679846","versionEndExcluding":"3.3.16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Host header (e.g. through misconfigured host setup or missing header validation by the webserver) can cause password reset emails to contain a link pointing to an attacker-controlled domain, potentially leading to account takeover."}],"id":"CVE-2026-29199","lastModified":"2026-06-17T10:29:46.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-29199","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-04T19:42:51.610948Z","version":"2.0.3"}}]},"published":"2026-05-04T07:15:59.960","references":[{"source":"support@hackerone.com","tags":["Permissions Required"],"url":"https://hackerone.com/reports/3543246"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"support@hackerone.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"phpBB","vendor":"phpBB","versions":[{"lessThanOrEqual":"3.3.15","status":"affected","version":"3.0.0","versionType":"semver"}]}],"source":"support@hackerone.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:phpbb:phpbb:*:*:*:*:*:*:*:*","matchCriteriaId":"A6D3A01D-45B6-40BF-9579-7DF628679846","versionEndExcluding":"3.3.16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Host header (e.g. through misconfigured host setup or missing header validation by the webserver) can cause password reset emails to contain a link pointing to an attacker-controlled domain, potentially leading to account takeover."},{"lang":"es","value":"phpBB anterior a 3.3.16 es vulnerable a la Inyección de Encabezado Host que puede llevar al envenenamiento de enlaces de restablecimiento de contraseña. Cuando force_server_vars está deshabilitado, el nombre de host del servidor puede ser extraído del encabezado HTTP Host, el cual se utiliza para generar la URL del enlace de restablecimiento de contraseña. Un atacante que puede manipular el encabezado Host (por ejemplo, a través de una configuración de host mal configurada o una validación de encabezado faltante por parte del servidor web) puede hacer que los correos electrónicos de restablecimiento de contraseña contengan un enlace que apunte a un dominio controlado por el atacante, lo que podría llevar a la toma de control de la cuenta."}],"id":"CVE-2026-29199","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-29199","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-04T19:42:51.610948Z","version":"2.0.3"}}]},"published":"2026-05-04T07:15:59.960","references":[{"source":"support@hackerone.com","tags":["Permissions Required"],"url":"https://hackerone.com/reports/3543246"}],"sourceIdentifier":"support@hackerone.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-640"}],"source":"support@hackerone.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-30266.json b/data/2026/CVE-2026-30266.json index c9057dbbda..b3c92669f5 100644 --- a/data/2026/CVE-2026-30266.json +++ b/data/2026/CVE-2026-30266.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:deepcool:deepcreative:*:*:*:*:*:*:*:*","matchCriteriaId":"885B582B-F47D-4A5D-96A7-9E4F94FA4AA3","versionEndExcluding":"1.2.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted file"}],"id":"CVE-2026-30266","lastModified":"2026-07-05T17:17:28.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-20T17:25:33.172119Z","version":"2.0.3"}}]},"published":"2026-04-20T17:16:33.377","references":[{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://github.com/uncle-hash/vulnerability-research/tree/main/CVE-2026-30266"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-277"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:deepcool:deepcreative:*:*:*:*:*:*:*:*","matchCriteriaId":"885B582B-F47D-4A5D-96A7-9E4F94FA4AA3","versionEndExcluding":"1.2.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbitrary code via a crafted file"},{"lang":"es","value":"Vulnerabilidad de permisos inseguros en DeepCool DeepCreative v.1.2.12 y anteriores permite a un atacante local ejecutar código arbitrario mediante un archivo manipulado."}],"id":"CVE-2026-30266","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30266","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-20T17:25:33.172119Z","version":"2.0.3"}}]},"published":"2026-04-20T17:16:33.377","references":[{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://github.com/uncle-hash/vulnerability-research/tree/main/CVE-2026-30266"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-277"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-30269.json b/data/2026/CVE-2026-30269.json index fa356df3a6..4834d67abf 100644 --- a/data/2026/CVE-2026-30269.json +++ b/data/2026/CVE-2026-30269.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:doorman:doorman:0.1.0:*:*:*:*:*:*:*","matchCriteriaId":"FEA94C59-0D12-4638-B640-7A65AD04586A","vulnerable":true},{"criteria":"cpe:2.3:a:doorman:doorman:1.0.2:*:*:*:*:*:*:*","matchCriteriaId":"C0C616A1-0504-4D08-A376-9BB21E2AE88A","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a non-admin privileged role via /platform/user/{username}. The `role` field is accepted by the update model without a manage_users permission check for self-updates, enabling privilege escalation to high-privileged roles."}],"id":"CVE-2026-30269","lastModified":"2026-06-17T10:32:34.063","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30269","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-20T18:22:55.563315Z","version":"2.0.3"}}]},"published":"2026-04-20T17:16:33.483","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://blog.orxiain.life/archives/cve-2026-30269---improper-access-control-in-doorman-allows-privilege-escalation"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/apidoorman/doorman"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:doorman:doorman:0.1.0:*:*:*:*:*:*:*","matchCriteriaId":"FEA94C59-0D12-4638-B640-7A65AD04586A","vulnerable":true},{"criteria":"cpe:2.3:a:doorman:doorman:1.0.2:*:*:*:*:*:*:*","matchCriteriaId":"C0C616A1-0504-4D08-A376-9BB21E2AE88A","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a non-admin privileged role via /platform/user/{username}. The `role` field is accepted by the update model without a manage_users permission check for self-updates, enabling privilege escalation to high-privileged roles."},{"lang":"es","value":"Control de acceso inadecuado en Doorman v0.1.0 y v1.0.2 permite a cualquier usuario autenticado actualizar el rol de su propia cuenta a un rol privilegiado no administrativo a través de /platform/user/{username}. El campo ’role’ es aceptado por el modelo de actualización sin una verificación de permiso de manage_users para autoactualizaciones, lo que permite la escalada de privilegios a roles de alto privilegio."}],"id":"CVE-2026-30269","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30269","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-20T18:22:55.563315Z","version":"2.0.3"}}]},"published":"2026-04-20T17:16:33.483","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://blog.orxiain.life/archives/cve-2026-30269---improper-access-control-in-doorman-allows-privilege-escalation"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/apidoorman/doorman"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-30273.json b/data/2026/CVE-2026-30273.json index 89d9887b23..3920e88f14 100644 --- a/data/2026/CVE-2026-30273.json +++ b/data/2026/CVE-2026-30273.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gabrieleventuri:pandasai:*:*:*:*:*:python:*:*","matchCriteriaId":"825B4264-493C-4247-AA15-AD830C6F6EFE","versionEndIncluding":"3.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"pandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent.base._execute_sql_query component."}],"id":"CVE-2026-30273","lastModified":"2026-06-17T10:32:34.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30273","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-01T18:18:48.301661Z","version":"2.0.3"}}]},"published":"2026-04-01T17:28:38.733","references":[{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://gist.github.com/CafeD1/21c32edbf1b63fd88a79c290ed2a8059"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/sinaptik-ai/pandas-ai"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gabrieleventuri:pandasai:*:*:*:*:*:python:*:*","matchCriteriaId":"825B4264-493C-4247-AA15-AD830C6F6EFE","versionEndIncluding":"3.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"pandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent.base._execute_sql_query component."},{"lang":"es","value":"pandas-ai v3.0.0 se descubrió que contenía una vulnerabilidad de inyección SQL a través del componente pandasai.agent.base._execute_sql_query."}],"id":"CVE-2026-30273","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30273","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-01T18:18:48.301661Z","version":"2.0.3"}}]},"published":"2026-04-01T17:28:38.733","references":[{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://gist.github.com/CafeD1/21c32edbf1b63fd88a79c290ed2a8059"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/sinaptik-ai/pandas-ai"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-30452.json b/data/2026/CVE-2026-30452.json index 5913477a4b..d7325ad65b 100644 --- a/data/2026/CVE-2026-30452.json +++ b/data/2026/CVE-2026-30452.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:textpattern:textpattern:4.9.0:-:*:*:*:*:*:*","matchCriteriaId":"E401C6DA-6708-4F7E-B6F6-54718AF3A18E","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher privileges. By manipulating the article ID parameter during the duplicate-and-save workflow in textpattern/include/txp_article.php, an attacker can bypass authorization checks and overwrite content belonging to other users."}],"id":"CVE-2026-30452","lastModified":"2026-06-17T10:32:40.970","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30452","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T13:56:20.608956Z","version":"2.0.3"}}]},"published":"2026-04-21T17:16:36.303","references":[{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/textpattern/textpattern"},{"source":"cve@mitre.org","tags":["Release Notes"],"url":"https://textpattern.com/weblog/textpattern-491-released-security-fixes-patches-and-tweaks"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:textpattern:textpattern:4.9.0:-:*:*:*:*:*:*","matchCriteriaId":"E401C6DA-6708-4F7E-B6F6-54718AF3A18E","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher privileges. By manipulating the article ID parameter during the duplicate-and-save workflow in textpattern/include/txp_article.php, an attacker can bypass authorization checks and overwrite content belonging to other users."},{"lang":"es","value":"Textpattern CMS 4.9.0 contiene una vulnerabilidad de control de acceso roto en el sistema de gestión de artículos que permite a usuarios autenticados con privilegios bajos modificar artículos propiedad de usuarios con privilegios más altos. Al manipular el parámetro de ID de artículo durante el flujo de trabajo de duplicar y guardar en textpattern/include/txp_article.php, un atacante puede eludir las comprobaciones de autorización y sobrescribir contenido perteneciente a otros usuarios."}],"id":"CVE-2026-30452","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30452","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T13:56:20.608956Z","version":"2.0.3"}}]},"published":"2026-04-21T17:16:36.303","references":[{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/textpattern/textpattern"},{"source":"cve@mitre.org","tags":["Release Notes"],"url":"https://textpattern.com/weblog/textpattern-491-released-security-fixes-patches-and-tweaks"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-30461.json b/data/2026/CVE-2026-30461.json index c5ad5553fd..3fb75d5055 100644 --- a/data/2026/CVE-2026-30461.json +++ b/data/2026/CVE-2026-30461.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:thedaylightstudio:fuel_cms:1.5.2:*:*:*:*:*:*:*","matchCriteriaId":"E3A44312-83D2-4421-9A35-3FD048EA578A","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule."}],"id":"CVE-2026-30461","lastModified":"2026-07-05T17:17:29.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30461","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-16T14:01:28.990290Z","version":"2.0.3"}}]},"published":"2026-04-15T16:16:36.050","references":[{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/daylightstudio/FUEL-CMS/blob/master/fuel/modules/fuel/controllers/Installer.php"},{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://pentest-tools.com/PTT-2025-028-Authenticated-RCE-via-Git-Submodules.pdf"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:thedaylightstudio:fuel_cms:1.5.2:*:*:*:*:*:*:*","matchCriteriaId":"E3A44312-83D2-4421-9A35-3FD048EA578A","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submodule."},{"lang":"es","value":"Daylight Studio FuelCMS v1.5.2 se descubrió que contenía una vulnerabilidad de ejecución remota de código (RCE) autenticada a través de /controllers/Installer.php y la función add_git_submodule."}],"id":"CVE-2026-30461","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30461","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-16T14:01:28.990290Z","version":"2.0.3"}}]},"published":"2026-04-15T16:16:36.050","references":[{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/daylightstudio/FUEL-CMS/blob/master/fuel/modules/fuel/controllers/Installer.php"},{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://pentest-tools.com/PTT-2025-028-Authenticated-RCE-via-Git-Submodules.pdf"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-30530.json b/data/2026/CVE-2026-30530.json index 99a65f89e8..d9e0f450cb 100644 --- a/data/2026/CVE-2026-30530.json +++ b/data/2026/CVE-2026-30530.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:oretnom23:online_food_ordering_system:1.0:*:*:*:*:*:*:*","matchCriteriaId":"0FAA9C4A-10ED-4AA4-8295-F4324DD2F879","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_customer action). The application fails to properly sanitize user input supplied to the \"username\" parameter. This allows an attacker to inject malicious SQL commands."}],"id":"CVE-2026-30530","lastModified":"2026-06-17T10:32:45.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30530","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-27T19:56:24.255286Z","version":"2.0.3"}}]},"published":"2026-03-27T16:16:23.567","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/SQLi-Actions-saveCustomer-username.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:oretnom23:online_food_ordering_system:1.0:*:*:*:*:*:*:*","matchCriteriaId":"0FAA9C4A-10ED-4AA4-8295-F4324DD2F879","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_customer action). The application fails to properly sanitize user input supplied to the \"username\" parameter. This allows an attacker to inject malicious SQL commands."},{"lang":"es","value":"Existe una vulnerabilidad de inyección SQL en SourceCodester Online Food Ordering System v1.0 en el archivo Actions.php (específicamente en la acción ’save_customer’). La aplicación no sanea adecuadamente la entrada de usuario proporcionada al parámetro ’username’. Esto permite a un atacante inyectar comandos SQL maliciosos."}],"id":"CVE-2026-30530","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-30530","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-27T19:56:24.255286Z","version":"2.0.3"}}]},"published":"2026-03-27T16:16:23.567","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/meifukun/Web-Security-PoCs/blob/main/Online-Food-Ordering-System/SQLi-Actions-saveCustomer-username.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31018.json b/data/2026/CVE-2026-31018.json index 3745ccd79f..771655664c 100644 --- a/data/2026/CVE-2026-31018.json +++ b/data/2026/CVE-2026-31018.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dolibarr:dolibarr_erp\\/crm:*:*:*:*:*:*:*:*","matchCriteriaId":"3BAE3269-374D-425C-B943-C4DA4494F7BF","versionEndIncluding":"22.0.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation."}],"id":"CVE-2026-31018","lastModified":"2026-07-05T02:17:45.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31018","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-21T15:30:39.381217Z","version":"2.0.3"}}]},"published":"2026-04-21T15:16:36.443","references":[{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31018/README.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dolibarr:dolibarr_erp\\/crm:*:*:*:*:*:*:*:*","matchCriteriaId":"3BAE3269-374D-425C-B943-C4DA4494F7BF","versionEndIncluding":"22.0.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation."},{"lang":"es","value":"En Dolibarr ERP y CRM menor o igual que 22.0.4, la detección de código PHP y la aplicación de permisos de edición en el módulo de Sitio Web no se aplica de manera consistente a todos los parámetros de entrada, permitiendo a un usuario autenticado restringido a la edición de HTML/JavaScript inyectar código PHP a través de entradas no protegidas durante la creación de páginas del sitio web."}],"id":"CVE-2026-31018","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31018","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-21T15:30:39.381217Z","version":"2.0.3"}}]},"published":"2026-04-21T15:16:36.443","references":[{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31018/README.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31019.json b/data/2026/CVE-2026-31019.json index 436596ba1d..7e31509a54 100644 --- a/data/2026/CVE-2026-31019.json +++ b/data/2026/CVE-2026-31019.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dolibarr:dolibarr_erp\\/crm:*:*:*:*:*:*:*:*","matchCriteriaId":"3BAE3269-374D-425C-B943-C4DA4494F7BF","versionEndIncluding":"22.0.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the ability to execute arbitrary operating system commands on the server."}],"id":"CVE-2026-31019","lastModified":"2026-07-05T02:17:45.357","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31019","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-21T18:23:29.127208Z","version":"2.0.3"}}]},"published":"2026-04-21T15:16:36.560","references":[{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31019/README.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:dolibarr:dolibarr_erp\\/crm:*:*:*:*:*:*:*:*","matchCriteriaId":"3BAE3269-374D-425C-B943-C4DA4494F7BF","versionEndIncluding":"22.0.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the ability to execute arbitrary operating system commands on the server."},{"lang":"es","value":"En el módulo de Sitio Web de Dolibarr ERP & CRM 22.0.4 y versiones anteriores, la aplicación utiliza un filtrado basado en lista negra para restringir funciones PHP peligrosas relacionadas con la ejecución de comandos del sistema. Un usuario autenticado con permiso para editar contenido PHP puede eludir este filtrado, lo que resulta en una ejecución remota de código completa con la capacidad de ejecutar comandos arbitrarios del sistema operativo en el servidor."}],"id":"CVE-2026-31019","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31019","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-21T18:23:29.127208Z","version":"2.0.3"}}]},"published":"2026-04-21T15:16:36.560","references":[{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31019/README.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31159.json b/data/2026/CVE-2026-31159.json index 1b97a43d46..be48e1f1a9 100644 --- a/data/2026/CVE-2026-31159.json +++ b/data/2026/CVE-2026-31159.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*","matchCriteriaId":"DD39B647-3419-4C6D-A6A2-30F40822A27D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*","matchCriteriaId":"7F723A73-4B32-4F9E-B5DA-80134D4711C1","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the password parameter to /cgi-bin/cstecgi.cgi."}],"id":"CVE-2026-31159","lastModified":"2026-06-17T10:33:22.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31159","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-23T17:46:51.568094Z","version":"2.0.3"}}]},"published":"2026-04-23T18:16:24.013","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-password-cmd-injection"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-password-cmd-injection"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*","matchCriteriaId":"DD39B647-3419-4C6D-A6A2-30F40822A27D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*","matchCriteriaId":"7F723A73-4B32-4F9E-B5DA-80134D4711C1","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the password parameter to /cgi-bin/cstecgi.cgi."},{"lang":"es","value":"Se descubrió un problema en el firmware ToToLink A3300R v17.0.0cu.557_B20221024 que permite a los atacantes ejecutar comandos arbitrarios a través del parámetro password a /cgi-bin/cstecgi.cgi."}],"id":"CVE-2026-31159","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31159","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-23T17:46:51.568094Z","version":"2.0.3"}}]},"published":"2026-04-23T18:16:24.013","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-password-cmd-injection"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-password-cmd-injection"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31164.json b/data/2026/CVE-2026-31164.json index ba0cb6d112..910274e3f8 100644 --- a/data/2026/CVE-2026-31164.json +++ b/data/2026/CVE-2026-31164.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*","matchCriteriaId":"DD39B647-3419-4C6D-A6A2-30F40822A27D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*","matchCriteriaId":"7F723A73-4B32-4F9E-B5DA-80134D4711C1","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to /cgi-bin/cstecgi.cgi."}],"id":"CVE-2026-31164","lastModified":"2026-06-17T10:33:23.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31164","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-23T18:33:47.359102Z","version":"2.0.3"}}]},"published":"2026-04-23T18:16:24.310","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-pppoe-mtu-cmd-injection"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-pppoe-mtu-cmd-injection"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*","matchCriteriaId":"DD39B647-3419-4C6D-A6A2-30F40822A27D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*","matchCriteriaId":"7F723A73-4B32-4F9E-B5DA-80134D4711C1","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to /cgi-bin/cstecgi.cgi."},{"lang":"es","value":"Se descubrió un problema en el firmware ToToLink A3300R v17.0.0cu.557_B20221024 que permite a los atacantes ejecutar comandos arbitrarios a través del parámetro pppoeMtu a /cgi-bin/cstecgi.cgi."}],"id":"CVE-2026-31164","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31164","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-23T18:33:47.359102Z","version":"2.0.3"}}]},"published":"2026-04-23T18:16:24.310","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-pppoe-mtu-cmd-injection"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-pppoe-mtu-cmd-injection"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31168.json b/data/2026/CVE-2026-31168.json index c2ef1645b6..dd0be834c4 100644 --- a/data/2026/CVE-2026-31168.json +++ b/data/2026/CVE-2026-31168.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*","matchCriteriaId":"DD39B647-3419-4C6D-A6A2-30F40822A27D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*","matchCriteriaId":"7F723A73-4B32-4F9E-B5DA-80134D4711C1","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the recHour parameter to /cgi-bin/cstecgi.cgi."}],"id":"CVE-2026-31168","lastModified":"2026-06-17T10:33:23.687","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31168","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-23T18:56:20.071035Z","version":"2.0.3"}}]},"published":"2026-04-23T19:17:24.987","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-rechour-cmd-injection"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-rechour-cmd-injection"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*","matchCriteriaId":"DD39B647-3419-4C6D-A6A2-30F40822A27D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*","matchCriteriaId":"7F723A73-4B32-4F9E-B5DA-80134D4711C1","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the recHour parameter to /cgi-bin/cstecgi.cgi."},{"lang":"es","value":"Se descubrió una vulnerabilidad en el firmware ToToLink A3300R v17.0.0cu.557_B20221024 que permite a los atacantes ejecutar comandos arbitrarios a través del parámetro recHour a /cgi-bin/cstecgi.cgi."}],"id":"CVE-2026-31168","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31168","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-23T18:56:20.071035Z","version":"2.0.3"}}]},"published":"2026-04-23T19:17:24.987","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-rechour-cmd-injection"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-rechour-cmd-injection"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31169.json b/data/2026/CVE-2026-31169.json index d40246cb5f..e3a40f886d 100644 --- a/data/2026/CVE-2026-31169.json +++ b/data/2026/CVE-2026-31169.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*","matchCriteriaId":"DD39B647-3419-4C6D-A6A2-30F40822A27D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*","matchCriteriaId":"7F723A73-4B32-4F9E-B5DA-80134D4711C1","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the week parameter to /cgi-bin/cstecgi.cgi."}],"id":"CVE-2026-31169","lastModified":"2026-06-17T10:33:23.837","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31169","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-23T18:55:14.411414Z","version":"2.0.3"}}]},"published":"2026-04-23T19:17:25.143","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-week-cmd-injection"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-week-cmd-injection"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024:*:*:*:*:*:*:*","matchCriteriaId":"DD39B647-3419-4C6D-A6A2-30F40822A27D","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:totolink:a3300r:-:*:*:*:*:*:*:*","matchCriteriaId":"7F723A73-4B32-4F9E-B5DA-80134D4711C1","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the week parameter to /cgi-bin/cstecgi.cgi."},{"lang":"es","value":"Se descubrió un problema en el firmware v17.0.0cu.557_B20221024 de ToToLink A3300R que permite a los atacantes ejecutar comandos arbitrarios a través del parámetro week a /cgi-bin/cstecgi.cgi."}],"id":"CVE-2026-31169","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31169","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-23T18:55:14.411414Z","version":"2.0.3"}}]},"published":"2026-04-23T19:17:25.143","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-week-cmd-injection"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Svigo-o/TOTOLINK-Vul/tree/main/totolink-a3300r-week-cmd-injection"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31192.json b/data/2026/CVE-2026-31192.json index b1946ca6be..aa59ff84bd 100644 --- a/data/2026/CVE-2026-31192.json +++ b/data/2026/CVE-2026-31192.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:raindrop:raindrop:5.6.76.0:*:*:*:*:chrome:*:*","matchCriteriaId":"C204428A-503A-4549-A55F-C5CF406FEA00","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitive user data via a crafted request."}],"id":"CVE-2026-31192","lastModified":"2026-06-17T10:33:25.687","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31192","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T18:20:17.373427Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:36.420","references":[{"source":"cve@mitre.org","tags":["Technical Description"],"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS"},{"source":"cve@mitre.org","tags":["Technical Description"],"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Origin"},{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://github.com/incoggeek/vulnerability-research/tree/master/CVE-2026-31192"},{"source":"cve@mitre.org","tags":["Not Applicable"],"url":"https://support.google.com/chrome_webstore/answer/2664769?hl=en"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:raindrop:raindrop:5.6.76.0:*:*:*:*:chrome:*:*","matchCriteriaId":"C204428A-503A-4549-A55F-C5CF406FEA00","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient validation of Chrome extension identifiers in Raindrop.io Bookmark Manager Web App 5.6.76.0 allows attackers to obtain sensitive user data via a crafted request."},{"lang":"es","value":"Validación insuficiente de identificadores de extensión de Chrome en la aplicación web Raindrop.io Bookmark Manager 5.6.76.0 permite a los atacantes obtener datos sensibles de usuario a través de una solicitud elaborada."}],"id":"CVE-2026-31192","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31192","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T18:20:17.373427Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:36.420","references":[{"source":"cve@mitre.org","tags":["Technical Description"],"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS"},{"source":"cve@mitre.org","tags":["Technical Description"],"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Origin"},{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://github.com/incoggeek/vulnerability-research/tree/master/CVE-2026-31192"},{"source":"cve@mitre.org","tags":["Not Applicable"],"url":"https://support.google.com/chrome_webstore/answer/2664769?hl=en"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31417.json b/data/2026/CVE-2026-31417.json index ab48ea25ab..2c1d2bad0f 100644 --- a/data/2026/CVE-2026-31417.json +++ b/data/2026/CVE-2026-31417.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/x25/x25_in.c","net/x25/x25_subr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"96fc16370b0bceb289c7e0479bd0540b81e257aa","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"798d613afb64b01a203f448fb0f43c37c6afe79d","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6e568835ea54a3e1d08e310e34f95d434e739477","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"1734bd85c5e0a7a801295b729efb56b009cb8fc3","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"4e2d1bcef78d21247fe8fef13bc7ed95885df2b5","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"8c92969c197b91c134be27dc3afb64ab468853a9","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"f953f11ccf4afe6feb635c08145f4240d9a6b544","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"a1822cb524e89b4cd2cf0b82e484a2335496a6d9","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/x25/x25_in.c","net/x25/x25_subr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5F0E43E1-33E5-4828-9B4A-F710AF2E7217","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc6:*:*:*:*:*:*","matchCriteriaId":"8CFD5CDD-1709-44C7-82BD-BAFDC46990D6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/x25: Fix overflow when accumulating packets\n\nAdd a check to ensure that `x25_sock.fraglen` does not overflow.\n\nThe `fraglen` also needs to be resetted when purging `fragment_queue` in\n`x25_clear_queues()`."}],"id":"CVE-2026-31417","lastModified":"2026-11-10T13:18:52.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-13T14:16:11.097","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1734bd85c5e0a7a801295b729efb56b009cb8fc3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e2d1bcef78d21247fe8fef13bc7ed95885df2b5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e568835ea54a3e1d08e310e34f95d434e739477"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/798d613afb64b01a203f448fb0f43c37c6afe79d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8c92969c197b91c134be27dc3afb64ab468853a9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/96fc16370b0bceb289c7e0479bd0540b81e257aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a1822cb524e89b4cd2cf0b82e484a2335496a6d9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f953f11ccf4afe6feb635c08145f4240d9a6b544"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/x25/x25_in.c","net/x25/x25_subr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"96fc16370b0bceb289c7e0479bd0540b81e257aa","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"798d613afb64b01a203f448fb0f43c37c6afe79d","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6e568835ea54a3e1d08e310e34f95d434e739477","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"1734bd85c5e0a7a801295b729efb56b009cb8fc3","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"4e2d1bcef78d21247fe8fef13bc7ed95885df2b5","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"8c92969c197b91c134be27dc3afb64ab468853a9","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"f953f11ccf4afe6feb635c08145f4240d9a6b544","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"a1822cb524e89b4cd2cf0b82e484a2335496a6d9","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/x25/x25_in.c","net/x25/x25_subr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5F0E43E1-33E5-4828-9B4A-F710AF2E7217","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc6:*:*:*:*:*:*","matchCriteriaId":"8CFD5CDD-1709-44C7-82BD-BAFDC46990D6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/x25: Fix overflow when accumulating packets\n\nAdd a check to ensure that `x25_sock.fraglen` does not overflow.\n\nThe `fraglen` also needs to be resetted when purging `fragment_queue` in\n`x25_clear_queues()`."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/x25: Corregir desbordamiento al acumular paquetes\n\nAñadir una comprobación para asegurar que ’x25_sock.fraglen’ no se desborde.\n\nEl ’fraglen’ también necesita ser reiniciado al purgar ’fragment_queue’ en ’x25_clear_queues()’."}],"id":"CVE-2026-31417","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-13T14:16:11.097","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1734bd85c5e0a7a801295b729efb56b009cb8fc3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e2d1bcef78d21247fe8fef13bc7ed95885df2b5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e568835ea54a3e1d08e310e34f95d434e739477"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/798d613afb64b01a203f448fb0f43c37c6afe79d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8c92969c197b91c134be27dc3afb64ab468853a9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/96fc16370b0bceb289c7e0479bd0540b81e257aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a1822cb524e89b4cd2cf0b82e484a2335496a6d9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f953f11ccf4afe6feb635c08145f4240d9a6b544"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31431.json b/data/2026/CVE-2026-31431.json index 88366cd6d7..b0e1a49210 100644 --- a/data/2026/CVE-2026-31431.json +++ b/data/2026/CVE-2026-31431.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/af_alg.c","crypto/algif_aead.c","crypto/algif_skcipher.c","include/crypto/if_alg.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"893d22e0135fa394db81df88697fba6032747667","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"19d43105a97be0810edbda875f2cd03f30dc130c","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"961cfa271a918ad4ae452420e7c303149002875b","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"3115af9644c342b356f3f07a4dd1c8905cd9a6fc","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"8b88d99341f139e23bdeb1027a2a3ae10d341d82","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"ce42ee423e58dffa5ec03524054c9d8bfd4f6237","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/af_alg.c","crypto/algif_aead.c","crypto/algif_skcipher.c","include/crypto/if_alg.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.254","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.204","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.170","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.137","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.85","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_nvidia:10::el10"],"defaultStatus":"affected","packageName":"kernel","product":"NVIDIA for RHEL 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.6.el10nv","versionType":"rpm"},{"lessThan":"*","status":"unaffected","version":"0:6.12.0-231.12.el10nv","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.1","cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-124.55.1.el10_1","versionType":"rpm"},{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.7.3.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.71.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.123.1.rt7.464.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.123.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-305.190.1.el8_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus_long_life:8.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-305.190.1.el8_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.191.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_tus:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.191.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.191.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.6"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_tus:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.139.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.139.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-611.54.1.el9_7","versionType":"rpm"},{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.5.3.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-70.178.1.el9_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-70.178.1.rt21.250.el9_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.0"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.169.1.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.169.1.rt14.454.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-427.124.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.4"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.112.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.6"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.12::el8"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"412.86.202605060316-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"413.92.202605051442-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"414.92.202605060243-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"415.92.202605060220-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"416.94.202605042300-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"417.94.202605050021-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"418.94.202605042017-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.19.9.6.202605042214-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.20.9.6.202605051409-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.21.9.6.202605051105-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC AX Runtime Core Linux Common Debian","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC AX Runtime Core Linux Common Debian arm64","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC AX Runtime Core Linux Platform Container Common Debian Development","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC AX Runtime Core Linux VMWare Development","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC CN 4100","vendor":"Siemens","versions":[{"lessThan":"V6.0","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1000 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1000 Unified Comfort Panel","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1000 Unified Comfort Panel hygienic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1000, Unified Comfort Panel neutral","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Unified Comfort Panel","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Unified Comfort Panel hygienic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Unified Comfort Panel neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Unified Comfort Panel","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Unified Comfort Panel hygienic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Unified Comfort Panel neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Unified Comfort Panel","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Unified Comfort Panel hygienic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Unified Comfort Panel neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Unified Comfort Hygienic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Unified Comfort Panel","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Unified Comfort Panel neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP400 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP700 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP700 Unified Comfort Panel","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP700, Unified Comfort Panel neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 Advanced","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IPC Industrial Edge Device OS (IED-OS)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.7","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.7","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.7","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.7","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP1000 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP1000 Unified Comfort","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP1200 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP1200 Unified Comfort","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP400 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP700 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 SP2 Update 1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP700 Unified Comfort","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.7","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"cisaActionDue":"2026-05-15","cisaExploitAdd":"2026-05-01","cisaRequiredAction":"\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cisaVulnerabilityName":"Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability","configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"24B62F9A-357D-465D-97EB-2819B1CD663C","versionEndExcluding":"5.10.254","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FA800016-0012-4E3F-A528-2A7F378A0A4A","versionEndExcluding":"5.15.204","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E6653854-B188-42DD-B8C5-0143F1956AB1","versionEndExcluding":"6.1.170","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3CA3EF52-168A-4348-8F5F-356C9EB69261","versionEndExcluding":"6.6.137","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F17D292D-A9B5-4DC7-8002-51AB95335606","versionEndExcluding":"6.12.85","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"E6FEF674-586D-4F75-B07C-407044DF151F","versionEndExcluding":"4.12.89","versionStartIncluding":"4.12","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"B31A414A-0545-4634-A6FB-511541C5E097","versionEndExcluding":"4.13.66","versionStartIncluding":"4.13","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"77C210A8-89BB-461A-8381-35A12D5B5116","versionEndExcluding":"4.14.65","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"99513472-1475-4D94-AFE4-9E4DF239B100","versionEndExcluding":"4.15.64","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"1AE50081-D222-4A00-965B-B628AB6394FF","versionEndExcluding":"4.16.61","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"96236E42-2DF9-47AC-8438-16929A863CF0","versionEndExcluding":"4.17.53","versionStartIncluding":"4.17","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"4CEDEF22-43C5-4572-A29A-89FDC67384A9","versionEndExcluding":"4.18.40","versionStartIncluding":"4.18","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"665A1C48-2209-448C-945A-37337A884C11","versionEndExcluding":"4.19.30","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"4B3BE91E-E136-4102-84BA-88FD88749F8B","versionEndExcluding":"4.20.21","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"58643369-41D9-46AB-BC74-B3025B44B143","versionEndExcluding":"4.21.14","versionStartIncluding":"4.21","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*","matchCriteriaId":"932D137F-528B-4526-9A89-CD59FA1AB0FE","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"7F6FB57C-2BC7-487C-96DD-132683AEB35D","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*","matchCriteriaId":"4D5F4FA7-E5C5-4C23-BDA8-36A36972E4F4","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*","matchCriteriaId":"5CA4F12A-5BC5-4D75-8F20-80D8BB2C5BF2","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*","matchCriteriaId":"0E3F09B5-569F-4C58-9FCA-3C0953D107B5","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*","matchCriteriaId":"B03506D7-0FCD-47B7-90F6-DDEEB5C5A733","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*","matchCriteriaId":"C4CF8D2F-DACA-49C2-A9F4-63496B0A9A80","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*","matchCriteriaId":"34990D09-125F-48CA-B85E-9D9F0EB4BC07","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*","matchCriteriaId":"C237415F-33FE-4686-9B19-A0916BF75D2D","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*","matchCriteriaId":"22D28543-C7C5-46B0-B909-20435AF7A501","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*","matchCriteriaId":"FB096D5D-E8F6-4164-8B76-0217B7151D30","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*","matchCriteriaId":"01ED4F33-EBE7-4C04-8312-3DA580EFFB68","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*","matchCriteriaId":"083AAC55-E87B-482A-A1F4-8F2DEB90CB23","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*","matchCriteriaId":"1FD9BF0E-7ACF-4A83-B754-6E3979ED903F","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:amazon:amazon_linux:-:*:*:*:*:*:*:*","matchCriteriaId":"C8699C74-BF90-4CF8-9285-32576DB1FE2B","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:-:*:*:*:*:*:*:*","matchCriteriaId":"019A2188-0877-45DE-8512-F0BF70DD179C","vulnerable":true},{"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED","vulnerable":true},{"criteria":"cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*","matchCriteriaId":"46D69DCC-AE4D-4EA5-861C-D60951444C6C","vulnerable":true},{"criteria":"cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*","matchCriteriaId":"204FC6CC-9DAC-45FB-8A9F-C9C8EDD29D54","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:opensuse:leap:15.3:*:*:*:*:*:*:*","matchCriteriaId":"090F0D1A-6BF8-4810-8942-3FFE4FBF7FE0","vulnerable":true},{"criteria":"cpe:2.3:o:opensuse:leap:15.4:*:*:*:*:*:*:*","matchCriteriaId":"BE80EB04-7F9D-4C0B-85DB-4A13DEACB5E4","vulnerable":true},{"criteria":"cpe:2.3:o:opensuse:leap:15.5:*:*:*:*:*:*:*","matchCriteriaId":"E79D3E16-E284-40C6-916E-2EE78102BF4A","vulnerable":true},{"criteria":"cpe:2.3:o:opensuse:leap:15.6:*:*:*:*:*:*:*","matchCriteriaId":"78B4F1C7-A301-4C94-A41C-A51182B83677","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:suse:caas_platform:4.0:*:*:*:*:*:*:*","matchCriteriaId":"5AB27A2D-549C-450E-A09E-B3316895F052","vulnerable":true},{"criteria":"cpe:2.3:a:suse:enterprise_storage:6.0:*:*:*:*:*:*:*","matchCriteriaId":"3B20D44D-F87E-4692-8E04-695683F1ECE6","vulnerable":true},{"criteria":"cpe:2.3:a:suse:enterprise_storage:7.0:*:*:*:*:*:*:*","matchCriteriaId":"F7305944-AC9C-47A3-AADF-71A8B24830D1","vulnerable":true},{"criteria":"cpe:2.3:a:suse:enterprise_storage:7.1:*:*:*:*:*:*:*","matchCriteriaId":"D9A626D2-FF84-40BB-B5A2-053D64992FE5","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_proxy:4.0:*:*:*:*:*:*:*","matchCriteriaId":"71A42960-17FA-4F96-8CF4-BADAB702EBA4","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_proxy:4.1:*:*:*:*:*:*:*","matchCriteriaId":"9910C73A-3BCD-4F56-8C7D-79CB289640A2","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_proxy:4.2:*:*:*:*:*:*:*","matchCriteriaId":"B0156BFA-9E83-43E6-9C73-9711AD054B5A","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_proxy:4.3:*:*:*:*:*:*:*","matchCriteriaId":"CAC2D0A4-56F8-4ED6-91E2-78434A016C5F","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_retail_branch_server:4.0:*:*:*:*:*:*:*","matchCriteriaId":"A4F81939-C109-4643-951E-42F8F20F4672","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_retail_branch_server:4.1:*:*:*:*:*:*:*","matchCriteriaId":"450A3B3F-F26D-4EAB-BF5D-4C906C4A99DD","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_retail_branch_server:4.2:*:*:*:*:*:*:*","matchCriteriaId":"BD5BDD59-5008-4DDC-B805-BB6B7DE8E1A6","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_retail_branch_server:4.3:*:*:*:*:*:*:*","matchCriteriaId":"A69D3CCD-6590-46EF-9D3F-E903AB78E3BA","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_server:4.0:*:*:*:*:*:*:*","matchCriteriaId":"51136B38-5715-49B3-BD8D-91F90632247D","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_server:4.1:*:*:*:*:*:*:*","matchCriteriaId":"B5810E98-7BF5-42E2-9DE9-661049ABE367","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_server:4.2:*:*:*:*:*:*:*","matchCriteriaId":"0E46DEFD-659D-4D8F-BCD8-6B8A022F8FB0","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_server:4.3:*:*:*:*:*:*:*","matchCriteriaId":"A1532304-0EA2-4816-B481-C87C7386DC88","vulnerable":true},{"criteria":"cpe:2.3:a:suse:openstack_cloud:9.0:*:*:*:*:*:*:*","matchCriteriaId":"83F8A7D8-FD3E-4C36-AB2A-A61449BF38C5","vulnerable":true},{"criteria":"cpe:2.3:a:suse:openstack_cloud_crowbar:9.0:*:*:*:*:*:*:*","matchCriteriaId":"B631400C-0A5A-45A3-9DFA-B419E83D324E","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp1:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"357F7687-7710-4F51-A655-E02F3A3603FF","vulnerable":true},{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp2:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"9199A62B-B38B-482D-9557-7E43A6E13774","vulnerable":true},{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp3:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"02D86BE4-C975-4F28-861D-3313E144BAC3","vulnerable":true},{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp4:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"2268D43F-6457-4708-AB00-F111B5945016","vulnerable":true},{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp5:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"990A2271-69DA-4FC9-BD7B-2D1A22BF26E0","vulnerable":true},{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp6:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"31785EF5-12E3-44EB-9391-B34C9476A075","vulnerable":true},{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp7:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"2E177376-B887-4D00-BD07-60C1B862901F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp1:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"58DEE083-487A-4C64-A269-CD5C63D4A273","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp2:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"0E65BF75-2DE8-46D3-8A34-BC5EDB9B66D2","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp3:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"D15DC0F1-2C7A-45F3-BC08-82A4B925B2B2","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp4:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"E7DF4886-9D35-4415-A727-A08FEBF7128C","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp5:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"6997F266-74C0-41A2-B157-F3E09A3A9C5A","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp6:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"AA273F5C-BE4E-410B-9192-0DD9473E9822","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp7:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"0A9B8201-C85C-46A9-B597-57711971F402","vulnerable":true},{"criteria":"cpe:2.3:o:suse:legacy_module:15:sp7:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"F60DD081-8FD5-4C2B-96BB-18CED178031F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*","matchCriteriaId":"17D4B6F2-514D-4BC2-B2C5-4E2FCCAC594C","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:12:sp4:*:*:*:*:*:*","matchCriteriaId":"55242557-663C-4870-A439-4C8FEEB69E7F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp1:*:*:*:*:*:*","matchCriteriaId":"7BBB0C06-3CCE-40B2-8CEA-F4303D861C9C","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp2:*:*:*:*:*:*","matchCriteriaId":"8C4F62C0-4188-433A-8292-559025CA23C0","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp3:*:*:*:*:*:*","matchCriteriaId":"ACB76FF0-B939-42E9-842B-171E929F317D","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp4:*:*:*:*:*:*","matchCriteriaId":"F648F64B-C3F2-4B14-906D-E48345303F0E","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp5:*:*:*:*:*:*","matchCriteriaId":"3298F3F6-F8A1-41CC-AD83-C584CA103757","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp6:*:*:*:*:*:*","matchCriteriaId":"B83183BD-A440-4697-8DD8-8A478C428984","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp7:*:*:*:*:*:*","matchCriteriaId":"B4388826-A383-4FBA-819A-363EAF6183DE","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_availability_extension:15:sp4:*:*:*:*:*:*","matchCriteriaId":"F1FCE4D2-1DEA-47B8-B8E2-28BF9F6B4427","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_availability_extension:15:sp6:*:*:*:*:*:*","matchCriteriaId":"CD0E86ED-467D-4904-A264-EA4A3DC43FAE","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_availability_extension:15:sp7:*:*:*:*:*:*","matchCriteriaId":"6D4A57E9-3F8E-487B-BAC8-0F85DC776C01","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_availability_extension:16.0:-:*:*:*:*:*:*","matchCriteriaId":"E00590A7-67FA-419C-8B98-3B7F7EBA3DC1","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:-:*:*:*","matchCriteriaId":"5EB65449-AE21-4EE9-B0A1-6E7F984BA33F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:espos:*:*:*","matchCriteriaId":"89C89474-3F7A-499E-8E7C-25952584A68C","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:ltss:*:*:*","matchCriteriaId":"CA2E84A0-A9ED-411B-9963-647D8A95D3D5","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:-:*:*:*","matchCriteriaId":"6426BD94-DEE9-4833-B266-747DAD834366","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:espos:*:*:*","matchCriteriaId":"455B5F70-FDA0-4AE3-9C62-F0BC8E6C3D85","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:ltss:*:*:*","matchCriteriaId":"A0E17861-F7C2-479B-B687-42419ADED014","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp3:*:*:-:*:*:*","matchCriteriaId":"75A0B727-33A9-416B-9E83-5103ABE856B4","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp3:*:*:espos:*:*:*","matchCriteriaId":"C46EFE88-003E-45C7-9BB3-CCC6B4E5E012","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp3:*:*:ltss:*:*:*","matchCriteriaId":"4B6D6786-D47A-49D3-A368-775417B47AE3","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp4:*:*:-:*:*:*","matchCriteriaId":"D0E679A3-3EAC-4603-BD89-E04EE26845B2","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp4:*:*:espos:*:*:*","matchCriteriaId":"3A766D20-F8F6-47D7-BB8A-298E6D4A557B","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp4:*:*:ltss:*:*:*","matchCriteriaId":"E7C37E18-03E4-4618-A5DF-3B4C307AE262","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp5:*:*:-:*:*:*","matchCriteriaId":"26F5E65A-CC1E-43D7-8181-53ACF3D04D01","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp5:*:*:espos:*:*:*","matchCriteriaId":"AFECB8BB-9BFE-4725-BEF0-D05DC7858E76","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp5:*:*:ltss:*:*:*","matchCriteriaId":"4E3D5431-943A-47E6-9702-BD9FC39FF18E","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp6:*:*:-:*:*:*","matchCriteriaId":"E3F9185F-365B-4DA9-A406-B474792C45A4","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp7:*:*:-:*:*:*","matchCriteriaId":"D1570F75-DBEA-4B52-B499-06E7D100E270","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_live_patching:12:sp5:*:*:*:*:*:*","matchCriteriaId":"1D26195B-07AA-4320-A0C9-D322266DEC68","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_live_patching:15:sp4:*:*:*:*:*:*","matchCriteriaId":"CADD34DE-2694-4F53-9CEE-765A981565DB","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_live_patching:15:sp5:*:*:*:*:*:*","matchCriteriaId":"0F229A3A-A13F-46E7-9A29-3FA43EE44D79","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_live_patching:15:sp6:*:*:*:*:*:*","matchCriteriaId":"B717A471-D104-4D66-9EDB-BF65C96E0A15","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_live_patching:15:sp7:*:*:*:*:*:*","matchCriteriaId":"B59781EB-6D62-4619-AC92-F858BDF0D430","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.0:*:*:*:*:-:*:*","matchCriteriaId":"620CB473-D500-49B1-ABD5-A2C6DB641DD9","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.1:*:*:*:*:-:*:*","matchCriteriaId":"FE7DC148-F244-4AEA-8803-17ADF8DC4AC7","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.2:*:*:*:*:-:*:*","matchCriteriaId":"EACDFD9B-C423-4FD1-B9AA-0D6D7D93CB36","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.2:*:*:*:*:rancher:*:*","matchCriteriaId":"825D86FE-87DA-4389-8097-D7CF34718CB2","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.3:*:*:*:*:-:*:*","matchCriteriaId":"E037079A-283D-460C-A76D-E436C575352B","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.3:*:*:*:*:rancher:*:*","matchCriteriaId":"E1BB6675-DF28-4494-A956-06915DE98A09","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.4:*:*:*:*:-:*:*","matchCriteriaId":"0D7CF925-609A-41DD-A76A-4D8F6C05729A","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.4:*:*:*:*:rancher:*:*","matchCriteriaId":"E9138B27-95CD-4064-AB74-CD1364DA3D3F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.5:*:*:*:*:-:*:*","matchCriteriaId":"6683D4D9-9647-4C06-A729-8CE2DFE195E8","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp2:*:*:*:*:*:*","matchCriteriaId":"4B0AC584-5E26-4ACE-BC19-9E69A302F238","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp3:*:*:*:*:*:*","matchCriteriaId":"17377C9F-F429-47B2-AC4D-17CE243ED949","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp4:*:*:*:*:*:*","matchCriteriaId":"62DC1612-368F-4D67-AA5E-E4719279DE4A","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp5:*:*:*:*:*:*","matchCriteriaId":"71E87389-289F-4FF6-928B-9A8E77387F65","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp6:*:*:*:*:*:*","matchCriteriaId":"E8772290-7B8F-4FF3-8114-0535E84E10F5","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp7:*:*:*:*:*:*","matchCriteriaId":"BF782A24-9E6B-4897-9402-37DBCA7A7332","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:-:-:*:*","matchCriteriaId":"A25FBA6E-EB0B-4FD3-A0CE-33CA9EB0CD62","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss:-:*:*","matchCriteriaId":"0E13E83D-4249-45C1-8025-491EECA6F9F3","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss_extreme_core:-:*:*","matchCriteriaId":"6BBDE786-4B07-4FD1-817F-948A19F97EE0","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:-:-:*:*","matchCriteriaId":"38373877-18C5-4CEB-A2F1-A6BCF63C1D79","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:-:sap:*:*","matchCriteriaId":"E279968E-C62B-4888-899A-2BF57E8F8692","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:espos:-:*:*","matchCriteriaId":"26CAA62D-796C-45E2-8797-64833C237D27","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:ltss:-:*:*","matchCriteriaId":"191B0B2D-5A5A-4206-B061-106C22C03C88","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:-:-:*:*","matchCriteriaId":"36E71D0E-6256-45D5-A0B8-518B3DB59718","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:ltss:-:*:*","matchCriteriaId":"FE4A9969-7684-44E0-AF88-437B6F5B2CAA","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:ltss_extended_security:-:*:*","matchCriteriaId":"1202065D-DE5A-4E7F-B01A-4D3915C5112A","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:-:-:*:*","matchCriteriaId":"60EF8A73-A078-49A9-8FDE-4B7F74B2E17B","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:-:sap:*:*","matchCriteriaId":"82A16781-8A1D-4FE4-84E8-19B6B8D5E6D0","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:business_critical_linux:-:*:*","matchCriteriaId":"26FDBC27-D993-4A93-BC70-753FA21F4C11","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:ltss:-:*:*","matchCriteriaId":"5BC409DF-47A5-4EAF-9DCA-9BA35BB1B2C5","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:-:-:*:*","matchCriteriaId":"2FAAE2BD-4063-4C24-B8C8-9638171A19B9","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:-:sap:*:*","matchCriteriaId":"1615874B-E07C-4DAB-9F48-34DA42915314","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:business_critical_linux:-:*:*","matchCriteriaId":"A256B5D1-49D2-4363-AAD6-30FD32F0D132","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:ltss:-:*:*","matchCriteriaId":"2AEA8A74-9D7D-410A-983E-7E69443DEA6B","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:-:-:*:*","matchCriteriaId":"F9771ADC-0560-4146-9CC2-690D3C3CE81F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:-:sap:*:*","matchCriteriaId":"76840252-04F1-43C4-9A59-676B179650E0","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:business_critical_linux:-:*:*","matchCriteriaId":"7456711B-C403-48FC-AD77-92D5177D3175","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:ltss:-:*:*","matchCriteriaId":"3BE8B253-3C09-48C8-BAE8-3E953AAFA49F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp4:*:*:-:-:*:*","matchCriteriaId":"9122256C-13F2-4322-95F1-9D83C9051A45","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp4:*:*:-:sap:*:*","matchCriteriaId":"CC23D242-B960-40D3-A395-174A1F270D4D","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp4:*:*:ltss:-:*:*","matchCriteriaId":"7053AA23-E12B-4B91-A641-724887F6A4DF","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp5:*:*:-:-:*:*","matchCriteriaId":"9E823F48-8554-4590-BC30-CA17ECAE9ED4","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp5:*:*:-:sap:*:*","matchCriteriaId":"0B02BB2D-5DB9-48DC-AB4F-B006D18234FA","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp5:*:*:ltss:-:*:*","matchCriteriaId":"8DFA6058-A5C9-4E87-9F34-B083E55A7EA3","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp6:*:*:-:-:*:*","matchCriteriaId":"BB84120C-48BB-4147-AAD3-39DEF003B57E","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp6:*:*:-:sap:*:*","matchCriteriaId":"8F9012DD-FFF8-4CED-AEA3-C22CB44C237F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp6:*:*:ltss:-:*:*","matchCriteriaId":"B05BFB51-DBF6-4F71-83F8-C32BFB396404","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp7:*:*:-:-:*:*","matchCriteriaId":"CCE4946A-773A-443D-B5E3-839E637C3360","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp7:*:*:-:sap:*:*","matchCriteriaId":"C2F7F7D2-6E82-4FB4-8C44-3C7DEF123173","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:16.0:-:*:*:-:-:*:*","matchCriteriaId":"0F61E05F-DD0A-48AB-B7B2-8D84A5517FF2","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:16.0:-:*:*:-:sap:*:*","matchCriteriaId":"7DC085B3-7D3D-4FEB-B778-79FBDD87264A","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:16.1:-:*:*:-:-:*:*","matchCriteriaId":"09803492-7525-4B24-B34E-64BB9FF6FDBD","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:16.1:-:*:*:-:sap:*:*","matchCriteriaId":"56519853-7A3E-412C-A4F6-6921A1742033","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_workstation_extension:15:sp7:*:*:*:*:*:*","matchCriteriaId":"12E15CF5-8517-4AE1-9130-4CFA65C2F7C2","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_micro:6.0:*:*:*:*:*:*:*","matchCriteriaId":"5A4E809C-2AAD-4E86-A5F4-AB41CA669F40","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_micro:6.1:*:*:*:*:*:*:*","matchCriteriaId":"9DC86A69-74D3-4745-BC7C-BBAF80B2BCBE","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_micro:6.2:*:*:*:*:*:*:*","matchCriteriaId":"E9594AD7-3671-42D1-B07E-D8FE8782EDD7","vulnerable":true},{"criteria":"cpe:2.3:o:suse:public_cloud_module:15:sp6:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"CEB648DC-0111-443B-A728-2D9B01EBC179","vulnerable":true},{"criteria":"cpe:2.3:o:suse:public_cloud_module:15:sp7:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"6C09FB49-F594-4ECD-9686-4EDBC8BD1C1A","vulnerable":true},{"criteria":"cpe:2.3:o:suse:realtime_module:15:sp3:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"9C713704-CEB4-4F44-BD93-77F0586DC518","vulnerable":true},{"criteria":"cpe:2.3:o:suse:realtime_module:15:sp4:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"D7E2A9ED-6E69-46D7-85AC-2DB710AB7A84","vulnerable":true},{"criteria":"cpe:2.3:o:suse:realtime_module:15:sp5:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"6C4BB4DD-2022-479F-8805-70B37E2B224C","vulnerable":true},{"criteria":"cpe:2.3:o:suse:realtime_module:15:sp6:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"ACB1A9AF-E037-4FC1-8A35-E1D128005FA9","vulnerable":true},{"criteria":"cpe:2.3:o:suse:realtime_module:15:sp7:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"DD298056-E8C4-4F7E-8CD5-784C201633D1","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:nixos:nixos:*:*:*:*:*:*:*:*","matchCriteriaId":"A1DAD7C2-EBFB-4DF5-A727-0A84F8F31619","versionEndExcluding":"25.11","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:arista:cloudvision_agni:*:*:*:*:*:-:*:*","matchCriteriaId":"A4C875E3-0FFA-4806-BA6C-EB2F8EBF76AF","versionEndIncluding":"2025.2.2","versionStartIncluding":"2024.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:arista:cloudvision_portal:*:*:*:*:*:*:*:*","matchCriteriaId":"0ADB58FD-7F44-4BA1-9A55-21E220B4FFDF","versionEndIncluding":"2026.1.0","versionStartIncluding":"2024.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:arista:velocloud_edge:*:*:*:*:*:*:*:*","matchCriteriaId":"1A9C5C40-C542-4320-9777-29A0F2D70220","versionEndIncluding":"6.4.1","versionStartIncluding":"4.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:arista:velocloud_gateway:-:*:*:*:*:*:*:*","matchCriteriaId":"88F2CE3D-1529-4A87-BD14-173BF206D7A9","vulnerable":true},{"criteria":"cpe:2.3:a:arista:velocloud_orchestrator:-:*:*:*:*:*:*:*","matchCriteriaId":"01F6A323-B165-4506-8573-8877F567FEBF","vulnerable":true},{"criteria":"cpe:2.3:o:arista:netvisor_os:*:*:*:*:*:*:*:*","matchCriteriaId":"A3349C40-C473-4744-AF72-AB6B0EBDB92F","versionEndExcluding":"7.1.0","vulnerable":true},{"criteria":"cpe:2.3:o:arista:netvisor_os:7.1.0:-:*:*:*:*:*:*","matchCriteriaId":"447BB72F-95B9-4F2E-8CDD-74664AD045ED","vulnerable":true},{"criteria":"cpe:2.3:o:arista:netvisor_os:7.1.0:hotfix7:*:*:*:*:*:*","matchCriteriaId":"82A2BB74-B148-44F1-904E-325E89720073","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\\/dp_mfp_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"99E36624-A573-47D9-B158-B18A8A822FBA","versionStartIncluding":"3.1.5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\\/dp_mfp:-:*:*:*:*:*:*:*","matchCriteriaId":"3BC4FA01-8DDB-41E4-B759-7B504F78AEBC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"2A7548B8-3DF7-46D9-8A4F-87C38969D900","versionStartIncluding":"3.1.5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp:-:*:*:*:*:*:*:*","matchCriteriaId":"5B1EE93D-BAD2-4B86-910C-8784FCC9F398","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:siplus_s7-1500_cpu_1518-4_pn\\/dp_mfp_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"19F1C257-0EE6-47DE-B4BE-169F801FFDD8","versionStartIncluding":"3.1.5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:siplus_s7-1500_cpu_1518-4_pn\\/dp_mfp:-:*:*:*:*:*:*:*","matchCriteriaId":"E2F63E0A-126D-4A93-8159-45EB5E606F81","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6C0262-1527-4F55-8BDE-973F59FE7E1B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:*","matchCriteriaId":"754051AB-27D3-41CA-B2C8-79BAD48C8750","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","matchCriteriaId":"B5A6F2F3-4894-4392-8296-3B8DD2679084","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","matchCriteriaId":"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","matchCriteriaId":"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*","matchCriteriaId":"902B8056-9E37-443B-8905-8AA93E2447FB","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*","matchCriteriaId":"359012F1-2C63-415A-88B8-6726A87830DE","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*","matchCriteriaId":"BF90B5A4-6E55-4369-B9D4-E7A061E797D2","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:25.10:*:*:*:-:*:*:*","matchCriteriaId":"8998BFFF-82EF-4D9E-8DE5-0072064512BC","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_cn_4100_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"44E1D58D-9B5B-45AC-A0C6-4482168101A5","versionEndExcluding":"6.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_cn_4100:-:*:*:*:*:*:*:*","matchCriteriaId":"92619F5F-3679-4424-9455-3285FF1EF2F1","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:siemens:simatic_ax_runtime:-:*:*:*:*:*:*:*","matchCriteriaId":"A82943E5-24F0-4C90-BD86-5EA6DE90281B","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_hmi_unified_comfort_panels_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"79C16917-20D1-4D6A-BEA3-DCD19154C7EA","versionEndExcluding":"21.0","vulnerable":true},{"criteria":"cpe:2.3:o:siemens:simatic_hmi_unified_comfort_panels_firmware:21.0:-:*:*:*:*:*:*","matchCriteriaId":"958AADC1-00C2-4FBC-B437-2B90CD458622","vulnerable":true},{"criteria":"cpe:2.3:o:siemens:simatic_hmi_unified_comfort_panels_firmware:21.0:update_1:*:*:*:*:*:*","matchCriteriaId":"6F712A84-CCB0-4E44-B95D-A493D9854FB7","vulnerable":true},{"criteria":"cpe:2.3:o:siemens:simatic_hmi_unified_comfort_panels_firmware:21.0:update_2:*:*:*:*:*:*","matchCriteriaId":"C0D94F80-74EF-4FC7-8E0A-C2150B3F24D7","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_hmi_mtp1000:-:*:*:*:*:*:*:*","matchCriteriaId":"05E7DDAD-872F-4E93-8119-B5BBABC76CB4","vulnerable":false},{"criteria":"cpe:2.3:h:siemens:simatic_hmi_mtp1200:-:*:*:*:*:*:*:*","matchCriteriaId":"B390024E-F616-4996-A436-1FB4F150AA00","vulnerable":false},{"criteria":"cpe:2.3:h:siemens:simatic_hmi_mtp1500:-:*:*:*:*:*:*:*","matchCriteriaId":"643CDFBC-F073-453B-99BE-1B397183F7FB","vulnerable":false},{"criteria":"cpe:2.3:h:siemens:simatic_hmi_mtp1900:-:*:*:*:*:*:*:*","matchCriteriaId":"984BD668-AB96-4577-8389-86C5F1D37412","vulnerable":false},{"criteria":"cpe:2.3:h:siemens:simatic_hmi_mtp2200:-:*:*:*:*:*:*:*","matchCriteriaId":"379F5A4A-6ED3-4B3D-81E0-A8A851AF02A0","vulnerable":false},{"criteria":"cpe:2.3:h:siemens:simatic_hmi_mtp700:-:*:*:*:*:*:*:*","matchCriteriaId":"9F6513F2-E929-49D3-975A-035CD7DAAD91","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_iot2050_advanced_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F12F6619-B7B3-44AB-883D-D76887712EED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_iot2050_advanced:-:*:*:*:*:*:*:*","matchCriteriaId":"DAA93FE9-C1BB-4A6D-A7EC-BA5D758A2A5B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_ipc_ied-os:-:*:*:*:*:*:*:*","matchCriteriaId":"5C86210A-361D-492B-A83B-14BF959263BA","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly."}],"id":"CVE-2026-31431","lastModified":"2026-09-08T15:13:07.273","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31431","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-04-22T09:16:21.270","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/29/23"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/29/25"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/29/26"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/10"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/11"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/14"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/15"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/16"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/17"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/18"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/20"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/10"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/15"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/16"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/17"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/18"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/22"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/23"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/24"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/3"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/14"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/15"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/16"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/17"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/18"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/19"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/20"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/21"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/23"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/24"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/25"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/4"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/7"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/8"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/10"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/3"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/4"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/10"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/11"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/14"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/24"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/27"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/28"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/29"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/31"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/8"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/9"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/06/5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/07/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/07/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/08/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/18/3"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"url":"https://copy.fail"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://www.kb.cert.org/vuls/id/260001"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13565"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13566"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13577"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13578"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13681"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13690"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13727"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13729"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13734"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13811"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13862"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13885"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13887"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13932"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13936"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14097"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14112"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14137"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14165"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14230"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14301"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14339"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14773"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14926"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:15087"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:15976"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:15978"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:16018"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:16063"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:16111"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:16208"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:16209"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:16210"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:19074"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:19225"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:33486"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2026-31431"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/cve-2026-31431#cve-details-mitigation"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Issue Tracking","Third Party Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460538"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-328642.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit"],"url":"https://github.com/theori-io/copy-fail-CVE-2026-31431"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"],"url":"https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31431.json"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-31431"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Third Party Advisory"],"url":"https://xint.io/blog/copy-fail-linux-distributions#the-fix-6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-669"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-1288"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/af_alg.c","crypto/algif_aead.c","crypto/algif_skcipher.c","include/crypto/if_alg.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"893d22e0135fa394db81df88697fba6032747667","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"19d43105a97be0810edbda875f2cd03f30dc130c","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"961cfa271a918ad4ae452420e7c303149002875b","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"3115af9644c342b356f3f07a4dd1c8905cd9a6fc","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"8b88d99341f139e23bdeb1027a2a3ae10d341d82","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"ce42ee423e58dffa5ec03524054c9d8bfd4f6237","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"},{"lessThan":"a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5","status":"affected","version":"72548b093ee38a6d4f2a19e6ef1948ae05c181f7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/af_alg.c","crypto/algif_aead.c","crypto/algif_skcipher.c","include/crypto/if_alg.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.254","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.204","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.170","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.137","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.85","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux_nvidia:10::el10"],"defaultStatus":"affected","packageName":"kernel","product":"NVIDIA for RHEL 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.6.el10nv","versionType":"rpm"},{"lessThan":"*","status":"unaffected","version":"0:6.12.0-231.12.el10nv","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.1","cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-124.55.1.el10_1","versionType":"rpm"},{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.7.3.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.71.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.123.1.rt7.464.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.123.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-305.190.1.el8_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus_long_life:8.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-305.190.1.el8_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_aus:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.191.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_tus:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.191.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-372.191.1.el8_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.6"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_tus:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.139.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.139.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-611.54.1.el9_7","versionType":"rpm"},{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.5.3.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-70.178.1.el9_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-70.178.1.rt21.250.el9_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.0"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.169.1.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.169.1.rt14.454.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:9.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-427.124.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.4"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.112.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_eus:9.6"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.12::el8"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"412.86.202605060316-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"413.92.202605051442-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"414.92.202605060243-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"415.92.202605060220-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"416.94.202605042300-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.17","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"417.94.202605050021-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.18","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"418.94.202605042017-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.19","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.19.9.6.202605042214-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.20","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.20.9.6.202605051409-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"defaultStatus":"affected","packageName":"rhcos","product":"Red Hat OpenShift Container Platform 4.21","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"4.21.9.6.202605051105-0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC AX Runtime Core Linux Common Debian","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC AX Runtime Core Linux Common Debian arm64","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC AX Runtime Core Linux Platform Container Common Debian Development","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC AX Runtime Core Linux VMWare Development","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC CN 4100","vendor":"Siemens","versions":[{"lessThan":"V6.0","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1000 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1000 Unified Comfort Panel","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1000 Unified Comfort Panel hygienic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1000 Unified Comfort Panel hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1000, Unified Comfort Panel neutral","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Comfort Pro for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Comfort Pro for support arm (expandable, round tube) and extension unit","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Comfort Pro for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Comfort Pro neutral design for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (expandable, round tube) and extension","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Comfort Pro neutral design for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Unified Comfort Panel","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Unified Comfort Panel hygienic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Unified Comfort Panel hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1200 Unified Comfort Panel neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Comfort Pro for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Comfort Pro for support arm (expandable, round tube) and extension unit","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Comfort Pro for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Comfort Pro neutral design for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (expandable, round tube) and extension","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Comfort Pro neutral design for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Unified Comfort Panel","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Unified Comfort Panel hygienic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Unified Comfort Panel hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1500 Unified Comfort Panel neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Comfort Pro for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Comfort Pro for support arm (expandable, round tube) and extension unit","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Comfort Pro for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Comfort Pro neutral design for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (expandable, round tube) and extension","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Comfort Pro neutral design for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Unified Comfort Panel","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Unified Comfort Panel hygienic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Unified Comfort Panel hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP1900 Unified Comfort Panel neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Comfort Pro for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Comfort Pro for support arm (expandable, round tube) and extension unit","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Comfort Pro for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Comfort Pro neutral design for stand (expandable, flange at the bottom)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (expandable, round tube) and extension","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Comfort Pro neutral design for support arm (not extendable, flange on top)","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Unified Comfort Hygienic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Unified Comfort Hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Unified Comfort Panel","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP2200 Unified Comfort Panel neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP400 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP700 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP700 Unified Comfort Panel","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP700 Unified Comfort Panel hygienic neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC HMI MTP700, Unified Comfort Panel neutral design","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IoT2050 Advanced","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC IPC Industrial Edge Device OS (IED-OS)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.7","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.7","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.7","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.7","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP1000 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP1000 Unified Comfort","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP1200 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP1200 Unified Comfort","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP400 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP700 Unified Basic","vendor":"Siemens","versions":[{"lessThan":"V21 SP2 Update 1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS HMI MTP700 Unified Comfort","vendor":"Siemens","versions":[{"lessThan":"V21 Update 2 SR1","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"V3.1.7","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"cisaActionDue":"2026-05-15","cisaExploitAdd":"2026-05-01","cisaRequiredAction":"\"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cisaVulnerabilityName":"Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability","configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"24B62F9A-357D-465D-97EB-2819B1CD663C","versionEndExcluding":"5.10.254","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FA800016-0012-4E3F-A528-2A7F378A0A4A","versionEndExcluding":"5.15.204","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E6653854-B188-42DD-B8C5-0143F1956AB1","versionEndExcluding":"6.1.170","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3CA3EF52-168A-4348-8F5F-356C9EB69261","versionEndExcluding":"6.6.137","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F17D292D-A9B5-4DC7-8002-51AB95335606","versionEndExcluding":"6.12.85","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"E6FEF674-586D-4F75-B07C-407044DF151F","versionEndExcluding":"4.12.89","versionStartIncluding":"4.12","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"B31A414A-0545-4634-A6FB-511541C5E097","versionEndExcluding":"4.13.66","versionStartIncluding":"4.13","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"77C210A8-89BB-461A-8381-35A12D5B5116","versionEndExcluding":"4.14.65","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"99513472-1475-4D94-AFE4-9E4DF239B100","versionEndExcluding":"4.15.64","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"1AE50081-D222-4A00-965B-B628AB6394FF","versionEndExcluding":"4.16.61","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"96236E42-2DF9-47AC-8438-16929A863CF0","versionEndExcluding":"4.17.53","versionStartIncluding":"4.17","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"4CEDEF22-43C5-4572-A29A-89FDC67384A9","versionEndExcluding":"4.18.40","versionStartIncluding":"4.18","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"665A1C48-2209-448C-945A-37337A884C11","versionEndExcluding":"4.19.30","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"4B3BE91E-E136-4102-84BA-88FD88749F8B","versionEndExcluding":"4.20.21","versionStartIncluding":"4.20","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*","matchCriteriaId":"58643369-41D9-46AB-BC74-B3025B44B143","versionEndExcluding":"4.21.14","versionStartIncluding":"4.21","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*","matchCriteriaId":"932D137F-528B-4526-9A89-CD59FA1AB0FE","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","matchCriteriaId":"F4CFF558-3C47-480D-A2F0-BABF26042943","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"7F6FB57C-2BC7-487C-96DD-132683AEB35D","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_aus:8.4:*:*:*:*:*:*:*","matchCriteriaId":"4D5F4FA7-E5C5-4C23-BDA8-36A36972E4F4","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_aus:8.6:*:*:*:*:*:*:*","matchCriteriaId":"5CA4F12A-5BC5-4D75-8F20-80D8BB2C5BF2","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*","matchCriteriaId":"0E3F09B5-569F-4C58-9FCA-3C0953D107B5","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*","matchCriteriaId":"B03506D7-0FCD-47B7-90F6-DDEEB5C5A733","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_eus:9.6:*:*:*:*:*:*:*","matchCriteriaId":"C4CF8D2F-DACA-49C2-A9F4-63496B0A9A80","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_eus:10.0:*:*:*:*:*:*:*","matchCriteriaId":"34990D09-125F-48CA-B85E-9D9F0EB4BC07","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_tus:8.6:*:*:*:*:*:*:*","matchCriteriaId":"C237415F-33FE-4686-9B19-A0916BF75D2D","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_tus:8.8:*:*:*:*:*:*:*","matchCriteriaId":"22D28543-C7C5-46B0-B909-20435AF7A501","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*","matchCriteriaId":"FB096D5D-E8F6-4164-8B76-0217B7151D30","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*","matchCriteriaId":"01ED4F33-EBE7-4C04-8312-3DA580EFFB68","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.0:*:*:*:*:*:*:*","matchCriteriaId":"083AAC55-E87B-482A-A1F4-8F2DEB90CB23","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:9.2:*:*:*:*:*:*:*","matchCriteriaId":"1FD9BF0E-7ACF-4A83-B754-6E3979ED903F","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:amazon:amazon_linux:-:*:*:*:*:*:*:*","matchCriteriaId":"C8699C74-BF90-4CF8-9285-32576DB1FE2B","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:-:*:*:*:*:*:*:*","matchCriteriaId":"019A2188-0877-45DE-8512-F0BF70DD179C","vulnerable":true},{"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED","vulnerable":true},{"criteria":"cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*","matchCriteriaId":"46D69DCC-AE4D-4EA5-861C-D60951444C6C","vulnerable":true},{"criteria":"cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*","matchCriteriaId":"204FC6CC-9DAC-45FB-8A9F-C9C8EDD29D54","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:opensuse:leap:15.3:*:*:*:*:*:*:*","matchCriteriaId":"090F0D1A-6BF8-4810-8942-3FFE4FBF7FE0","vulnerable":true},{"criteria":"cpe:2.3:o:opensuse:leap:15.4:*:*:*:*:*:*:*","matchCriteriaId":"BE80EB04-7F9D-4C0B-85DB-4A13DEACB5E4","vulnerable":true},{"criteria":"cpe:2.3:o:opensuse:leap:15.5:*:*:*:*:*:*:*","matchCriteriaId":"E79D3E16-E284-40C6-916E-2EE78102BF4A","vulnerable":true},{"criteria":"cpe:2.3:o:opensuse:leap:15.6:*:*:*:*:*:*:*","matchCriteriaId":"78B4F1C7-A301-4C94-A41C-A51182B83677","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:suse:caas_platform:4.0:*:*:*:*:*:*:*","matchCriteriaId":"5AB27A2D-549C-450E-A09E-B3316895F052","vulnerable":true},{"criteria":"cpe:2.3:a:suse:enterprise_storage:6.0:*:*:*:*:*:*:*","matchCriteriaId":"3B20D44D-F87E-4692-8E04-695683F1ECE6","vulnerable":true},{"criteria":"cpe:2.3:a:suse:enterprise_storage:7.0:*:*:*:*:*:*:*","matchCriteriaId":"F7305944-AC9C-47A3-AADF-71A8B24830D1","vulnerable":true},{"criteria":"cpe:2.3:a:suse:enterprise_storage:7.1:*:*:*:*:*:*:*","matchCriteriaId":"D9A626D2-FF84-40BB-B5A2-053D64992FE5","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_proxy:4.0:*:*:*:*:*:*:*","matchCriteriaId":"71A42960-17FA-4F96-8CF4-BADAB702EBA4","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_proxy:4.1:*:*:*:*:*:*:*","matchCriteriaId":"9910C73A-3BCD-4F56-8C7D-79CB289640A2","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_proxy:4.2:*:*:*:*:*:*:*","matchCriteriaId":"B0156BFA-9E83-43E6-9C73-9711AD054B5A","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_proxy:4.3:*:*:*:*:*:*:*","matchCriteriaId":"CAC2D0A4-56F8-4ED6-91E2-78434A016C5F","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_retail_branch_server:4.0:*:*:*:*:*:*:*","matchCriteriaId":"A4F81939-C109-4643-951E-42F8F20F4672","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_retail_branch_server:4.1:*:*:*:*:*:*:*","matchCriteriaId":"450A3B3F-F26D-4EAB-BF5D-4C906C4A99DD","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_retail_branch_server:4.2:*:*:*:*:*:*:*","matchCriteriaId":"BD5BDD59-5008-4DDC-B805-BB6B7DE8E1A6","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_retail_branch_server:4.3:*:*:*:*:*:*:*","matchCriteriaId":"A69D3CCD-6590-46EF-9D3F-E903AB78E3BA","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_server:4.0:*:*:*:*:*:*:*","matchCriteriaId":"51136B38-5715-49B3-BD8D-91F90632247D","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_server:4.1:*:*:*:*:*:*:*","matchCriteriaId":"B5810E98-7BF5-42E2-9DE9-661049ABE367","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_server:4.2:*:*:*:*:*:*:*","matchCriteriaId":"0E46DEFD-659D-4D8F-BCD8-6B8A022F8FB0","vulnerable":true},{"criteria":"cpe:2.3:a:suse:manager_server:4.3:*:*:*:*:*:*:*","matchCriteriaId":"A1532304-0EA2-4816-B481-C87C7386DC88","vulnerable":true},{"criteria":"cpe:2.3:a:suse:openstack_cloud:9.0:*:*:*:*:*:*:*","matchCriteriaId":"83F8A7D8-FD3E-4C36-AB2A-A61449BF38C5","vulnerable":true},{"criteria":"cpe:2.3:a:suse:openstack_cloud_crowbar:9.0:*:*:*:*:*:*:*","matchCriteriaId":"B631400C-0A5A-45A3-9DFA-B419E83D324E","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp1:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"357F7687-7710-4F51-A655-E02F3A3603FF","vulnerable":true},{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp2:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"9199A62B-B38B-482D-9557-7E43A6E13774","vulnerable":true},{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp3:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"02D86BE4-C975-4F28-861D-3313E144BAC3","vulnerable":true},{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp4:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"2268D43F-6457-4708-AB00-F111B5945016","vulnerable":true},{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp5:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"990A2271-69DA-4FC9-BD7B-2D1A22BF26E0","vulnerable":true},{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp6:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"31785EF5-12E3-44EB-9391-B34C9476A075","vulnerable":true},{"criteria":"cpe:2.3:o:suse:basesystem_module:15:sp7:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"2E177376-B887-4D00-BD07-60C1B862901F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp1:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"58DEE083-487A-4C64-A269-CD5C63D4A273","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp2:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"0E65BF75-2DE8-46D3-8A34-BC5EDB9B66D2","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp3:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"D15DC0F1-2C7A-45F3-BC08-82A4B925B2B2","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp4:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"E7DF4886-9D35-4415-A727-A08FEBF7128C","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp5:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"6997F266-74C0-41A2-B157-F3E09A3A9C5A","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp6:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"AA273F5C-BE4E-410B-9192-0DD9473E9822","vulnerable":true},{"criteria":"cpe:2.3:o:suse:development_tools_module:15:sp7:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"0A9B8201-C85C-46A9-B597-57711971F402","vulnerable":true},{"criteria":"cpe:2.3:o:suse:legacy_module:15:sp7:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"F60DD081-8FD5-4C2B-96BB-18CED178031F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*","matchCriteriaId":"17D4B6F2-514D-4BC2-B2C5-4E2FCCAC594C","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:12:sp4:*:*:*:*:*:*","matchCriteriaId":"55242557-663C-4870-A439-4C8FEEB69E7F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp1:*:*:*:*:*:*","matchCriteriaId":"7BBB0C06-3CCE-40B2-8CEA-F4303D861C9C","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp2:*:*:*:*:*:*","matchCriteriaId":"8C4F62C0-4188-433A-8292-559025CA23C0","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp3:*:*:*:*:*:*","matchCriteriaId":"ACB76FF0-B939-42E9-842B-171E929F317D","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp4:*:*:*:*:*:*","matchCriteriaId":"F648F64B-C3F2-4B14-906D-E48345303F0E","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp5:*:*:*:*:*:*","matchCriteriaId":"3298F3F6-F8A1-41CC-AD83-C584CA103757","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp6:*:*:*:*:*:*","matchCriteriaId":"B83183BD-A440-4697-8DD8-8A478C428984","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:15:sp7:*:*:*:*:*:*","matchCriteriaId":"B4388826-A383-4FBA-819A-363EAF6183DE","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_availability_extension:15:sp4:*:*:*:*:*:*","matchCriteriaId":"F1FCE4D2-1DEA-47B8-B8E2-28BF9F6B4427","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_availability_extension:15:sp6:*:*:*:*:*:*","matchCriteriaId":"CD0E86ED-467D-4904-A264-EA4A3DC43FAE","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_availability_extension:15:sp7:*:*:*:*:*:*","matchCriteriaId":"6D4A57E9-3F8E-487B-BAC8-0F85DC776C01","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_availability_extension:16.0:-:*:*:*:*:*:*","matchCriteriaId":"E00590A7-67FA-419C-8B98-3B7F7EBA3DC1","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:-:*:*:*","matchCriteriaId":"5EB65449-AE21-4EE9-B0A1-6E7F984BA33F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:espos:*:*:*","matchCriteriaId":"89C89474-3F7A-499E-8E7C-25952584A68C","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp1:*:*:ltss:*:*:*","matchCriteriaId":"CA2E84A0-A9ED-411B-9963-647D8A95D3D5","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:-:*:*:*","matchCriteriaId":"6426BD94-DEE9-4833-B266-747DAD834366","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:espos:*:*:*","matchCriteriaId":"455B5F70-FDA0-4AE3-9C62-F0BC8E6C3D85","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp2:*:*:ltss:*:*:*","matchCriteriaId":"A0E17861-F7C2-479B-B687-42419ADED014","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp3:*:*:-:*:*:*","matchCriteriaId":"75A0B727-33A9-416B-9E83-5103ABE856B4","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp3:*:*:espos:*:*:*","matchCriteriaId":"C46EFE88-003E-45C7-9BB3-CCC6B4E5E012","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp3:*:*:ltss:*:*:*","matchCriteriaId":"4B6D6786-D47A-49D3-A368-775417B47AE3","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp4:*:*:-:*:*:*","matchCriteriaId":"D0E679A3-3EAC-4603-BD89-E04EE26845B2","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp4:*:*:espos:*:*:*","matchCriteriaId":"3A766D20-F8F6-47D7-BB8A-298E6D4A557B","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp4:*:*:ltss:*:*:*","matchCriteriaId":"E7C37E18-03E4-4618-A5DF-3B4C307AE262","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp5:*:*:-:*:*:*","matchCriteriaId":"26F5E65A-CC1E-43D7-8181-53ACF3D04D01","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp5:*:*:espos:*:*:*","matchCriteriaId":"AFECB8BB-9BFE-4725-BEF0-D05DC7858E76","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp5:*:*:ltss:*:*:*","matchCriteriaId":"4E3D5431-943A-47E6-9702-BD9FC39FF18E","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp6:*:*:-:*:*:*","matchCriteriaId":"E3F9185F-365B-4DA9-A406-B474792C45A4","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15.0:sp7:*:*:-:*:*:*","matchCriteriaId":"D1570F75-DBEA-4B52-B499-06E7D100E270","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_live_patching:12:sp5:*:*:*:*:*:*","matchCriteriaId":"1D26195B-07AA-4320-A0C9-D322266DEC68","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_live_patching:15:sp4:*:*:*:*:*:*","matchCriteriaId":"CADD34DE-2694-4F53-9CEE-765A981565DB","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_live_patching:15:sp5:*:*:*:*:*:*","matchCriteriaId":"0F229A3A-A13F-46E7-9A29-3FA43EE44D79","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_live_patching:15:sp6:*:*:*:*:*:*","matchCriteriaId":"B717A471-D104-4D66-9EDB-BF65C96E0A15","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_live_patching:15:sp7:*:*:*:*:*:*","matchCriteriaId":"B59781EB-6D62-4619-AC92-F858BDF0D430","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.0:*:*:*:*:-:*:*","matchCriteriaId":"620CB473-D500-49B1-ABD5-A2C6DB641DD9","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.1:*:*:*:*:-:*:*","matchCriteriaId":"FE7DC148-F244-4AEA-8803-17ADF8DC4AC7","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.2:*:*:*:*:-:*:*","matchCriteriaId":"EACDFD9B-C423-4FD1-B9AA-0D6D7D93CB36","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.2:*:*:*:*:rancher:*:*","matchCriteriaId":"825D86FE-87DA-4389-8097-D7CF34718CB2","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.3:*:*:*:*:-:*:*","matchCriteriaId":"E037079A-283D-460C-A76D-E436C575352B","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.3:*:*:*:*:rancher:*:*","matchCriteriaId":"E1BB6675-DF28-4494-A956-06915DE98A09","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.4:*:*:*:*:-:*:*","matchCriteriaId":"0D7CF925-609A-41DD-A76A-4D8F6C05729A","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.4:*:*:*:*:rancher:*:*","matchCriteriaId":"E9138B27-95CD-4064-AB74-CD1364DA3D3F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_micro:5.5:*:*:*:*:-:*:*","matchCriteriaId":"6683D4D9-9647-4C06-A729-8CE2DFE195E8","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp2:*:*:*:*:*:*","matchCriteriaId":"4B0AC584-5E26-4ACE-BC19-9E69A302F238","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp3:*:*:*:*:*:*","matchCriteriaId":"17377C9F-F429-47B2-AC4D-17CE243ED949","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp4:*:*:*:*:*:*","matchCriteriaId":"62DC1612-368F-4D67-AA5E-E4719279DE4A","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp5:*:*:*:*:*:*","matchCriteriaId":"71E87389-289F-4FF6-928B-9A8E77387F65","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp6:*:*:*:*:*:*","matchCriteriaId":"E8772290-7B8F-4FF3-8114-0535E84E10F5","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_real_time:15.0:sp7:*:*:*:*:*:*","matchCriteriaId":"BF782A24-9E6B-4897-9402-37DBCA7A7332","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:-:-:*:*","matchCriteriaId":"A25FBA6E-EB0B-4FD3-A0CE-33CA9EB0CD62","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss:-:*:*","matchCriteriaId":"0E13E83D-4249-45C1-8025-491EECA6F9F3","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss_extreme_core:-:*:*","matchCriteriaId":"6BBDE786-4B07-4FD1-817F-948A19F97EE0","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:-:-:*:*","matchCriteriaId":"38373877-18C5-4CEB-A2F1-A6BCF63C1D79","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:-:sap:*:*","matchCriteriaId":"E279968E-C62B-4888-899A-2BF57E8F8692","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:espos:-:*:*","matchCriteriaId":"26CAA62D-796C-45E2-8797-64833C237D27","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:ltss:-:*:*","matchCriteriaId":"191B0B2D-5A5A-4206-B061-106C22C03C88","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:-:-:*:*","matchCriteriaId":"36E71D0E-6256-45D5-A0B8-518B3DB59718","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:ltss:-:*:*","matchCriteriaId":"FE4A9969-7684-44E0-AF88-437B6F5B2CAA","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:ltss_extended_security:-:*:*","matchCriteriaId":"1202065D-DE5A-4E7F-B01A-4D3915C5112A","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:-:-:*:*","matchCriteriaId":"60EF8A73-A078-49A9-8FDE-4B7F74B2E17B","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:-:sap:*:*","matchCriteriaId":"82A16781-8A1D-4FE4-84E8-19B6B8D5E6D0","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:business_critical_linux:-:*:*","matchCriteriaId":"26FDBC27-D993-4A93-BC70-753FA21F4C11","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:ltss:-:*:*","matchCriteriaId":"5BC409DF-47A5-4EAF-9DCA-9BA35BB1B2C5","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:-:-:*:*","matchCriteriaId":"2FAAE2BD-4063-4C24-B8C8-9638171A19B9","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:-:sap:*:*","matchCriteriaId":"1615874B-E07C-4DAB-9F48-34DA42915314","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:business_critical_linux:-:*:*","matchCriteriaId":"A256B5D1-49D2-4363-AAD6-30FD32F0D132","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:ltss:-:*:*","matchCriteriaId":"2AEA8A74-9D7D-410A-983E-7E69443DEA6B","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:-:-:*:*","matchCriteriaId":"F9771ADC-0560-4146-9CC2-690D3C3CE81F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:-:sap:*:*","matchCriteriaId":"76840252-04F1-43C4-9A59-676B179650E0","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:business_critical_linux:-:*:*","matchCriteriaId":"7456711B-C403-48FC-AD77-92D5177D3175","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:ltss:-:*:*","matchCriteriaId":"3BE8B253-3C09-48C8-BAE8-3E953AAFA49F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp4:*:*:-:-:*:*","matchCriteriaId":"9122256C-13F2-4322-95F1-9D83C9051A45","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp4:*:*:-:sap:*:*","matchCriteriaId":"CC23D242-B960-40D3-A395-174A1F270D4D","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp4:*:*:ltss:-:*:*","matchCriteriaId":"7053AA23-E12B-4B91-A641-724887F6A4DF","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp5:*:*:-:-:*:*","matchCriteriaId":"9E823F48-8554-4590-BC30-CA17ECAE9ED4","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp5:*:*:-:sap:*:*","matchCriteriaId":"0B02BB2D-5DB9-48DC-AB4F-B006D18234FA","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp5:*:*:ltss:-:*:*","matchCriteriaId":"8DFA6058-A5C9-4E87-9F34-B083E55A7EA3","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp6:*:*:-:-:*:*","matchCriteriaId":"BB84120C-48BB-4147-AAD3-39DEF003B57E","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp6:*:*:-:sap:*:*","matchCriteriaId":"8F9012DD-FFF8-4CED-AEA3-C22CB44C237F","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp6:*:*:ltss:-:*:*","matchCriteriaId":"B05BFB51-DBF6-4F71-83F8-C32BFB396404","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp7:*:*:-:-:*:*","matchCriteriaId":"CCE4946A-773A-443D-B5E3-839E637C3360","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:15:sp7:*:*:-:sap:*:*","matchCriteriaId":"C2F7F7D2-6E82-4FB4-8C44-3C7DEF123173","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:16.0:-:*:*:-:-:*:*","matchCriteriaId":"0F61E05F-DD0A-48AB-B7B2-8D84A5517FF2","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:16.0:-:*:*:-:sap:*:*","matchCriteriaId":"7DC085B3-7D3D-4FEB-B778-79FBDD87264A","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:16.1:-:*:*:-:-:*:*","matchCriteriaId":"09803492-7525-4B24-B34E-64BB9FF6FDBD","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_server:16.1:-:*:*:-:sap:*:*","matchCriteriaId":"56519853-7A3E-412C-A4F6-6921A1742033","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_enterprise_workstation_extension:15:sp7:*:*:*:*:*:*","matchCriteriaId":"12E15CF5-8517-4AE1-9130-4CFA65C2F7C2","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_micro:6.0:*:*:*:*:*:*:*","matchCriteriaId":"5A4E809C-2AAD-4E86-A5F4-AB41CA669F40","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_micro:6.1:*:*:*:*:*:*:*","matchCriteriaId":"9DC86A69-74D3-4745-BC7C-BBAF80B2BCBE","vulnerable":true},{"criteria":"cpe:2.3:o:suse:linux_micro:6.2:*:*:*:*:*:*:*","matchCriteriaId":"E9594AD7-3671-42D1-B07E-D8FE8782EDD7","vulnerable":true},{"criteria":"cpe:2.3:o:suse:public_cloud_module:15:sp6:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"CEB648DC-0111-443B-A728-2D9B01EBC179","vulnerable":true},{"criteria":"cpe:2.3:o:suse:public_cloud_module:15:sp7:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"6C09FB49-F594-4ECD-9686-4EDBC8BD1C1A","vulnerable":true},{"criteria":"cpe:2.3:o:suse:realtime_module:15:sp3:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"9C713704-CEB4-4F44-BD93-77F0586DC518","vulnerable":true},{"criteria":"cpe:2.3:o:suse:realtime_module:15:sp4:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"D7E2A9ED-6E69-46D7-85AC-2DB710AB7A84","vulnerable":true},{"criteria":"cpe:2.3:o:suse:realtime_module:15:sp5:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"6C4BB4DD-2022-479F-8805-70B37E2B224C","vulnerable":true},{"criteria":"cpe:2.3:o:suse:realtime_module:15:sp6:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"ACB1A9AF-E037-4FC1-8A35-E1D128005FA9","vulnerable":true},{"criteria":"cpe:2.3:o:suse:realtime_module:15:sp7:*:*:*:suse_linux_enterprise:*:*","matchCriteriaId":"DD298056-E8C4-4F7E-8CD5-784C201633D1","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:nixos:nixos:*:*:*:*:*:*:*:*","matchCriteriaId":"A1DAD7C2-EBFB-4DF5-A727-0A84F8F31619","versionEndExcluding":"25.11","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:arista:cloudvision_agni:*:*:*:*:*:-:*:*","matchCriteriaId":"A4C875E3-0FFA-4806-BA6C-EB2F8EBF76AF","versionEndIncluding":"2025.2.2","versionStartIncluding":"2024.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:arista:cloudvision_portal:*:*:*:*:*:*:*:*","matchCriteriaId":"0ADB58FD-7F44-4BA1-9A55-21E220B4FFDF","versionEndIncluding":"2026.1.0","versionStartIncluding":"2024.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:arista:velocloud_edge:*:*:*:*:*:*:*:*","matchCriteriaId":"1A9C5C40-C542-4320-9777-29A0F2D70220","versionEndIncluding":"6.4.1","versionStartIncluding":"4.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:arista:velocloud_gateway:-:*:*:*:*:*:*:*","matchCriteriaId":"88F2CE3D-1529-4A87-BD14-173BF206D7A9","vulnerable":true},{"criteria":"cpe:2.3:a:arista:velocloud_orchestrator:-:*:*:*:*:*:*:*","matchCriteriaId":"01F6A323-B165-4506-8573-8877F567FEBF","vulnerable":true},{"criteria":"cpe:2.3:o:arista:netvisor_os:*:*:*:*:*:*:*:*","matchCriteriaId":"A3349C40-C473-4744-AF72-AB6B0EBDB92F","versionEndExcluding":"7.1.0","vulnerable":true},{"criteria":"cpe:2.3:o:arista:netvisor_os:7.1.0:-:*:*:*:*:*:*","matchCriteriaId":"447BB72F-95B9-4F2E-8CDD-74664AD045ED","vulnerable":true},{"criteria":"cpe:2.3:o:arista:netvisor_os:7.1.0:hotfix7:*:*:*:*:*:*","matchCriteriaId":"82A2BB74-B148-44F1-904E-325E89720073","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\\/dp_mfp_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"99E36624-A573-47D9-B158-B18A8A822FBA","versionStartIncluding":"3.1.5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\\/dp_mfp:-:*:*:*:*:*:*:*","matchCriteriaId":"3BC4FA01-8DDB-41E4-B759-7B504F78AEBC","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"2A7548B8-3DF7-46D9-8A4F-87C38969D900","versionStartIncluding":"3.1.5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp:-:*:*:*:*:*:*:*","matchCriteriaId":"5B1EE93D-BAD2-4B86-910C-8784FCC9F398","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:siplus_s7-1500_cpu_1518-4_pn\\/dp_mfp_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"19F1C257-0EE6-47DE-B4BE-169F801FFDD8","versionStartIncluding":"3.1.5","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:siplus_s7-1500_cpu_1518-4_pn\\/dp_mfp:-:*:*:*:*:*:*:*","matchCriteriaId":"E2F63E0A-126D-4A93-8159-45EB5E606F81","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_s7-1500_tm_mfp_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"7F6C0262-1527-4F55-8BDE-973F59FE7E1B","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_s7-1500_tm_mfp:-:*:*:*:*:*:*:*","matchCriteriaId":"754051AB-27D3-41CA-B2C8-79BAD48C8750","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","matchCriteriaId":"B5A6F2F3-4894-4392-8296-3B8DD2679084","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","matchCriteriaId":"F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","matchCriteriaId":"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*","matchCriteriaId":"902B8056-9E37-443B-8905-8AA93E2447FB","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*","matchCriteriaId":"359012F1-2C63-415A-88B8-6726A87830DE","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*","matchCriteriaId":"BF90B5A4-6E55-4369-B9D4-E7A061E797D2","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:25.10:*:*:*:-:*:*:*","matchCriteriaId":"8998BFFF-82EF-4D9E-8DE5-0072064512BC","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_cn_4100_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"44E1D58D-9B5B-45AC-A0C6-4482168101A5","versionEndExcluding":"6.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_cn_4100:-:*:*:*:*:*:*:*","matchCriteriaId":"92619F5F-3679-4424-9455-3285FF1EF2F1","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:siemens:simatic_ax_runtime:-:*:*:*:*:*:*:*","matchCriteriaId":"A82943E5-24F0-4C90-BD86-5EA6DE90281B","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_hmi_unified_comfort_panels_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"79C16917-20D1-4D6A-BEA3-DCD19154C7EA","versionEndExcluding":"21.0","vulnerable":true},{"criteria":"cpe:2.3:o:siemens:simatic_hmi_unified_comfort_panels_firmware:21.0:-:*:*:*:*:*:*","matchCriteriaId":"958AADC1-00C2-4FBC-B437-2B90CD458622","vulnerable":true},{"criteria":"cpe:2.3:o:siemens:simatic_hmi_unified_comfort_panels_firmware:21.0:update_1:*:*:*:*:*:*","matchCriteriaId":"6F712A84-CCB0-4E44-B95D-A493D9854FB7","vulnerable":true},{"criteria":"cpe:2.3:o:siemens:simatic_hmi_unified_comfort_panels_firmware:21.0:update_2:*:*:*:*:*:*","matchCriteriaId":"C0D94F80-74EF-4FC7-8E0A-C2150B3F24D7","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_hmi_mtp1000:-:*:*:*:*:*:*:*","matchCriteriaId":"05E7DDAD-872F-4E93-8119-B5BBABC76CB4","vulnerable":false},{"criteria":"cpe:2.3:h:siemens:simatic_hmi_mtp1200:-:*:*:*:*:*:*:*","matchCriteriaId":"B390024E-F616-4996-A436-1FB4F150AA00","vulnerable":false},{"criteria":"cpe:2.3:h:siemens:simatic_hmi_mtp1500:-:*:*:*:*:*:*:*","matchCriteriaId":"643CDFBC-F073-453B-99BE-1B397183F7FB","vulnerable":false},{"criteria":"cpe:2.3:h:siemens:simatic_hmi_mtp1900:-:*:*:*:*:*:*:*","matchCriteriaId":"984BD668-AB96-4577-8389-86C5F1D37412","vulnerable":false},{"criteria":"cpe:2.3:h:siemens:simatic_hmi_mtp2200:-:*:*:*:*:*:*:*","matchCriteriaId":"379F5A4A-6ED3-4B3D-81E0-A8A851AF02A0","vulnerable":false},{"criteria":"cpe:2.3:h:siemens:simatic_hmi_mtp700:-:*:*:*:*:*:*:*","matchCriteriaId":"9F6513F2-E929-49D3-975A-035CD7DAAD91","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_iot2050_advanced_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F12F6619-B7B3-44AB-883D-D76887712EED","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:siemens:simatic_iot2050_advanced:-:*:*:*:*:*:*:*","matchCriteriaId":"DAA93FE9-C1BB-4A6D-A7EC-BA5D758A2A5B","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:siemens:simatic_ipc_ied-os:-:*:*:*:*:*:*:*","matchCriteriaId":"5C86210A-361D-492B-A83B-14BF959263BA","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: algif_aead - Revert to operating out-of-place\n\nThis mostly reverts commit 72548b093ee3 except for the copying of\nthe associated data.\n\nThere is no benefit in operating in-place in algif_aead since the\nsource and destination come from different mappings. Get rid of\nall the complexity added for in-place operation and just copy the\nAD directly."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: algif_aead - Revertir a operar out-of-place\n\nEsto revierte mayormente el commit 72548b093ee3 excepto por la copia de los datos asociados.\n\nNo hay beneficio en operar in-place en algif_aead ya que el origen y el destino provienen de mapeos diferentes. Eliminar toda la complejidad añadida para la operación in-place y simplemente copiar el AD directamente."}],"id":"CVE-2026-31431","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31431","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-29T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-04-22T09:16:21.270","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/19d43105a97be0810edbda875f2cd03f30dc130c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3115af9644c342b356f3f07a4dd1c8905cd9a6fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/893d22e0135fa394db81df88697fba6032747667"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8b88d99341f139e23bdeb1027a2a3ae10d341d82"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/961cfa271a918ad4ae452420e7c303149002875b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ce42ee423e58dffa5ec03524054c9d8bfd4f6237"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fafe0fa2995a0f7073c1c358d7d3145bcc9aedd8"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/29/23"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/29/25"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/29/26"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/10"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/11"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/14"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/15"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/16"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/17"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/18"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/20"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Patch"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/04/30/6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/10"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/15"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/16"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/17"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/18"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/22"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/23"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/24"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/01/3"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/14"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/15"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/16"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/17"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/18"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/19"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/20"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/21"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/23"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/24"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/25"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/4"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/7"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/02/8"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/10"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/3"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/4"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/03/6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/1"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/10"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/11"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/14"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/24"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/27"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/28"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/29"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/31"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/8"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/04/9"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/06/5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/07/12"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/07/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/08/13"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"url":"http://www.openwall.com/lists/oss-security/2026/05/18/3"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"url":"https://copy.fail"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://websec.net/blog/cve-2026-31431-linux-algifaead-page-cache-write-to-root-69f38a4ccddd2db1f520f170"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://www.kb.cert.org/vuls/id/260001"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13565"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13566"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13577"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13578"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13681"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13690"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13727"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13729"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13734"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13811"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13862"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13885"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13887"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13932"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:13936"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14097"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14112"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14137"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14165"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14230"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14301"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14339"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14773"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:14926"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:15087"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:15976"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:15978"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:16018"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:16063"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:16111"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:16208"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:16209"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:16210"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:19074"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:19225"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2026:33486"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2026-31431"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/cve-2026-31431#cve-details-mitigation"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Issue Tracking","Third Party Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460538"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":["Third Party Advisory"],"url":"https://cert-portal.siemens.com/productcert/html/ssa-328642.html"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit"],"url":"https://github.com/theori-io/copy-fail-CVE-2026-31431"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"],"url":"https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31431-3d65@gregkh/"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":["Third Party Advisory"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31431.json"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-31431"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Third Party Advisory"],"url":"https://xint.io/blog/copy-fail-linux-distributions#the-fix-6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-669"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-1288"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31432.json b/data/2026/CVE-2026-31432.json index 2f53ca5b8a..f181bfaeb0 100644 --- a/data/2026/CVE-2026-31432.json +++ b/data/2026/CVE-2026-31432.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c","fs/smb/server/smbacl.c","fs/smb/server/smbacl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"533f84264e28c54a79257ea87d2f94a0fcc9a611","status":"affected","version":"9f297df20d93411c0b4ddad7f88ba04a7cd36e77","versionType":"git"},{"lessThan":"850452af77f55d185f9445e1f7a1db53c5e4aad4","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"075ea208c648cc2bcd616295b711d3637c61de45","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"515c2daab46021221bdf406bef19bc90a44ec617","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"fda9522ed6afaec45cabc198d8492270c394c7bc","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"status":"affected","version":"f2283680a80571ca82d710bc6ecd8f8beac67d63","versionType":"git"},{"lessThan":"6.1.191","status":"affected","version":"6.1.71","versionType":"semver"},{"lessThan":"5.16","status":"affected","version":"5.15.145","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c","fs/smb/server/smbacl.c","fs/smb/server/smbacl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B98C9201-BF17-4E2C-84FF-75EE2AA94DC5","versionEndExcluding":"5.16","versionStartIncluding":"5.15.145","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"163E72B5-0F5D-49E2-AAEA-F11E02D730AD","versionEndExcluding":"6.2","versionStartIncluding":"6.1.71","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D467CA25-2A1E-475C-969E-62759720CE35","versionEndExcluding":"6.12.81","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix OOB write in QUERY_INFO for compound requests\n\nWhen a compound request such as READ + QUERY_INFO(Security) is received,\nand the first command (READ) consumes most of the response buffer,\nksmbd could write beyond the allocated buffer while building a security\ndescriptor.\n\nThe root cause was that smb2_get_info_sec() checked buffer space using\nppntsd_size from xattr, while build_sec_desc() often synthesized a\nsignificantly larger descriptor from POSIX ACLs.\n\nThis patch introduces smb_acl_sec_desc_scratch_len() to accurately\ncompute the final descriptor size beforehand, performs proper buffer\nchecking with smb2_calc_max_out_buf_len(), and uses exact-sized\nallocation + iov pinning."}],"id":"CVE-2026-31432","lastModified":"2026-10-30T13:18:39.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T09:16:21.410","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/075ea208c648cc2bcd616295b711d3637c61de45"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/515c2daab46021221bdf406bef19bc90a44ec617"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/533f84264e28c54a79257ea87d2f94a0fcc9a611"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/850452af77f55d185f9445e1f7a1db53c5e4aad4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fda9522ed6afaec45cabc198d8492270c394c7bc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c","fs/smb/server/smbacl.c","fs/smb/server/smbacl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"533f84264e28c54a79257ea87d2f94a0fcc9a611","status":"affected","version":"9f297df20d93411c0b4ddad7f88ba04a7cd36e77","versionType":"git"},{"lessThan":"850452af77f55d185f9445e1f7a1db53c5e4aad4","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"075ea208c648cc2bcd616295b711d3637c61de45","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"515c2daab46021221bdf406bef19bc90a44ec617","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"fda9522ed6afaec45cabc198d8492270c394c7bc","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"status":"affected","version":"f2283680a80571ca82d710bc6ecd8f8beac67d63","versionType":"git"},{"lessThan":"6.1.191","status":"affected","version":"6.1.71","versionType":"semver"},{"lessThan":"5.16","status":"affected","version":"5.15.145","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c","fs/smb/server/smbacl.c","fs/smb/server/smbacl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B98C9201-BF17-4E2C-84FF-75EE2AA94DC5","versionEndExcluding":"5.16","versionStartIncluding":"5.15.145","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"163E72B5-0F5D-49E2-AAEA-F11E02D730AD","versionEndExcluding":"6.2","versionStartIncluding":"6.1.71","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D467CA25-2A1E-475C-969E-62759720CE35","versionEndExcluding":"6.12.81","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix OOB write in QUERY_INFO for compound requests\n\nWhen a compound request such as READ + QUERY_INFO(Security) is received,\nand the first command (READ) consumes most of the response buffer,\nksmbd could write beyond the allocated buffer while building a security\ndescriptor.\n\nThe root cause was that smb2_get_info_sec() checked buffer space using\nppntsd_size from xattr, while build_sec_desc() often synthesized a\nsignificantly larger descriptor from POSIX ACLs.\n\nThis patch introduces smb_acl_sec_desc_scratch_len() to accurately\ncompute the final descriptor size beforehand, performs proper buffer\nchecking with smb2_calc_max_out_buf_len(), and uses exact-sized\nallocation + iov pinning."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: corrección de escritura fuera de límites en QUERY_INFO para solicitudes compuestas\n\nCuando se recibe una solicitud compuesta como READ + QUERY_INFO(Security), y el primer comando (READ) consume la mayor parte del búfer de respuesta, ksmbd podría escribir más allá del búfer asignado mientras construye un descriptor de seguridad.\n\nLa causa raíz fue que smb2_get_info_sec() verificaba el espacio del búfer usando ppntsd_size de xattr, mientras que build_sec_desc() a menudo sintetizaba un descriptor significativamente más grande a partir de ACL de POSIX.\n\nEste parche introduce smb_acl_sec_desc_scratch_len() para calcular con precisión el tamaño final del descriptor de antemano, realiza una verificación adecuada del búfer con smb2_calc_max_out_buf_len(), y utiliza asignación de tamaño exacto + fijación de iov."}],"id":"CVE-2026-31432","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T09:16:21.410","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/075ea208c648cc2bcd616295b711d3637c61de45"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/515c2daab46021221bdf406bef19bc90a44ec617"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/533f84264e28c54a79257ea87d2f94a0fcc9a611"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/850452af77f55d185f9445e1f7a1db53c5e4aad4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d48c64fb80ad78b3dd29fb7d79b6ec7bd72bfc09"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fda9522ed6afaec45cabc198d8492270c394c7bc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31433.json b/data/2026/CVE-2026-31433.json index 8ecc1fb056..34edcf8a69 100644 --- a/data/2026/CVE-2026-31433.json +++ b/data/2026/CVE-2026-31433.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7","status":"affected","version":"f2283680a80571ca82d710bc6ecd8f8beac67d63","versionType":"git"},{"lessThan":"4cca3eff2099b18672934a39cee70aed835d652c","status":"affected","version":"9f297df20d93411c0b4ddad7f88ba04a7cd36e77","versionType":"git"},{"lessThan":"358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"7aec5a769d2356cbf344d85bcfd36de592ac96a5","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"b0cd9725fe2bcc9f37d096b132318a9060373f5d","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"9d7032851d6f5adbe2739601ca456c0ad3b422f0","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"beef2634f81f1c086208191f7228bce1d366493d","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.145","versionType":"semver"},{"lessThan":"6.1.168","status":"affected","version":"6.1.71","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"120A3FBD-C86A-46F6-BD23-D862D4C6E574","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.145","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C6118D40-41D5-46EF-9C28-382159147BC9","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.71","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2DC0D2CD-6CF8-469A-B3F5-E48375FDA274","versionEndExcluding":"6.6.131","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix potencial OOB in get_file_all_info() for compound requests\n\nWhen a compound request consists of QUERY_DIRECTORY + QUERY_INFO\n(FILE_ALL_INFORMATION) and the first command consumes nearly the entire\nmax_trans_size, get_file_all_info() would blindly call smbConvertToUTF16()\nwith PATH_MAX, causing out-of-bounds write beyond the response buffer.\nIn get_file_all_info(), there was a missing validation check for\nthe client-provided OutputBufferLength before copying the filename into\nFileName field of the smb2_file_all_info structure.\nIf the filename length exceeds the available buffer space, it could lead to\npotential buffer overflows or memory corruption during smbConvertToUTF16\nconversion. This calculating the actual free buffer size using\nsmb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is\ninsufficient and updating smbConvertToUTF16 to use the actual filename\nlength (clamped by PATH_MAX) to ensure a safe copy operation."}],"id":"CVE-2026-31433","lastModified":"2026-06-17T10:33:42.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T09:16:21.573","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cca3eff2099b18672934a39cee70aed835d652c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7aec5a769d2356cbf344d85bcfd36de592ac96a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d7032851d6f5adbe2739601ca456c0ad3b422f0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b0cd9725fe2bcc9f37d096b132318a9060373f5d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/beef2634f81f1c086208191f7228bce1d366493d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7","status":"affected","version":"f2283680a80571ca82d710bc6ecd8f8beac67d63","versionType":"git"},{"lessThan":"4cca3eff2099b18672934a39cee70aed835d652c","status":"affected","version":"9f297df20d93411c0b4ddad7f88ba04a7cd36e77","versionType":"git"},{"lessThan":"358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"7aec5a769d2356cbf344d85bcfd36de592ac96a5","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"b0cd9725fe2bcc9f37d096b132318a9060373f5d","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"9d7032851d6f5adbe2739601ca456c0ad3b422f0","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"beef2634f81f1c086208191f7228bce1d366493d","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.145","versionType":"semver"},{"lessThan":"6.1.168","status":"affected","version":"6.1.71","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"120A3FBD-C86A-46F6-BD23-D862D4C6E574","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.145","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C6118D40-41D5-46EF-9C28-382159147BC9","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.71","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2DC0D2CD-6CF8-469A-B3F5-E48375FDA274","versionEndExcluding":"6.6.131","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix potencial OOB in get_file_all_info() for compound requests\n\nWhen a compound request consists of QUERY_DIRECTORY + QUERY_INFO\n(FILE_ALL_INFORMATION) and the first command consumes nearly the entire\nmax_trans_size, get_file_all_info() would blindly call smbConvertToUTF16()\nwith PATH_MAX, causing out-of-bounds write beyond the response buffer.\nIn get_file_all_info(), there was a missing validation check for\nthe client-provided OutputBufferLength before copying the filename into\nFileName field of the smb2_file_all_info structure.\nIf the filename length exceeds the available buffer space, it could lead to\npotential buffer overflows or memory corruption during smbConvertToUTF16\nconversion. This calculating the actual free buffer size using\nsmb2_calc_max_out_buf_len() and returning -EINVAL if the buffer is\ninsufficient and updating smbConvertToUTF16 to use the actual filename\nlength (clamped by PATH_MAX) to ensure a safe copy operation."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: corregir potencial OOB en get_file_all_info() para solicitudes compuestas\n\nCuando una solicitud compuesta consiste en QUERY_DIRECTORY + QUERY_INFO (FILE_ALL_INFORMATION) y el primer comando consume casi la totalidad de max_trans_size, get_file_all_info() llamaría ciegamente a smbConvertToUTF16() con PATH_MAX, causando una escritura fuera de límites más allá del búfer de respuesta. En get_file_all_info(), faltaba una verificación de validación para el OutputBufferLength proporcionado por el cliente antes de copiar el nombre de archivo en el campo FileName de la estructura smb2_file_all_info. Si la longitud del nombre de archivo excede el espacio de búfer disponible, podría conducir a potenciales desbordamientos de búfer o corrupción de memoria durante la conversión smbConvertToUTF16. Esto calculando el tamaño real del búfer libre usando smb2_calc_max_out_buf_len() y devolviendo -EINVAL si el búfer es insuficiente y actualizando smbConvertToUTF16 para usar la longitud real del nombre de archivo (limitada por PATH_MAX) para asegurar una operación de copia segura."}],"id":"CVE-2026-31433","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T09:16:21.573","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/358cdaa1f7fbf2712cb4c5f6b59cb9a5c673c5fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a852f9d1c981fb14f6bf4e24999e0ea8088a7d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cca3eff2099b18672934a39cee70aed835d652c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7aec5a769d2356cbf344d85bcfd36de592ac96a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d7032851d6f5adbe2739601ca456c0ad3b422f0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b0cd9725fe2bcc9f37d096b132318a9060373f5d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/beef2634f81f1c086208191f7228bce1d366493d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31434.json b/data/2026/CVE-2026-31434.json index dd64bfc29f..e05a67d6aa 100644 --- a/data/2026/CVE-2026-31434.json +++ b/data/2026/CVE-2026-31434.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/block-group.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"416484f21a9d1280cf6daa7ebc10c79b59c46e48","status":"affected","version":"64c7ddda83acfbaa0efb381a1928ce908c584607","versionType":"git"},{"lessThan":"94054ffd311a1f76b7093ba8ebf50bdb0d28337c","status":"affected","version":"0bd151ce4200ca847990e05cca29a76456982ca5","versionType":"git"},{"lessThan":"1737ddeafbb1304f41ec2eede4f7366082e7c96a","status":"affected","version":"190d5a7c4fe42b8c9aa46e3336389e7cb10395bb","versionType":"git"},{"lessThan":"3c844d01f9874a43004c82970d8da94f9aba8949","status":"affected","version":"f92ee31e031c7819126d2febdda0c3e91f5d2eb9","versionType":"git"},{"lessThan":"3c645c6f7e5470debbb81666b230056de48f36dc","status":"affected","version":"f92ee31e031c7819126d2febdda0c3e91f5d2eb9","versionType":"git"},{"lessThan":"a4376d9a5d4c9610e69def3fc0b32c86a7ab7a41","status":"affected","version":"f92ee31e031c7819126d2febdda0c3e91f5d2eb9","versionType":"git"},{"lessThan":"6.1.168","status":"affected","version":"6.1.162","versionType":"semver"},{"lessThan":"6.6.131","status":"affected","version":"6.6.122","versionType":"semver"},{"lessThan":"6.12.80","status":"affected","version":"6.12.67","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/block-group.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1C240D52-1BFC-4F7E-A81D-58DE5E627247","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.162","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"71FB4B35-54E8-40A0-98EF-342E1577E167","versionEndExcluding":"6.6.131","versionStartIncluding":"6.6.122","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E63FD44B-7F11-44F2-B10F-0F52157A6163","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.67","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A6CA36DA-3783-4321-81A6-485364836084","versionEndExcluding":"6.18.21","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix leak of kobject name for sub-group space_info\n\nWhen create_space_info_sub_group() allocates elements of\nspace_info->sub_group[], kobject_init_and_add() is called for each\nelement via btrfs_sysfs_add_space_info_type(). However, when\ncheck_removing_space_info() frees these elements, it does not call\nbtrfs_sysfs_remove_space_info() on them. As a result, kobject_put() is\nnot called and the associated kobj->name objects are leaked.\n\nThis memory leak is reproduced by running the blktests test case\nzbd/009 on kernels built with CONFIG_DEBUG_KMEMLEAK. The kmemleak\nfeature reports the following error:\n\nunreferenced object 0xffff888112877d40 (size 16):\n comm \"mount\", pid 1244, jiffies 4294996972\n hex dump (first 16 bytes):\n 64 61 74 61 2d 72 65 6c 6f 63 00 c4 c6 a7 cb 7f data-reloc......\n backtrace (crc 53ffde4d):\n __kmalloc_node_track_caller_noprof+0x619/0x870\n kstrdup+0x42/0xc0\n kobject_set_name_vargs+0x44/0x110\n kobject_init_and_add+0xcf/0x150\n btrfs_sysfs_add_space_info_type+0xfc/0x210 [btrfs]\n create_space_info_sub_group.constprop.0+0xfb/0x1b0 [btrfs]\n create_space_info+0x211/0x320 [btrfs]\n btrfs_init_space_info+0x15a/0x1b0 [btrfs]\n open_ctree+0x33c7/0x4a50 [btrfs]\n btrfs_get_tree.cold+0x9f/0x1ee [btrfs]\n vfs_get_tree+0x87/0x2f0\n vfs_cmd_create+0xbd/0x280\n __do_sys_fsconfig+0x3df/0x990\n do_syscall_64+0x136/0x1540\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nTo avoid the leak, call btrfs_sysfs_remove_space_info() instead of\nkfree() for the elements."}],"id":"CVE-2026-31434","lastModified":"2026-06-17T10:33:42.890","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:36.533","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1737ddeafbb1304f41ec2eede4f7366082e7c96a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c645c6f7e5470debbb81666b230056de48f36dc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c844d01f9874a43004c82970d8da94f9aba8949"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/416484f21a9d1280cf6daa7ebc10c79b59c46e48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/94054ffd311a1f76b7093ba8ebf50bdb0d28337c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a4376d9a5d4c9610e69def3fc0b32c86a7ab7a41"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/block-group.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"416484f21a9d1280cf6daa7ebc10c79b59c46e48","status":"affected","version":"64c7ddda83acfbaa0efb381a1928ce908c584607","versionType":"git"},{"lessThan":"94054ffd311a1f76b7093ba8ebf50bdb0d28337c","status":"affected","version":"0bd151ce4200ca847990e05cca29a76456982ca5","versionType":"git"},{"lessThan":"1737ddeafbb1304f41ec2eede4f7366082e7c96a","status":"affected","version":"190d5a7c4fe42b8c9aa46e3336389e7cb10395bb","versionType":"git"},{"lessThan":"3c844d01f9874a43004c82970d8da94f9aba8949","status":"affected","version":"f92ee31e031c7819126d2febdda0c3e91f5d2eb9","versionType":"git"},{"lessThan":"3c645c6f7e5470debbb81666b230056de48f36dc","status":"affected","version":"f92ee31e031c7819126d2febdda0c3e91f5d2eb9","versionType":"git"},{"lessThan":"a4376d9a5d4c9610e69def3fc0b32c86a7ab7a41","status":"affected","version":"f92ee31e031c7819126d2febdda0c3e91f5d2eb9","versionType":"git"},{"lessThan":"6.1.168","status":"affected","version":"6.1.162","versionType":"semver"},{"lessThan":"6.6.131","status":"affected","version":"6.6.122","versionType":"semver"},{"lessThan":"6.12.80","status":"affected","version":"6.12.67","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/block-group.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1C240D52-1BFC-4F7E-A81D-58DE5E627247","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.162","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"71FB4B35-54E8-40A0-98EF-342E1577E167","versionEndExcluding":"6.6.131","versionStartIncluding":"6.6.122","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E63FD44B-7F11-44F2-B10F-0F52157A6163","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.67","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A6CA36DA-3783-4321-81A6-485364836084","versionEndExcluding":"6.18.21","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix leak of kobject name for sub-group space_info\n\nWhen create_space_info_sub_group() allocates elements of\nspace_info->sub_group[], kobject_init_and_add() is called for each\nelement via btrfs_sysfs_add_space_info_type(). However, when\ncheck_removing_space_info() frees these elements, it does not call\nbtrfs_sysfs_remove_space_info() on them. As a result, kobject_put() is\nnot called and the associated kobj->name objects are leaked.\n\nThis memory leak is reproduced by running the blktests test case\nzbd/009 on kernels built with CONFIG_DEBUG_KMEMLEAK. The kmemleak\nfeature reports the following error:\n\nunreferenced object 0xffff888112877d40 (size 16):\n comm \"mount\", pid 1244, jiffies 4294996972\n hex dump (first 16 bytes):\n 64 61 74 61 2d 72 65 6c 6f 63 00 c4 c6 a7 cb 7f data-reloc......\n backtrace (crc 53ffde4d):\n __kmalloc_node_track_caller_noprof+0x619/0x870\n kstrdup+0x42/0xc0\n kobject_set_name_vargs+0x44/0x110\n kobject_init_and_add+0xcf/0x150\n btrfs_sysfs_add_space_info_type+0xfc/0x210 [btrfs]\n create_space_info_sub_group.constprop.0+0xfb/0x1b0 [btrfs]\n create_space_info+0x211/0x320 [btrfs]\n btrfs_init_space_info+0x15a/0x1b0 [btrfs]\n open_ctree+0x33c7/0x4a50 [btrfs]\n btrfs_get_tree.cold+0x9f/0x1ee [btrfs]\n vfs_get_tree+0x87/0x2f0\n vfs_cmd_create+0xbd/0x280\n __do_sys_fsconfig+0x3df/0x990\n do_syscall_64+0x136/0x1540\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nTo avoid the leak, call btrfs_sysfs_remove_space_info() instead of\nkfree() for the elements."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbtrfs: corrige la fuga de nombre de kobject para subgrupo space_info\n\nCuando create_space_info_sub_group() asigna elementos de space_info -> sub_group[], se llama a kobject_init_and_add() para cada elemento a través de btrfs_sysfs_add_space_info_type(). Sin embargo, cuando check_removing_space_info() libera estos elementos, no llama a btrfs_sysfs_remove_space_info() sobre ellos. Como resultado, no se llama a kobject_put() y los objetos kobj -> name asociados se fugan.\n\nEsta fuga de memoria se reproduce ejecutando el caso de prueba blktests zbd/009 en kernels compilados con CONFIG_DEBUG_KMEMLEAK. La característica kmemleak informa el siguiente error:\n\nobjeto sin referencia 0x ffff888112877d40 (tamaño 16):\n comm ’mount’, pid 1244, jiffies 4294996972\n volcado hexadecimal (primeros 16 bytes):\n 64 61 74 61 2d 72 65 6c 6f 63 00 c4 c6 a7 cb 7f data-reloc......\n rastreo (crc 53ffde4d):\n __kmalloc_node_track_caller_noprof+0x619/0x870\n kstrdup+0x42/0xc0\n kobject_set_name_vargs+0x44/0x110\n kobject_init_and_add+0xcf/0x150\n btrfs_sysfs_add_space_info_type+0xfc/0x210 [btrfs]\n create_space_info_sub_group.constprop.0+0xfb/0x1b0 [btrfs]\n create_space_info+0x211/0x320 [btrfs]\n btrfs_init_space_info+0x15a/0x1b0 [btrfs]\n open_ctree+0x 33c7/0x 4a50 [btrfs]\n btrfs_get_tree.cold+0x9f/0x1ee [btrfs]\n vfs_get_tree+0x87/0x2f0\n vfs_cmd_create+0xbd/0x280\n __do_sys_fsconfig+0x3df/0x990\n do_syscall_64+0x136/0x 1540\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nPara evitar la fuga, llame a btrfs_sysfs_remove_space_info() en lugar de kfree() para los elementos."}],"id":"CVE-2026-31434","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:36.533","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1737ddeafbb1304f41ec2eede4f7366082e7c96a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c645c6f7e5470debbb81666b230056de48f36dc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c844d01f9874a43004c82970d8da94f9aba8949"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/416484f21a9d1280cf6daa7ebc10c79b59c46e48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/94054ffd311a1f76b7093ba8ebf50bdb0d28337c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a4376d9a5d4c9610e69def3fc0b32c86a7ab7a41"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31435.json b/data/2026/CVE-2026-31435.json index ec02f78d01..c54b99aac1 100644 --- a/data/2026/CVE-2026-31435.json +++ b/data/2026/CVE-2026-31435.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/read_retry.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3e5fd8f53b575ff2188f82071da19c977ca56c41","status":"affected","version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","versionType":"git"},{"lessThan":"8f2f2bd128a8d9edbc1e785760da54ada3df69b7","status":"affected","version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","versionType":"git"},{"lessThan":"7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","status":"affected","version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/netfs/read_retry.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"93477C16-86F4-42D8-A83F-3E95FF0B26F8","versionEndExcluding":"6.18.21","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix read abandonment during retry\n\nUnder certain circumstances, all the remaining subrequests from a read\nrequest will get abandoned during retry. The abandonment process expects\nthe 'subreq' variable to be set to the place to start abandonment from, but\nit doesn't always have a useful value (it will be uninitialised on the\nfirst pass through the loop and it may point to a deleted subrequest on\nlater passes).\n\nFix the first jump to \"abandon:\" to set subreq to the start of the first\nsubrequest expected to need retry (which, in this abandonment case, turned\nout unexpectedly to no longer have NEED_RETRY set).\n\nAlso clear the subreq pointer after discarding superfluous retryable\nsubrequests to cause an oops if we do try to access it."}],"id":"CVE-2026-31435","lastModified":"2026-10-19T19:17:53.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31435","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:13.729814Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:36.710","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3e5fd8f53b575ff2188f82071da19c977ca56c41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f2f2bd128a8d9edbc1e785760da54ada3df69b7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-457"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/read_retry.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3e5fd8f53b575ff2188f82071da19c977ca56c41","status":"affected","version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","versionType":"git"},{"lessThan":"8f2f2bd128a8d9edbc1e785760da54ada3df69b7","status":"affected","version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","versionType":"git"},{"lessThan":"7e57523490cd2efb52b1ea97f2e0a74c0fb634cd","status":"affected","version":"ee4cdf7ba857a894ad1650d6ab77669cbbfa329e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/netfs/read_retry.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"93477C16-86F4-42D8-A83F-3E95FF0B26F8","versionEndExcluding":"6.18.21","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix read abandonment during retry\n\nUnder certain circumstances, all the remaining subrequests from a read\nrequest will get abandoned during retry. The abandonment process expects\nthe 'subreq' variable to be set to the place to start abandonment from, but\nit doesn't always have a useful value (it will be uninitialised on the\nfirst pass through the loop and it may point to a deleted subrequest on\nlater passes).\n\nFix the first jump to \"abandon:\" to set subreq to the start of the first\nsubrequest expected to need retry (which, in this abandonment case, turned\nout unexpectedly to no longer have NEED_RETRY set).\n\nAlso clear the subreq pointer after discarding superfluous retryable\nsubrequests to cause an oops if we do try to access it."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfs: Corrige el abandono de lectura durante el reintento\n\nBajo ciertas circunstancias, todas las subpeticiones restantes de una petición de lectura serán abandonadas durante el reintento. El proceso de abandono espera que la variable ’subreq’ esté configurada en el lugar desde donde iniciar el abandono, pero no siempre tiene un valor útil (estará sin inicializar en la primera pasada por el bucle y puede apuntar a una subpetición eliminada en pasadas posteriores).\n\nCorrige el primer salto a “abandon:” para establecer subreq al inicio de la primera subpetición que se espera que necesite reintento (la cual, en este caso de abandono, resultó inesperadamente no tener ya NEED_RETRY establecido).\n\nTambién borra el puntero subreq después de descartar subpeticiones reintentables superfluas para causar un oops si intentamos acceder a él."}],"id":"CVE-2026-31435","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31435","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:13.729814Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:36.710","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3e5fd8f53b575ff2188f82071da19c977ca56c41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e57523490cd2efb52b1ea97f2e0a74c0fb634cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f2f2bd128a8d9edbc1e785760da54ada3df69b7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-457"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31436.json b/data/2026/CVE-2026-31436.json index 0fd46bb9ad..115ad7d414 100644 --- a/data/2026/CVE-2026-31436.json +++ b/data/2026/CVE-2026-31436.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/submit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e21da2ad8844585040fe4b82be1ad2fe99d40074","status":"affected","version":"aa8d18becc0c14aa3eb46d6d1b81450446e11b87","versionType":"git"},{"lessThan":"82656e8daf8de00935ae91b91bed43f4d6e0d644","status":"affected","version":"aa8d18becc0c14aa3eb46d6d1b81450446e11b87","versionType":"git"},{"lessThan":"0e4f43779d550e559be13a5cdb763bad92c4cc99","status":"affected","version":"aa8d18becc0c14aa3eb46d6d1b81450446e11b87","versionType":"git"},{"lessThan":"e1c9866173c5f8521f2d0768547a01508cb9ff27","status":"affected","version":"aa8d18becc0c14aa3eb46d6d1b81450446e11b87","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/submit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F1E59CA7-28C1-4587-BC4E-7056631D9864","versionEndExcluding":"6.12.80","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()\n\nAt the end of this function, d is the traversal cursor of flist, but the\ncode completes found instead. This can lead to issues such as NULL pointer\ndereferences, double completion, or descriptor leaks.\n\nFix this by completing d instead of found in the final\nlist_for_each_entry_safe() loop."}],"id":"CVE-2026-31436","lastModified":"2026-10-19T19:17:53.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31436","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:16.062641Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:36.843","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e4f43779d550e559be13a5cdb763bad92c4cc99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/82656e8daf8de00935ae91b91bed43f4d6e0d644"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e1c9866173c5f8521f2d0768547a01508cb9ff27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e21da2ad8844585040fe4b82be1ad2fe99d40074"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-758"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/submit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e21da2ad8844585040fe4b82be1ad2fe99d40074","status":"affected","version":"aa8d18becc0c14aa3eb46d6d1b81450446e11b87","versionType":"git"},{"lessThan":"82656e8daf8de00935ae91b91bed43f4d6e0d644","status":"affected","version":"aa8d18becc0c14aa3eb46d6d1b81450446e11b87","versionType":"git"},{"lessThan":"0e4f43779d550e559be13a5cdb763bad92c4cc99","status":"affected","version":"aa8d18becc0c14aa3eb46d6d1b81450446e11b87","versionType":"git"},{"lessThan":"e1c9866173c5f8521f2d0768547a01508cb9ff27","status":"affected","version":"aa8d18becc0c14aa3eb46d6d1b81450446e11b87","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/submit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F1E59CA7-28C1-4587-BC4E-7056631D9864","versionEndExcluding":"6.12.80","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()\n\nAt the end of this function, d is the traversal cursor of flist, but the\ncode completes found instead. This can lead to issues such as NULL pointer\ndereferences, double completion, or descriptor leaks.\n\nFix this by completing d instead of found in the final\nlist_for_each_entry_safe() loop."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndmaengine: idxd: corrige la posible finalización incorrecta del descriptor en llist_abort_desc()\n\nAl final de esta función, d es el cursor de recorrido de flist, pero el código completa found en su lugar. Esto puede llevar a problemas como desreferencias de puntero NULL, doble finalización o fugas de descriptores.\n\nSolucione esto completando d en lugar de found en el bucle final list_for_each_entry_safe()."}],"id":"CVE-2026-31436","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31436","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:16.062641Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:36.843","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e4f43779d550e559be13a5cdb763bad92c4cc99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/82656e8daf8de00935ae91b91bed43f4d6e0d644"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e1c9866173c5f8521f2d0768547a01508cb9ff27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e21da2ad8844585040fe4b82be1ad2fe99d40074"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-758"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31437.json b/data/2026/CVE-2026-31437.json index 8e96cde924..ac2a4229ec 100644 --- a/data/2026/CVE-2026-31437.json +++ b/data/2026/CVE-2026-31437.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/direct_write.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a4d1b4ba9754bac3efebd06f583a44a7af52c0ab","status":"affected","version":"72d08d2839649d1c5efbe375751f4473fa4486af","versionType":"git"},{"lessThan":"7a5482f5ce891decbf36f2e6fab1e9fc4a76a684","status":"affected","version":"0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0","versionType":"git"},{"lessThan":"e9075e420a1eb3b52c60f3b95893a55e77419ce8","status":"affected","version":"a0b4c7a49137ed21279f354eb59f49ddae8dffc2","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/direct_write.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.21","status":"affected","version":"6.18.17","versionType":"semver"},{"lessThan":"6.19.11","status":"affected","version":"6.19.7","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3EF23CE5-8E2E-47D1-9B2C-449AA5BB1870","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0F154E5F-DF7A-4EB9-BAFA-13EC093D679A","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry\n\nWhen a write subrequest is marked NETFS_SREQ_NEED_RETRY, the retry path\nin netfs_unbuffered_write() unconditionally calls stream->prepare_write()\nwithout checking if it is NULL.\n\nFilesystems such as 9P do not set the prepare_write operation, so\nstream->prepare_write remains NULL. When get_user_pages() fails with\n-EFAULT and the subrequest is flagged for retry, this results in a NULL\npointer dereference at fs/netfs/direct_write.c:189.\n\nFix this by mirroring the pattern already used in write_retry.c: if\nstream->prepare_write is NULL, skip renegotiation and directly reissue\nthe subrequest via netfs_reissue_write(), which handles iterator reset,\nIN_PROGRESS flag, stats update and reissue internally."}],"id":"CVE-2026-31437","lastModified":"2026-06-17T10:33:43.237","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:36.980","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7a5482f5ce891decbf36f2e6fab1e9fc4a76a684"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a4d1b4ba9754bac3efebd06f583a44a7af52c0ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e9075e420a1eb3b52c60f3b95893a55e77419ce8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/direct_write.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a4d1b4ba9754bac3efebd06f583a44a7af52c0ab","status":"affected","version":"72d08d2839649d1c5efbe375751f4473fa4486af","versionType":"git"},{"lessThan":"7a5482f5ce891decbf36f2e6fab1e9fc4a76a684","status":"affected","version":"0c29f6d63122a0168d67cb8ecde5b4cf7fe4acb0","versionType":"git"},{"lessThan":"e9075e420a1eb3b52c60f3b95893a55e77419ce8","status":"affected","version":"a0b4c7a49137ed21279f354eb59f49ddae8dffc2","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/direct_write.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.18.21","status":"affected","version":"6.18.17","versionType":"semver"},{"lessThan":"6.19.11","status":"affected","version":"6.19.7","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3EF23CE5-8E2E-47D1-9B2C-449AA5BB1870","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0F154E5F-DF7A-4EB9-BAFA-13EC093D679A","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry\n\nWhen a write subrequest is marked NETFS_SREQ_NEED_RETRY, the retry path\nin netfs_unbuffered_write() unconditionally calls stream->prepare_write()\nwithout checking if it is NULL.\n\nFilesystems such as 9P do not set the prepare_write operation, so\nstream->prepare_write remains NULL. When get_user_pages() fails with\n-EFAULT and the subrequest is flagged for retry, this results in a NULL\npointer dereference at fs/netfs/direct_write.c:189.\n\nFix this by mirroring the pattern already used in write_retry.c: if\nstream->prepare_write is NULL, skip renegotiation and directly reissue\nthe subrequest via netfs_reissue_write(), which handles iterator reset,\nIN_PROGRESS flag, stats update and reissue internally."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfs: Corrección de desreferencia de puntero NULL en netfs_unbuffered_write() al reintentar\n\nCuando una subsolicitud de escritura se marca como NETFS_SREQ_NEED_RETRY, la ruta de reintento en netfs_unbuffered_write() llama incondicionalmente a stream -> prepare_write() sin comprobar si es NULL.\n\nSistemas de archivos como 9P no establecen la operación prepare_write, por lo que stream -> prepare_write permanece NULL. Cuando get_user_pages() falla con -EFAULT y la subsolicitud se marca para reintento, esto resulta en una desreferencia de puntero NULL en fs/netfs/direct_write.c:189.\n\nEsto se corrige replicando el patrón ya utilizado en write_retry.c: si stream -> prepare_write es NULL, se omite la renegociación y se reemite directamente la subsolicitud a través de netfs_reissue_write(), que maneja internamente el reinicio del iterador, el indicador IN_PROGRESS, la actualización de estadísticas y la reemisión."}],"id":"CVE-2026-31437","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:36.980","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7a5482f5ce891decbf36f2e6fab1e9fc4a76a684"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a4d1b4ba9754bac3efebd06f583a44a7af52c0ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e9075e420a1eb3b52c60f3b95893a55e77419ce8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31438.json b/data/2026/CVE-2026-31438.json index 31718dc5ee..6f3641ddbc 100644 --- a/data/2026/CVE-2026-31438.json +++ b/data/2026/CVE-2026-31438.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/iterator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"18c2e20b42dd21db599e42d05ddaeeb647b2bb6d","status":"affected","version":"cae932d3aee55035a54415dcea8e7ecf2ec469b5","versionType":"git"},{"lessThan":"4bc2d72c7695cedf6d4e1a558924903c2b28a78e","status":"affected","version":"cae932d3aee55035a54415dcea8e7ecf2ec469b5","versionType":"git"},{"lessThan":"00d6df7115f6972370974212de9088087820802e","status":"affected","version":"cae932d3aee55035a54415dcea8e7ecf2ec469b5","versionType":"git"},{"lessThan":"67e467a11f62ff64ad219dc6aa5459e132c79d14","status":"affected","version":"cae932d3aee55035a54415dcea8e7ecf2ec469b5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/netfs/iterator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F1E59CA7-28C1-4587-BC4E-7056631D9864","versionEndExcluding":"6.12.80","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators\n\nWhen a process crashes and the kernel writes a core dump to a 9P\nfilesystem, __kernel_write() creates an ITER_KVEC iterator. This\niterator reaches netfs_limit_iter() via netfs_unbuffered_write(), which\nonly handles ITER_FOLIOQ, ITER_BVEC and ITER_XARRAY iterator types,\nhitting the BUG() for any other type.\n\nFix this by adding netfs_limit_kvec() following the same pattern as\nnetfs_limit_bvec(), since both kvec and bvec are simple segment arrays\nwith pointer and length fields. Dispatch it from netfs_limit_iter() when\nthe iterator type is ITER_KVEC."}],"id":"CVE-2026-31438","lastModified":"2026-11-05T22:18:31.410","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31438","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:22.454848Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:37.100","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/00d6df7115f6972370974212de9088087820802e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/18c2e20b42dd21db599e42d05ddaeeb647b2bb6d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4bc2d72c7695cedf6d4e1a558924903c2b28a78e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67e467a11f62ff64ad219dc6aa5459e132c79d14"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/netfs/iterator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"18c2e20b42dd21db599e42d05ddaeeb647b2bb6d","status":"affected","version":"cae932d3aee55035a54415dcea8e7ecf2ec469b5","versionType":"git"},{"lessThan":"4bc2d72c7695cedf6d4e1a558924903c2b28a78e","status":"affected","version":"cae932d3aee55035a54415dcea8e7ecf2ec469b5","versionType":"git"},{"lessThan":"00d6df7115f6972370974212de9088087820802e","status":"affected","version":"cae932d3aee55035a54415dcea8e7ecf2ec469b5","versionType":"git"},{"lessThan":"67e467a11f62ff64ad219dc6aa5459e132c79d14","status":"affected","version":"cae932d3aee55035a54415dcea8e7ecf2ec469b5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/netfs/iterator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F1E59CA7-28C1-4587-BC4E-7056631D9864","versionEndExcluding":"6.12.80","versionStartIncluding":"6.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators\n\nWhen a process crashes and the kernel writes a core dump to a 9P\nfilesystem, __kernel_write() creates an ITER_KVEC iterator. This\niterator reaches netfs_limit_iter() via netfs_unbuffered_write(), which\nonly handles ITER_FOLIOQ, ITER_BVEC and ITER_XARRAY iterator types,\nhitting the BUG() for any other type.\n\nFix this by adding netfs_limit_kvec() following the same pattern as\nnetfs_limit_bvec(), since both kvec and bvec are simple segment arrays\nwith pointer and length fields. Dispatch it from netfs_limit_iter() when\nthe iterator type is ITER_KVEC."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfs: Corrige un BUG del kernel en netfs_limit_iter() para iteradores ITER_KVEC\n\nCuando un proceso falla y el kernel escribe un volcado de memoria en un sistema de archivos 9P, __kernel_write() crea un iterador ITER_KVEC. Este iterador llega a netfs_limit_iter() a través de netfs_unbuffered_write(), que solo maneja los tipos de iterador ITER_FOLIOQ, ITER_BVEC e ITER_XARRAY, alcanzando el BUG() para cualquier otro tipo.\n\nSoluciona esto añadiendo netfs_limit_kvec() siguiendo el mismo patrón que netfs_limit_bvec(), ya que tanto kvec como bvec son matrices de segmentos simples con campos de puntero y longitud. Despáchalo desde netfs_limit_iter() cuando el tipo de iterador sea ITER_KVEC."}],"id":"CVE-2026-31438","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31438","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:22.454848Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:37.100","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/00d6df7115f6972370974212de9088087820802e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/18c2e20b42dd21db599e42d05ddaeeb647b2bb6d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4bc2d72c7695cedf6d4e1a558924903c2b28a78e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67e467a11f62ff64ad219dc6aa5459e132c79d14"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31439.json b/data/2026/CVE-2026-31439.json index 7145829315..5ea25aea23 100644 --- a/data/2026/CVE-2026-31439.json +++ b/data/2026/CVE-2026-31439.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/xilinx/xdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4b6e1da50b22e5528b9003f376a3cecccce4decc","status":"affected","version":"17ce252266c7f016ece026492c45838f852ddc79","versionType":"git"},{"lessThan":"9787b3d9b908785b40bc3f2e6d7082fdb8fdd98a","status":"affected","version":"17ce252266c7f016ece026492c45838f852ddc79","versionType":"git"},{"lessThan":"f27197ccfd2ecd2c71f27fd57c6d507e892ad24d","status":"affected","version":"17ce252266c7f016ece026492c45838f852ddc79","versionType":"git"},{"lessThan":"59f6ccd0f3345be2e8a78bdef2103e93f180633a","status":"affected","version":"17ce252266c7f016ece026492c45838f852ddc79","versionType":"git"},{"lessThan":"e0adbf74e2a0455a6bc9628726ba87bcd0b42bf8","status":"affected","version":"17ce252266c7f016ece026492c45838f852ddc79","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/xilinx/xdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.3"},{"lessThan":"6.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"858A62AF-CE08-40A8-B117-168DE9269127","versionEndExcluding":"6.6.131","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: xilinx: xdma: Fix regmap init error handling\n\ndevm_regmap_init_mmio returns an ERR_PTR() upon error, not NULL.\nFix the error check and also fix the error message. Use the error code\nfrom ERR_PTR() instead of the wrong value in ret."}],"id":"CVE-2026-31439","lastModified":"2026-06-17T10:33:43.437","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:37.240","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b6e1da50b22e5528b9003f376a3cecccce4decc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/59f6ccd0f3345be2e8a78bdef2103e93f180633a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9787b3d9b908785b40bc3f2e6d7082fdb8fdd98a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0adbf74e2a0455a6bc9628726ba87bcd0b42bf8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f27197ccfd2ecd2c71f27fd57c6d507e892ad24d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/xilinx/xdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4b6e1da50b22e5528b9003f376a3cecccce4decc","status":"affected","version":"17ce252266c7f016ece026492c45838f852ddc79","versionType":"git"},{"lessThan":"9787b3d9b908785b40bc3f2e6d7082fdb8fdd98a","status":"affected","version":"17ce252266c7f016ece026492c45838f852ddc79","versionType":"git"},{"lessThan":"f27197ccfd2ecd2c71f27fd57c6d507e892ad24d","status":"affected","version":"17ce252266c7f016ece026492c45838f852ddc79","versionType":"git"},{"lessThan":"59f6ccd0f3345be2e8a78bdef2103e93f180633a","status":"affected","version":"17ce252266c7f016ece026492c45838f852ddc79","versionType":"git"},{"lessThan":"e0adbf74e2a0455a6bc9628726ba87bcd0b42bf8","status":"affected","version":"17ce252266c7f016ece026492c45838f852ddc79","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/xilinx/xdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.3"},{"lessThan":"6.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"858A62AF-CE08-40A8-B117-168DE9269127","versionEndExcluding":"6.6.131","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: xilinx: xdma: Fix regmap init error handling\n\ndevm_regmap_init_mmio returns an ERR_PTR() upon error, not NULL.\nFix the error check and also fix the error message. Use the error code\nfrom ERR_PTR() instead of the wrong value in ret."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndmaengine: xilinx: xdma: Corrección del manejo de errores de inicialización de regmap\n\ndevm_regmap_init_mmio devuelve un ERR_PTR() en caso de error, no NULL.\nCorrige la comprobación de errores y también el mensaje de error. Utiliza el código de error de ERR_PTR() en lugar del valor incorrecto en ret."}],"id":"CVE-2026-31439","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:37.240","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b6e1da50b22e5528b9003f376a3cecccce4decc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/59f6ccd0f3345be2e8a78bdef2103e93f180633a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9787b3d9b908785b40bc3f2e6d7082fdb8fdd98a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0adbf74e2a0455a6bc9628726ba87bcd0b42bf8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f27197ccfd2ecd2c71f27fd57c6d507e892ad24d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31440.json b/data/2026/CVE-2026-31440.json index a8db561587..024b663694 100644 --- a/data/2026/CVE-2026-31440.json +++ b/data/2026/CVE-2026-31440.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"695b491dc3f20365fd5821f22e25dbe3c1c20cbc","status":"affected","version":"244da66cda359227d80ccb41dbcb99da40eae186","versionType":"git"},{"lessThan":"d94f9b0ba28a205caf95902ee88b42bdb8af83d0","status":"affected","version":"244da66cda359227d80ccb41dbcb99da40eae186","versionType":"git"},{"lessThan":"facd0012708e942fc12890708738aebde497564e","status":"affected","version":"244da66cda359227d80ccb41dbcb99da40eae186","versionType":"git"},{"lessThan":"9dfa00967e6ef43a9dd0887fe5c3a721a39da92e","status":"affected","version":"244da66cda359227d80ccb41dbcb99da40eae186","versionType":"git"},{"lessThan":"ee66bc29578391c9b48523dc9119af67bd5c7c0f","status":"affected","version":"244da66cda359227d80ccb41dbcb99da40eae186","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2F36D808-4779-4F06-832E-00E88B607F3C","versionEndExcluding":"6.12.80","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix leaking event log memory\n\nDuring the device remove process, the device is reset, causing the\nconfiguration registers to go back to their default state, which is\nzero. As the driver is checking if the event log support was enabled\nbefore deallocating, it will fail if a reset happened before.\n\nDo not check if the support was enabled, the check for 'idxd->evl'\nbeing valid (only allocated if the HW capability is available) is\nenough."}],"id":"CVE-2026-31440","lastModified":"2026-11-05T22:18:31.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31440","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:27.403110Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:37.390","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/695b491dc3f20365fd5821f22e25dbe3c1c20cbc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9dfa00967e6ef43a9dd0887fe5c3a721a39da92e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d94f9b0ba28a205caf95902ee88b42bdb8af83d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee66bc29578391c9b48523dc9119af67bd5c7c0f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/facd0012708e942fc12890708738aebde497564e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"695b491dc3f20365fd5821f22e25dbe3c1c20cbc","status":"affected","version":"244da66cda359227d80ccb41dbcb99da40eae186","versionType":"git"},{"lessThan":"d94f9b0ba28a205caf95902ee88b42bdb8af83d0","status":"affected","version":"244da66cda359227d80ccb41dbcb99da40eae186","versionType":"git"},{"lessThan":"facd0012708e942fc12890708738aebde497564e","status":"affected","version":"244da66cda359227d80ccb41dbcb99da40eae186","versionType":"git"},{"lessThan":"9dfa00967e6ef43a9dd0887fe5c3a721a39da92e","status":"affected","version":"244da66cda359227d80ccb41dbcb99da40eae186","versionType":"git"},{"lessThan":"ee66bc29578391c9b48523dc9119af67bd5c7c0f","status":"affected","version":"244da66cda359227d80ccb41dbcb99da40eae186","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2F36D808-4779-4F06-832E-00E88B607F3C","versionEndExcluding":"6.12.80","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix leaking event log memory\n\nDuring the device remove process, the device is reset, causing the\nconfiguration registers to go back to their default state, which is\nzero. As the driver is checking if the event log support was enabled\nbefore deallocating, it will fail if a reset happened before.\n\nDo not check if the support was enabled, the check for 'idxd->evl'\nbeing valid (only allocated if the HW capability is available) is\nenough."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndmaengine: idxd: Arreglar la fuga de memoria del registro de eventos\n\nDurante el proceso de eliminación del dispositivo, el dispositivo se restablece, haciendo que los registros de configuración vuelvan a su estado predeterminado, que es cero. Como el controlador está comprobando si el soporte del registro de eventos estaba habilitado antes de desasignar, fallará si un restablecimiento ocurrió antes.\n\nNo comprobar si el soporte estaba habilitado, la comprobación de que ’idxd -> evl’ sea válido (solo asignado si la capacidad de HW está disponible) es suficiente."}],"id":"CVE-2026-31440","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31440","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:27.403110Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:37.390","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/695b491dc3f20365fd5821f22e25dbe3c1c20cbc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9dfa00967e6ef43a9dd0887fe5c3a721a39da92e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d94f9b0ba28a205caf95902ee88b42bdb8af83d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee66bc29578391c9b48523dc9119af67bd5c7c0f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/facd0012708e942fc12890708738aebde497564e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31441.json b/data/2026/CVE-2026-31441.json index 04a444d97e..df9f1c0d52 100644 --- a/data/2026/CVE-2026-31441.json +++ b/data/2026/CVE-2026-31441.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a16098a2f0c11ee5e04e23aa7478ca1fcfb0f658","status":"affected","version":"da32b28c95a79e399e18c03f8178f41aec9c66e4","versionType":"git"},{"lessThan":"54d77cc0c40ca2f894859dc7b3c52997574f1a2a","status":"affected","version":"da32b28c95a79e399e18c03f8178f41aec9c66e4","versionType":"git"},{"lessThan":"39c1504e0e76bcfb93991fd94288a83e05d13b51","status":"affected","version":"da32b28c95a79e399e18c03f8178f41aec9c66e4","versionType":"git"},{"lessThan":"a9e7815d38629bcf59d3005001f1f315424a58de","status":"affected","version":"da32b28c95a79e399e18c03f8178f41aec9c66e4","versionType":"git"},{"lessThan":"0c3d3ac57e3c52b570b8c695903306bff07e04c8","status":"affected","version":"da32b28c95a79e399e18c03f8178f41aec9c66e4","versionType":"git"},{"lessThan":"d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478","status":"affected","version":"da32b28c95a79e399e18c03f8178f41aec9c66e4","versionType":"git"},{"status":"affected","version":"2a2df2bd10de44c3804661ed15157817c12d6291","versionType":"git"},{"lessThan":"5.8","status":"affected","version":"5.7.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"92A73C33-7B25-44AD-A976-034B527AB896","versionEndExcluding":"5.8","versionStartIncluding":"5.7.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D301ED86-94B4-4354-BAE0-4EF47270600A","versionEndExcluding":"6.1.168","versionStartIncluding":"5.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:-:*:*:*:*:*:*","matchCriteriaId":"0E2DC66F-4A95-475F-B8B6-191DEC1E7EF6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:rc6:*:*:*:*:*:*","matchCriteriaId":"69E12239-342D-43B2-93F0-2760623AFEEF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:rc7:*:*:*:*:*:*","matchCriteriaId":"CA1501B4-945A-45C2-8E7C-65085BF91C76","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix memory leak when a wq is reset\n\nidxd_wq_disable_cleanup() which is called from the reset path for a\nworkqueue, sets the wq type to NONE, which for other parts of the\ndriver mean that the wq is empty (all its resources were released).\n\nOnly set the wq type to NONE after its resources are released."}],"id":"CVE-2026-31441","lastModified":"2026-11-10T13:18:54.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31441","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:34.483651Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:37.530","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c3d3ac57e3c52b570b8c695903306bff07e04c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/39c1504e0e76bcfb93991fd94288a83e05d13b51"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/54d77cc0c40ca2f894859dc7b3c52997574f1a2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a16098a2f0c11ee5e04e23aa7478ca1fcfb0f658"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a9e7815d38629bcf59d3005001f1f315424a58de"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a16098a2f0c11ee5e04e23aa7478ca1fcfb0f658","status":"affected","version":"da32b28c95a79e399e18c03f8178f41aec9c66e4","versionType":"git"},{"lessThan":"54d77cc0c40ca2f894859dc7b3c52997574f1a2a","status":"affected","version":"da32b28c95a79e399e18c03f8178f41aec9c66e4","versionType":"git"},{"lessThan":"39c1504e0e76bcfb93991fd94288a83e05d13b51","status":"affected","version":"da32b28c95a79e399e18c03f8178f41aec9c66e4","versionType":"git"},{"lessThan":"a9e7815d38629bcf59d3005001f1f315424a58de","status":"affected","version":"da32b28c95a79e399e18c03f8178f41aec9c66e4","versionType":"git"},{"lessThan":"0c3d3ac57e3c52b570b8c695903306bff07e04c8","status":"affected","version":"da32b28c95a79e399e18c03f8178f41aec9c66e4","versionType":"git"},{"lessThan":"d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478","status":"affected","version":"da32b28c95a79e399e18c03f8178f41aec9c66e4","versionType":"git"},{"status":"affected","version":"2a2df2bd10de44c3804661ed15157817c12d6291","versionType":"git"},{"lessThan":"5.8","status":"affected","version":"5.7.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"92A73C33-7B25-44AD-A976-034B527AB896","versionEndExcluding":"5.8","versionStartIncluding":"5.7.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D301ED86-94B4-4354-BAE0-4EF47270600A","versionEndExcluding":"6.1.168","versionStartIncluding":"5.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:-:*:*:*:*:*:*","matchCriteriaId":"0E2DC66F-4A95-475F-B8B6-191DEC1E7EF6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:rc6:*:*:*:*:*:*","matchCriteriaId":"69E12239-342D-43B2-93F0-2760623AFEEF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:rc7:*:*:*:*:*:*","matchCriteriaId":"CA1501B4-945A-45C2-8E7C-65085BF91C76","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix memory leak when a wq is reset\n\nidxd_wq_disable_cleanup() which is called from the reset path for a\nworkqueue, sets the wq type to NONE, which for other parts of the\ndriver mean that the wq is empty (all its resources were released).\n\nOnly set the wq type to NONE after its resources are released."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndmaengine: idxd: Corrección de fuga de memoria cuando se reinicia una wq\n\nidxd_wq_disable_cleanup(), que se llama desde la ruta de reinicio para una cola de trabajo, establece el tipo de wq en NONE, lo que para otras partes del controlador significa que la wq está vacía (todos sus recursos fueron liberados).\n\nSolo establecer el tipo de wq en NONE después de que sus recursos sean liberados."}],"id":"CVE-2026-31441","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31441","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:34.483651Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:37.530","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c3d3ac57e3c52b570b8c695903306bff07e04c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/39c1504e0e76bcfb93991fd94288a83e05d13b51"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/54d77cc0c40ca2f894859dc7b3c52997574f1a2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a16098a2f0c11ee5e04e23aa7478ca1fcfb0f658"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a9e7815d38629bcf59d3005001f1f315424a58de"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31442.json b/data/2026/CVE-2026-31442.json index 9d8c61ebbc..97df3925c7 100644 --- a/data/2026/CVE-2026-31442.json +++ b/data/2026/CVE-2026-31442.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"504c0e6751001ac46917c73e703f2b1b92cfc026","status":"affected","version":"98d187a989036096feaa2fef1ec3b2240ecdeacf","versionType":"git"},{"lessThan":"867d0c801f21370d561420fa32f2ea1a7dc3a22d","status":"affected","version":"98d187a989036096feaa2fef1ec3b2240ecdeacf","versionType":"git"},{"lessThan":"d6077df7b75d26e4edf98983836c05d00ebabd8d","status":"affected","version":"98d187a989036096feaa2fef1ec3b2240ecdeacf","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A92793EC-8117-409C-996C-47A04124C722","versionEndExcluding":"6.18.21","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix possible invalid memory access after FLR\n\nIn the case that the first Function Level Reset (FLR) concludes\ncorrectly, but in the second FLR the scratch area for the saved\nconfiguration cannot be allocated, it's possible for a invalid memory\naccess to happen.\n\nAlways set the deallocated scratch area to NULL after FLR completes."}],"id":"CVE-2026-31442","lastModified":"2026-10-19T19:17:53.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31442","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:18.455036Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:37.703","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/504c0e6751001ac46917c73e703f2b1b92cfc026"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/867d0c801f21370d561420fa32f2ea1a7dc3a22d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d6077df7b75d26e4edf98983836c05d00ebabd8d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"504c0e6751001ac46917c73e703f2b1b92cfc026","status":"affected","version":"98d187a989036096feaa2fef1ec3b2240ecdeacf","versionType":"git"},{"lessThan":"867d0c801f21370d561420fa32f2ea1a7dc3a22d","status":"affected","version":"98d187a989036096feaa2fef1ec3b2240ecdeacf","versionType":"git"},{"lessThan":"d6077df7b75d26e4edf98983836c05d00ebabd8d","status":"affected","version":"98d187a989036096feaa2fef1ec3b2240ecdeacf","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A92793EC-8117-409C-996C-47A04124C722","versionEndExcluding":"6.18.21","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix possible invalid memory access after FLR\n\nIn the case that the first Function Level Reset (FLR) concludes\ncorrectly, but in the second FLR the scratch area for the saved\nconfiguration cannot be allocated, it's possible for a invalid memory\naccess to happen.\n\nAlways set the deallocated scratch area to NULL after FLR completes."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\ndmaengine: idxd: Corrección de posible acceso a memoria no válido después de FLR\n\nEn el caso de que el primer Function Level Reset (FLR) concluya correctamente, pero en el segundo FLR el área de trabajo para la configuración guardada no pueda asignarse, es posible que ocurra un acceso a memoria no válido.\n\nSiempre establecer el área de trabajo desasignada a NULL después de que FLR se complete."}],"id":"CVE-2026-31442","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31442","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:18.455036Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:37.703","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/504c0e6751001ac46917c73e703f2b1b92cfc026"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/867d0c801f21370d561420fa32f2ea1a7dc3a22d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d6077df7b75d26e4edf98983836c05d00ebabd8d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31443.json b/data/2026/CVE-2026-31443.json index 85c4cf522e..9e81a30684 100644 --- a/data/2026/CVE-2026-31443.json +++ b/data/2026/CVE-2026-31443.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/device.c","drivers/dma/idxd/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"aa0ffc6d3990ec35976308a068dc23178037e564","status":"affected","version":"6078a315aec15e0776fa90347cf4eba7478cdbd7","versionType":"git"},{"lessThan":"0e761079d653c25f838380cf7cef2730832110cc","status":"affected","version":"6078a315aec15e0776fa90347cf4eba7478cdbd7","versionType":"git"},{"lessThan":"52d2edea0d63c935e82631e4b9e4a94eccf97b5b","status":"affected","version":"6078a315aec15e0776fa90347cf4eba7478cdbd7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/device.c","drivers/dma/idxd/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A92793EC-8117-409C-996C-47A04124C722","versionEndExcluding":"6.18.21","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix crash when the event log is disabled\n\nIf reporting errors to the event log is not supported by the hardware,\nand an error that causes Function Level Reset (FLR) is received, the\ndriver will try to restore the event log even if it was not allocated.\n\nAlso, only try to free the event log if it was properly allocated."}],"id":"CVE-2026-31443","lastModified":"2026-11-05T22:18:31.930","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31443","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:40.615820Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:37.860","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e761079d653c25f838380cf7cef2730832110cc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/52d2edea0d63c935e82631e4b9e4a94eccf97b5b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aa0ffc6d3990ec35976308a068dc23178037e564"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/device.c","drivers/dma/idxd/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"aa0ffc6d3990ec35976308a068dc23178037e564","status":"affected","version":"6078a315aec15e0776fa90347cf4eba7478cdbd7","versionType":"git"},{"lessThan":"0e761079d653c25f838380cf7cef2730832110cc","status":"affected","version":"6078a315aec15e0776fa90347cf4eba7478cdbd7","versionType":"git"},{"lessThan":"52d2edea0d63c935e82631e4b9e4a94eccf97b5b","status":"affected","version":"6078a315aec15e0776fa90347cf4eba7478cdbd7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/device.c","drivers/dma/idxd/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A92793EC-8117-409C-996C-47A04124C722","versionEndExcluding":"6.18.21","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix crash when the event log is disabled\n\nIf reporting errors to the event log is not supported by the hardware,\nand an error that causes Function Level Reset (FLR) is received, the\ndriver will try to restore the event log even if it was not allocated.\n\nAlso, only try to free the event log if it was properly allocated."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndmaengine: idxd: Corrige un fallo cuando el registro de eventos está deshabilitado\n\nSi el informe de errores al registro de eventos no es compatible con el hardware,\ny se recibe un error que causa un Restablecimiento a Nivel de Función (FLR), el\ncontrolador intentará restaurar el registro de eventos incluso si no fue asignado.\n\nAdemás, solo intente liberar el registro de eventos si fue asignado correctamente."}],"id":"CVE-2026-31443","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31443","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:40.615820Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:37.860","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e761079d653c25f838380cf7cef2730832110cc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/52d2edea0d63c935e82631e4b9e4a94eccf97b5b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aa0ffc6d3990ec35976308a068dc23178037e564"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31444.json b/data/2026/CVE-2026-31444.json index 1669012157..b03d15f826 100644 --- a/data/2026/CVE-2026-31444.json +++ b/data/2026/CVE-2026-31444.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/oplock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9e785f004cbc56390479b77375726ea9b0d1a8a6","status":"affected","version":"302fef75512b2c8329a3f5efab1ae7ba2562387a","versionType":"git"},{"lessThan":"7de55bba69cbf0f9280daaea385daf08bc076121","status":"affected","version":"08aa9f3c8cf4d0bee44df540dfe34e8d64069f2c","versionType":"git"},{"lessThan":"a5c6f6d6ceefed2d5210ee420fb75f8362461f46","status":"affected","version":"1d6abf145615dbfe267ce3b0a271f95e3780e18e","versionType":"git"},{"lessThan":"6d7e5a918c1d0aad06db0e17677b66fc9a471021","status":"affected","version":"ce8507ee82c888126d8e7565e27c016308d24cde","versionType":"git"},{"lessThan":"48623ec358c1c600fa1e38368746f933e0f1a617","status":"affected","version":"1dfd062caa165ec9d7ee0823087930f3ab8a6294","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/oplock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.6.131","status":"affected","version":"6.6.130","versionType":"semver"},{"lessThan":"6.12.80","status":"affected","version":"6.12.78","versionType":"semver"},{"lessThan":"6.18.21","status":"affected","version":"6.18.19","versionType":"semver"},{"lessThan":"6.19.11","status":"affected","version":"6.19.9","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"32BFB596-06E1-4DA3-9777-1ED37BA1744B","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.78","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"75041A3B-374A-4909-A065-48064ABDEC6C","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F3885A44-8CC0-4992-8F4A-B68D3E58E912","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.6.130:*:*:*:*:*:*:*","matchCriteriaId":"BBE4A27D-9A72-4C12-BFE0-E9811803AC96","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free and NULL deref in smb_grant_oplock()\n\nsmb_grant_oplock() has two issues in the oplock publication sequence:\n\n1) opinfo is linked into ci->m_op_list (via opinfo_add) before\n add_lease_global_list() is called. If add_lease_global_list()\n fails (kmalloc returns NULL), the error path frees the opinfo\n via __free_opinfo() while it is still linked in ci->m_op_list.\n Concurrent m_op_list readers (opinfo_get_list, or direct iteration\n in smb_break_all_levII_oplock) dereference the freed node.\n\n2) opinfo->o_fp is assigned after add_lease_global_list() publishes\n the opinfo on the global lease list. A concurrent\n find_same_lease_key() can walk the lease list and dereference\n opinfo->o_fp->f_ci while o_fp is still NULL.\n\nFix by restructuring the publication sequence to eliminate post-publish\nfailure:\n\n- Set opinfo->o_fp before any list publication (fixes NULL deref).\n- Preallocate lease_table via alloc_lease_table() before opinfo_add()\n so add_lease_global_list() becomes infallible after publication.\n- Keep the original m_op_list publication order (opinfo_add before\n lease list) so concurrent opens via same_client_has_lease() and\n opinfo_get_list() still see the in-flight grant.\n- Use opinfo_put() instead of __free_opinfo() on err_out so that\n the RCU-deferred free path is used.\n\nThis also requires splitting add_lease_global_list() to take a\npreallocated lease_table and changing its return type from int to void,\nsince it can no longer fail."}],"id":"CVE-2026-31444","lastModified":"2026-06-17T10:33:43.960","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:38.010","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48623ec358c1c600fa1e38368746f933e0f1a617"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6d7e5a918c1d0aad06db0e17677b66fc9a471021"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7de55bba69cbf0f9280daaea385daf08bc076121"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e785f004cbc56390479b77375726ea9b0d1a8a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a5c6f6d6ceefed2d5210ee420fb75f8362461f46"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/oplock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9e785f004cbc56390479b77375726ea9b0d1a8a6","status":"affected","version":"302fef75512b2c8329a3f5efab1ae7ba2562387a","versionType":"git"},{"lessThan":"7de55bba69cbf0f9280daaea385daf08bc076121","status":"affected","version":"08aa9f3c8cf4d0bee44df540dfe34e8d64069f2c","versionType":"git"},{"lessThan":"a5c6f6d6ceefed2d5210ee420fb75f8362461f46","status":"affected","version":"1d6abf145615dbfe267ce3b0a271f95e3780e18e","versionType":"git"},{"lessThan":"6d7e5a918c1d0aad06db0e17677b66fc9a471021","status":"affected","version":"ce8507ee82c888126d8e7565e27c016308d24cde","versionType":"git"},{"lessThan":"48623ec358c1c600fa1e38368746f933e0f1a617","status":"affected","version":"1dfd062caa165ec9d7ee0823087930f3ab8a6294","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/oplock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.6.131","status":"affected","version":"6.6.130","versionType":"semver"},{"lessThan":"6.12.80","status":"affected","version":"6.12.78","versionType":"semver"},{"lessThan":"6.18.21","status":"affected","version":"6.18.19","versionType":"semver"},{"lessThan":"6.19.11","status":"affected","version":"6.19.9","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"32BFB596-06E1-4DA3-9777-1ED37BA1744B","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.78","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"75041A3B-374A-4909-A065-48064ABDEC6C","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F3885A44-8CC0-4992-8F4A-B68D3E58E912","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.6.130:*:*:*:*:*:*:*","matchCriteriaId":"BBE4A27D-9A72-4C12-BFE0-E9811803AC96","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free and NULL deref in smb_grant_oplock()\n\nsmb_grant_oplock() has two issues in the oplock publication sequence:\n\n1) opinfo is linked into ci->m_op_list (via opinfo_add) before\n add_lease_global_list() is called. If add_lease_global_list()\n fails (kmalloc returns NULL), the error path frees the opinfo\n via __free_opinfo() while it is still linked in ci->m_op_list.\n Concurrent m_op_list readers (opinfo_get_list, or direct iteration\n in smb_break_all_levII_oplock) dereference the freed node.\n\n2) opinfo->o_fp is assigned after add_lease_global_list() publishes\n the opinfo on the global lease list. A concurrent\n find_same_lease_key() can walk the lease list and dereference\n opinfo->o_fp->f_ci while o_fp is still NULL.\n\nFix by restructuring the publication sequence to eliminate post-publish\nfailure:\n\n- Set opinfo->o_fp before any list publication (fixes NULL deref).\n- Preallocate lease_table via alloc_lease_table() before opinfo_add()\n so add_lease_global_list() becomes infallible after publication.\n- Keep the original m_op_list publication order (opinfo_add before\n lease list) so concurrent opens via same_client_has_lease() and\n opinfo_get_list() still see the in-flight grant.\n- Use opinfo_put() instead of __free_opinfo() on err_out so that\n the RCU-deferred free path is used.\n\nThis also requires splitting add_lease_global_list() to take a\npreallocated lease_table and changing its return type from int to void,\nsince it can no longer fail."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: corrige uso después de liberación y desreferencia NULL en smb_grant_oplock()\n\nsmb_grant_oplock() tiene dos problemas en la secuencia de publicación de oplock:\n\n1) opinfo se enlaza en ci -> m_op_list (a través de opinfo_add) antes de que se llame a add_lease_global_list(). Si add_lease_global_list() falla (kmalloc devuelve NULL), la ruta de error libera el opinfo a través de __free_opinfo() mientras aún está enlazado en ci -> m_op_list. Lectores concurrentes de m_op_list (opinfo_get_list, o iteración directa en smb_break_all_levII_oplock) desreferencian el nodo liberado.\n\n2) opinfo -> o_fp se asigna después de que add_lease_global_list() publica el opinfo en la lista global de arrendamientos. Un find_same_lease_key() concurrente puede recorrer la lista de arrendamientos y desreferenciar opinfo -> o_fp -> f_ci mientras o_fp aún es NULL.\n\nSe corrige reestructurando la secuencia de publicación para eliminar fallos posteriores a la publicación:\n\n- Establecer opinfo -> o_fp antes de cualquier publicación en lista (corrige la desreferencia NULL).\n- Preasignar lease_table a través de alloc_lease_table() antes de opinfo_add() para que add_lease_global_list() se vuelva infalible después de la publicación.\n- Mantener el orden de publicación original de m_op_list (opinfo_add antes de la lista de arrendamientos) para que las aperturas concurrentes a través de same_client_has_lease() y opinfo_get_list() aún vean la concesión en curso.\n- Usar opinfo_put() en lugar de __free_opinfo() en err_out para que se utilice la ruta de liberación diferida por RCU.\n\nEsto también requiere dividir add_lease_global_list() para que tome una lease_table preasignada y cambiar su tipo de retorno de int a void, ya que ya no puede fallar."}],"id":"CVE-2026-31444","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:38.010","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48623ec358c1c600fa1e38368746f933e0f1a617"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6d7e5a918c1d0aad06db0e17677b66fc9a471021"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7de55bba69cbf0f9280daaea385daf08bc076121"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e785f004cbc56390479b77375726ea9b0d1a8a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a5c6f6d6ceefed2d5210ee420fb75f8362461f46"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31445.json b/data/2026/CVE-2026-31445.json index 3cbcb8e9ca..7242645aca 100644 --- a/data/2026/CVE-2026-31445.json +++ b/data/2026/CVE-2026-31445.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/damon.h","mm/damon/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9c495f9d3781cd692bd199531cabd4627155e8cd","status":"affected","version":"3301f1861d34f53911a30a8f5f41b9141bd8ed39","versionType":"git"},{"lessThan":"1b247cd0654a3a306996fa80741d79296c683a56","status":"affected","version":"3301f1861d34f53911a30a8f5f41b9141bd8ed39","versionType":"git"},{"lessThan":"26f775a054c3cda86ad465a64141894a90a9e145","status":"affected","version":"3301f1861d34f53911a30a8f5f41b9141bd8ed39","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/damon.h","mm/damon/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"54C46FD6-33A9-4762-8D41-DB70D9475EFF","versionEndExcluding":"6.18.21","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: avoid use of half-online-committed context\n\nOne major usage of damon_call() is online DAMON parameters update. It is\ndone by calling damon_commit_ctx() inside the damon_call() callback\nfunction. damon_commit_ctx() can fail for two reasons: 1) invalid\nparameters and 2) internal memory allocation failures. In case of\nfailures, the damon_ctx that attempted to be updated (commit destination)\ncan be partially updated (or, corrupted from a perspective), and therefore\nshouldn't be used anymore. The function only ensures the damon_ctx object\ncan safely deallocated using damon_destroy_ctx().\n\nThe API callers are, however, calling damon_commit_ctx() only after\nasserting the parameters are valid, to avoid damon_commit_ctx() fails due\nto invalid input parameters. But it can still theoretically fail if the\ninternal memory allocation fails. In the case, DAMON may run with the\npartially updated damon_ctx. This can result in unexpected behaviors\nincluding even NULL pointer dereference in case of damos_commit_dests()\nfailure [1]. Such allocation failure is arguably too small to fail, so\nthe real world impact would be rare. But, given the bad consequence, this\nneeds to be fixed.\n\nAvoid such partially-committed (maybe-corrupted) damon_ctx use by saving\nthe damon_commit_ctx() failure on the damon_ctx object. For this,\nintroduce damon_ctx->maybe_corrupted field. damon_commit_ctx() sets it\nwhen it is failed. kdamond_call() checks if the field is set after each\ndamon_call_control->fn() is executed. If it is set, ignore remaining\ncallback requests and return. All kdamond_call() callers including\nkdamond_fn() also check the maybe_corrupted field right after\nkdamond_call() invocations. If the field is set, break the kdamond_fn()\nmain loop so that DAMON sill doesn't use the context that might be\ncorrupted.\n\n[sj@kernel.org: let kdamond_call() with cancel regardless of maybe_corrupted]"}],"id":"CVE-2026-31445","lastModified":"2026-06-17T10:33:44.070","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:38.177","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1b247cd0654a3a306996fa80741d79296c683a56"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26f775a054c3cda86ad465a64141894a90a9e145"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9c495f9d3781cd692bd199531cabd4627155e8cd"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/damon.h","mm/damon/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9c495f9d3781cd692bd199531cabd4627155e8cd","status":"affected","version":"3301f1861d34f53911a30a8f5f41b9141bd8ed39","versionType":"git"},{"lessThan":"1b247cd0654a3a306996fa80741d79296c683a56","status":"affected","version":"3301f1861d34f53911a30a8f5f41b9141bd8ed39","versionType":"git"},{"lessThan":"26f775a054c3cda86ad465a64141894a90a9e145","status":"affected","version":"3301f1861d34f53911a30a8f5f41b9141bd8ed39","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/damon.h","mm/damon/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"54C46FD6-33A9-4762-8D41-DB70D9475EFF","versionEndExcluding":"6.18.21","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: avoid use of half-online-committed context\n\nOne major usage of damon_call() is online DAMON parameters update. It is\ndone by calling damon_commit_ctx() inside the damon_call() callback\nfunction. damon_commit_ctx() can fail for two reasons: 1) invalid\nparameters and 2) internal memory allocation failures. In case of\nfailures, the damon_ctx that attempted to be updated (commit destination)\ncan be partially updated (or, corrupted from a perspective), and therefore\nshouldn't be used anymore. The function only ensures the damon_ctx object\ncan safely deallocated using damon_destroy_ctx().\n\nThe API callers are, however, calling damon_commit_ctx() only after\nasserting the parameters are valid, to avoid damon_commit_ctx() fails due\nto invalid input parameters. But it can still theoretically fail if the\ninternal memory allocation fails. In the case, DAMON may run with the\npartially updated damon_ctx. This can result in unexpected behaviors\nincluding even NULL pointer dereference in case of damos_commit_dests()\nfailure [1]. Such allocation failure is arguably too small to fail, so\nthe real world impact would be rare. But, given the bad consequence, this\nneeds to be fixed.\n\nAvoid such partially-committed (maybe-corrupted) damon_ctx use by saving\nthe damon_commit_ctx() failure on the damon_ctx object. For this,\nintroduce damon_ctx->maybe_corrupted field. damon_commit_ctx() sets it\nwhen it is failed. kdamond_call() checks if the field is set after each\ndamon_call_control->fn() is executed. If it is set, ignore remaining\ncallback requests and return. All kdamond_call() callers including\nkdamond_fn() also check the maybe_corrupted field right after\nkdamond_call() invocations. If the field is set, break the kdamond_fn()\nmain loop so that DAMON sill doesn't use the context that might be\ncorrupted.\n\n[sj@kernel.org: let kdamond_call() with cancel regardless of maybe_corrupted]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/damon/core: evitar el uso de contexto medio-online-commitado\n\nUn uso principal de damon_call() es la actualización de parámetros DAMON en línea. Se realiza llamando a damon_commit_ctx() dentro de la función de callback damon_call(). damon_commit_ctx() puede fallar por dos razones: 1) parámetros inválidos y 2) fallos de asignación de memoria interna. En caso de fallos, el damon_ctx que intentó ser actualizado (destino de commit) puede ser parcialmente actualizado (o, corrompido desde una perspectiva), y por lo tanto no debería usarse más. La función solo asegura que el objeto damon_ctx puede ser desasignado de forma segura usando damon_destroy_ctx().\n\nLos llamadores de la API están, sin embargo, llamando a damon_commit_ctx() solo después de afirmar que los parámetros son válidos, para evitar que damon_commit_ctx() falle debido a parámetros de entrada inválidos. Pero aún puede fallar teóricamente si la asignación de memoria interna falla. En ese caso, DAMON puede ejecutarse con el damon_ctx parcialmente actualizado. Esto puede resultar en comportamientos inesperados, incluyendo incluso la desreferencia de puntero NULL en caso de fallo de damos_commit_dests() [1]. Tal fallo de asignación es, discutiblemente, demasiado pequeño para fallar, por lo que el impacto en el mundo real sería raro. Pero, dada la mala consecuencia, esto necesita ser arreglado.\n\nEvitar el uso de dicho damon_ctx parcialmente-commitado (quizás-corrompido) guardando el fallo de damon_commit_ctx() en el objeto damon_ctx. Para esto, se introduce el campo damon_ctx -> maybe_corrupted. damon_commit_ctx() lo establece cuando falla. kdamond_call() verifica si el campo está establecido después de que se ejecuta cada damon_call_control -> fn(). Si está establecido, ignorar las solicitudes de callback restantes y retornar. Todos los llamadores de kdamond_call(), incluyendo kdamond_fn(), también verifican el campo maybe_corrupted justo después de las invocaciones de kdamond_call(). Si el campo está establecido, romper el bucle principal de kdamond_fn() para que DAMON siga sin usar el contexto que podría estar corrompido.\n\n[sj@kernel.org: permitir kdamond_call() con cancelación independientemente de maybe_corrupted]"}],"id":"CVE-2026-31445","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:38.177","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1b247cd0654a3a306996fa80741d79296c683a56"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26f775a054c3cda86ad465a64141894a90a9e145"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9c495f9d3781cd692bd199531cabd4627155e8cd"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31446.json b/data/2026/CVE-2026-31446.json index 1eadff3f19..bd7fa2538b 100644 --- a/data/2026/CVE-2026-31446.json +++ b/data/2026/CVE-2026-31446.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/ext4.h","fs/ext4/super.c","fs/ext4/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c8fe17a1b308c3d8c703ebfb049b325f844342c3","status":"affected","version":"52c3a04f9ec2a16a4204d6274db338cb8d5b2d74","versionType":"git"},{"lessThan":"c4d829737329f2290dd41e290b7d75effdb2a7ff","status":"affected","version":"b98535d091795a79336f520b0708457aacf55c67","versionType":"git"},{"lessThan":"9449f99ba04f5dd1c8423ad8a90b3651d7240d1d","status":"affected","version":"b98535d091795a79336f520b0708457aacf55c67","versionType":"git"},{"lessThan":"034053378dd81837fd6c7a43b37ee2e58d4f0b4e","status":"affected","version":"b98535d091795a79336f520b0708457aacf55c67","versionType":"git"},{"lessThan":"c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe","status":"affected","version":"b98535d091795a79336f520b0708457aacf55c67","versionType":"git"},{"lessThan":"08b10e6f37fc533a759e9833af0692242e8b3f93","status":"affected","version":"b98535d091795a79336f520b0708457aacf55c67","versionType":"git"},{"lessThan":"d15e4b0a418537aafa56b2cb80d44add83e83697","status":"affected","version":"b98535d091795a79336f520b0708457aacf55c67","versionType":"git"},{"status":"affected","version":"585ef03c9e79672781f954daae730dfe24bf3a46","versionType":"git"},{"status":"affected","version":"afe490e48d47df1b3f64012835c1bc2f075a8c8b","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.38","versionType":"semver"},{"lessThan":"5.11","status":"affected","version":"5.10.114","versionType":"semver"},{"lessThan":"5.18","status":"affected","version":"5.17.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/ext4.h","fs/ext4/super.c","fs/ext4/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"06D67EC3-92E2-452F-9826-4CF918434F2B","versionEndExcluding":"5.11","versionStartIncluding":"5.10.114","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"237A1663-E334-49A1-A031-5A8D1A1782AD","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"49134C93-AD6F-411A-A4B1-E5E509EEFB00","versionEndExcluding":"5.18","versionStartIncluding":"5.17.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0292DDCD-3BB0-457C-AB09-7796072CC1DB","versionEndExcluding":"6.1.168","versionStartIncluding":"5.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:*","matchCriteriaId":"0384FA0A-DE99-48D7-84E3-46ED0C3B5E03","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:rc4:*:*:*:*:*:*","matchCriteriaId":"DA5F085D-52F3-4EE2-8353-455D1A6FE073","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:rc5:*:*:*:*:*:*","matchCriteriaId":"D6EE5B78-0D83-4715-893C-ABD69B49E7FC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:rc6:*:*:*:*:*:*","matchCriteriaId":"EE723F14-047B-4FCF-B109-E0542EDFB063","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:rc7:*:*:*:*:*:*","matchCriteriaId":"2FCFCE58-5118-4D05-864E-C82CF20EABE5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:rc9:*:*:*:*:*:*","matchCriteriaId":"9C3E5BC9-613C-4362-BF02-153A5BBFFB2F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free in update_super_work when racing with umount\n\nCommit b98535d09179 (\"ext4: fix bug_on in start_this_handle during umount\nfilesystem\") moved ext4_unregister_sysfs() before flushing s_sb_upd_work\nto prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups\nreads during unmount. However, this introduced a use-after-free because\nupdate_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which\naccesses the kobject's kernfs_node after it has been freed by kobject_del()\nin ext4_unregister_sysfs():\n\n update_super_work ext4_put_super\n ----------------- --------------\n ext4_unregister_sysfs(sb)\n kobject_del(&sbi->s_kobj)\n __kobject_del()\n sysfs_remove_dir()\n kobj->sd = NULL\n sysfs_put(sd)\n kernfs_put() // RCU free\n ext4_notify_error_sysfs(sbi)\n sysfs_notify(&sbi->s_kobj)\n kn = kobj->sd // stale pointer\n kernfs_get(kn) // UAF on freed kernfs_node\n ext4_journal_destroy()\n flush_work(&sbi->s_sb_upd_work)\n\nInstead of reordering the teardown sequence, fix this by making\next4_notify_error_sysfs() detect that sysfs has already been torn down\nby checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call\nin that case. A dedicated mutex (s_error_notify_mutex) serializes\next4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs()\nto prevent TOCTOU races where the kobject could be deleted between the\nstate_in_sysfs check and the sysfs_notify() call."}],"id":"CVE-2026-31446","lastModified":"2026-11-10T13:18:54.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31446","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:20.883316Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:38.340","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/034053378dd81837fd6c7a43b37ee2e58d4f0b4e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08b10e6f37fc533a759e9833af0692242e8b3f93"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9449f99ba04f5dd1c8423ad8a90b3651d7240d1d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4d829737329f2290dd41e290b7d75effdb2a7ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8fe17a1b308c3d8c703ebfb049b325f844342c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d15e4b0a418537aafa56b2cb80d44add83e83697"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/ext4.h","fs/ext4/super.c","fs/ext4/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c8fe17a1b308c3d8c703ebfb049b325f844342c3","status":"affected","version":"52c3a04f9ec2a16a4204d6274db338cb8d5b2d74","versionType":"git"},{"lessThan":"c4d829737329f2290dd41e290b7d75effdb2a7ff","status":"affected","version":"b98535d091795a79336f520b0708457aacf55c67","versionType":"git"},{"lessThan":"9449f99ba04f5dd1c8423ad8a90b3651d7240d1d","status":"affected","version":"b98535d091795a79336f520b0708457aacf55c67","versionType":"git"},{"lessThan":"034053378dd81837fd6c7a43b37ee2e58d4f0b4e","status":"affected","version":"b98535d091795a79336f520b0708457aacf55c67","versionType":"git"},{"lessThan":"c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe","status":"affected","version":"b98535d091795a79336f520b0708457aacf55c67","versionType":"git"},{"lessThan":"08b10e6f37fc533a759e9833af0692242e8b3f93","status":"affected","version":"b98535d091795a79336f520b0708457aacf55c67","versionType":"git"},{"lessThan":"d15e4b0a418537aafa56b2cb80d44add83e83697","status":"affected","version":"b98535d091795a79336f520b0708457aacf55c67","versionType":"git"},{"status":"affected","version":"585ef03c9e79672781f954daae730dfe24bf3a46","versionType":"git"},{"status":"affected","version":"afe490e48d47df1b3f64012835c1bc2f075a8c8b","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.38","versionType":"semver"},{"lessThan":"5.11","status":"affected","version":"5.10.114","versionType":"semver"},{"lessThan":"5.18","status":"affected","version":"5.17.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/ext4.h","fs/ext4/super.c","fs/ext4/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"06D67EC3-92E2-452F-9826-4CF918434F2B","versionEndExcluding":"5.11","versionStartIncluding":"5.10.114","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"237A1663-E334-49A1-A031-5A8D1A1782AD","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"49134C93-AD6F-411A-A4B1-E5E509EEFB00","versionEndExcluding":"5.18","versionStartIncluding":"5.17.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0292DDCD-3BB0-457C-AB09-7796072CC1DB","versionEndExcluding":"6.1.168","versionStartIncluding":"5.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:*","matchCriteriaId":"0384FA0A-DE99-48D7-84E3-46ED0C3B5E03","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:rc4:*:*:*:*:*:*","matchCriteriaId":"DA5F085D-52F3-4EE2-8353-455D1A6FE073","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:rc5:*:*:*:*:*:*","matchCriteriaId":"D6EE5B78-0D83-4715-893C-ABD69B49E7FC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:rc6:*:*:*:*:*:*","matchCriteriaId":"EE723F14-047B-4FCF-B109-E0542EDFB063","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:rc7:*:*:*:*:*:*","matchCriteriaId":"2FCFCE58-5118-4D05-864E-C82CF20EABE5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:rc9:*:*:*:*:*:*","matchCriteriaId":"9C3E5BC9-613C-4362-BF02-153A5BBFFB2F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix use-after-free in update_super_work when racing with umount\n\nCommit b98535d09179 (\"ext4: fix bug_on in start_this_handle during umount\nfilesystem\") moved ext4_unregister_sysfs() before flushing s_sb_upd_work\nto prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups\nreads during unmount. However, this introduced a use-after-free because\nupdate_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which\naccesses the kobject's kernfs_node after it has been freed by kobject_del()\nin ext4_unregister_sysfs():\n\n update_super_work ext4_put_super\n ----------------- --------------\n ext4_unregister_sysfs(sb)\n kobject_del(&sbi->s_kobj)\n __kobject_del()\n sysfs_remove_dir()\n kobj->sd = NULL\n sysfs_put(sd)\n kernfs_put() // RCU free\n ext4_notify_error_sysfs(sbi)\n sysfs_notify(&sbi->s_kobj)\n kn = kobj->sd // stale pointer\n kernfs_get(kn) // UAF on freed kernfs_node\n ext4_journal_destroy()\n flush_work(&sbi->s_sb_upd_work)\n\nInstead of reordering the teardown sequence, fix this by making\next4_notify_error_sysfs() detect that sysfs has already been torn down\nby checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call\nin that case. A dedicated mutex (s_error_notify_mutex) serializes\next4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs()\nto prevent TOCTOU races where the kobject could be deleted between the\nstate_in_sysfs check and the sysfs_notify() call."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: corrige el uso después de liberación en update_super_work cuando compite con umount\n\nEl commit b98535d09179 (’ext4: corrige bug_on en start_this_handle durante el desmontaje del sistema de archivos’) movió ext4_unregister_sysfs() antes de vaciar s_sb_upd_work para evitar que se encole nuevo trabajo de error a través de lecturas de /proc/fs/ext4/xx/mb_groups durante el desmontaje. Sin embargo, esto introdujo un uso después de liberación porque update_super_work llama a ext4_notify_error_sysfs() -> sysfs_notify() que accede al kernfs_node del kobject después de que ha sido liberado por kobject_del() en ext4_unregister_sysfs():\n\n update_super_work ext4_put_super\n - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n ext4_unregister_sysfs(sb)\n kobject_del(ref:sbi -> s_kobj)\n __kobject_del()\n sysfs_remove_dir()\n kobj -> sd = NULL\n sysfs_put(sd)\n kernfs_put() // liberación RCU\n ext4_notify_error_sysfs(sbi)\n sysfs_notify(ref:sbi -> s_kobj)\n kn = kobj -> sd // puntero obsoleto\n kernfs_get(kn) // UAF en kernfs_node liberado\n ext4_journal_destroy()\n flush_work(ref:sbi -> s_sb_upd_work)\n\nEn lugar de reordenar la secuencia de desmontaje, corrige esto haciendo que ext4_notify_error_sysfs() detecte que sysfs ya ha sido desmontado verificando s_kobj.state_in_sysfs, y omitiendo la llamada a sysfs_notify() en ese caso. Un mutex dedicado (s_error_notify_mutex) serializa ext4_notify_error_sysfs() frente a kobject_del() en ext4_unregister_sysfs() para prevenir condiciones de carrera TOCTOU donde el kobject podría ser eliminado entre la verificación de state_in_sysfs y la llamada a sysfs_notify()."}],"id":"CVE-2026-31446","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31446","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:20.883316Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:38.340","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/034053378dd81837fd6c7a43b37ee2e58d4f0b4e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08b10e6f37fc533a759e9833af0692242e8b3f93"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9449f99ba04f5dd1c8423ad8a90b3651d7240d1d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4d829737329f2290dd41e290b7d75effdb2a7ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8fe17a1b308c3d8c703ebfb049b325f844342c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d15e4b0a418537aafa56b2cb80d44add83e83697"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31447.json b/data/2026/CVE-2026-31447.json index 96f4760b4d..2c7a906bd0 100644 --- a/data/2026/CVE-2026-31447.json +++ b/data/2026/CVE-2026-31447.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5ad6d994255e27a3254079dfb50ca861fc31f2d0","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"3a926957cc95899ef88529710836edadc03c71a1","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"7b58c110b4e1f028eb38eec9ed3555e9be81c8b0","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"b77de3fceafbb39f30e4ff5dc986f863d5456417","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"d787d3ae96648dc14a3b7ca8fde817177e82c1c7","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"ad1f6d608f33f59d21a3d025615d6786a6443998","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"7d5b04290156c3fc316eecc86a4f9d201ab7d44a","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"3822743dc20386d9897e999dbb990befa3a5b3f8","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6C3CD3BF-4498-4DF6-A38E-F5BE399AA47F","versionEndExcluding":"5.10.253","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: reject mount if bigalloc with s_first_data_block != 0\n\nbigalloc with s_first_data_block != 0 is not supported, reject mounting\nit."}],"id":"CVE-2026-31447","lastModified":"2026-11-10T13:18:54.750","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31447","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:23.320699Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:38.577","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3822743dc20386d9897e999dbb990befa3a5b3f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a926957cc95899ef88529710836edadc03c71a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5ad6d994255e27a3254079dfb50ca861fc31f2d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7b58c110b4e1f028eb38eec9ed3555e9be81c8b0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7d5b04290156c3fc316eecc86a4f9d201ab7d44a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ad1f6d608f33f59d21a3d025615d6786a6443998"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b77de3fceafbb39f30e4ff5dc986f863d5456417"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d787d3ae96648dc14a3b7ca8fde817177e82c1c7"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5ad6d994255e27a3254079dfb50ca861fc31f2d0","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"3a926957cc95899ef88529710836edadc03c71a1","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"7b58c110b4e1f028eb38eec9ed3555e9be81c8b0","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"b77de3fceafbb39f30e4ff5dc986f863d5456417","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"d787d3ae96648dc14a3b7ca8fde817177e82c1c7","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"ad1f6d608f33f59d21a3d025615d6786a6443998","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"7d5b04290156c3fc316eecc86a4f9d201ab7d44a","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"},{"lessThan":"3822743dc20386d9897e999dbb990befa3a5b3f8","status":"affected","version":"281b59959707dfae03ce038cdf231bf4904e170c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6C3CD3BF-4498-4DF6-A38E-F5BE399AA47F","versionEndExcluding":"5.10.253","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: reject mount if bigalloc with s_first_data_block != 0\n\nbigalloc with s_first_data_block != 0 is not supported, reject mounting\nit."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: rechazar montaje si bigalloc con s_first_data_block != 0\n\nbigalloc con s_first_data_block != 0 no es compatible, rechazar su montaje."}],"id":"CVE-2026-31447","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31447","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:23.320699Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:38.577","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3822743dc20386d9897e999dbb990befa3a5b3f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a926957cc95899ef88529710836edadc03c71a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5ad6d994255e27a3254079dfb50ca861fc31f2d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7b58c110b4e1f028eb38eec9ed3555e9be81c8b0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7d5b04290156c3fc316eecc86a4f9d201ab7d44a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ad1f6d608f33f59d21a3d025615d6786a6443998"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b77de3fceafbb39f30e4ff5dc986f863d5456417"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d787d3ae96648dc14a3b7ca8fde817177e82c1c7"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31448.json b/data/2026/CVE-2026-31448.json index 1ad02f2ddd..d07ad22aba 100644 --- a/data/2026/CVE-2026-31448.json +++ b/data/2026/CVE-2026-31448.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/extents.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c66545e83a802c3851d9be27a41c0479dd29ff0c","status":"affected","version":"315054f023d28ee64f308adf8b5737831541776b","versionType":"git"},{"lessThan":"ecc50bfca9b5c2ee6aeef998181689b80477367b","status":"affected","version":"315054f023d28ee64f308adf8b5737831541776b","versionType":"git"},{"lessThan":"3a7667595bcad84da53fc156a418e110267c3412","status":"affected","version":"315054f023d28ee64f308adf8b5737831541776b","versionType":"git"},{"lessThan":"416c86f30f91b4fb2642ef6b102596ca898f41a5","status":"affected","version":"315054f023d28ee64f308adf8b5737831541776b","versionType":"git"},{"lessThan":"64f425b06b3bea9abc8977fd3982779b3ad070c9","status":"affected","version":"315054f023d28ee64f308adf8b5737831541776b","versionType":"git"},{"lessThan":"5422fe71d26d42af6c454ca9527faaad4e677d6c","status":"affected","version":"315054f023d28ee64f308adf8b5737831541776b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/extents.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"09A2CD65-1CD4-45BC-AB86-2A903D823B07","versionEndExcluding":"6.1.168","versionStartIncluding":"2.6.22.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:-:*:*:*:*:*:*","matchCriteriaId":"7F7D6C66-3384-4ACC-9D08-C5A26B4FD004","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:rc4:*:*:*:*:*:*","matchCriteriaId":"6465E61D-0238-4ED3-B4CB-E3B93F4F324F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:rc5:*:*:*:*:*:*","matchCriteriaId":"830B8340-2B8F-4F0A-8943-F4413411573C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:rc6:*:*:*:*:*:*","matchCriteriaId":"D123AAFE-3F17-45C4-9382-BA392FD022C4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:rc7:*:*:*:*:*:*","matchCriteriaId":"E0C256E6-2691-4478-A51C-DE580A717AB9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid infinite loops caused by residual data\n\nOn the mkdir/mknod path, when mapping logical blocks to physical blocks,\nif inserting a new extent into the extent tree fails (in this example,\nbecause the file system disabled the huge file feature when marking the\ninode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to\nreclaim the physical block without deleting the corresponding data in\nthe extent tree. This causes subsequent mkdir operations to reference\nthe previously reclaimed physical block number again, even though this\nphysical block is already being used by the xattr block. Therefore, a\nsituation arises where both the directory and xattr are using the same\nbuffer head block in memory simultaneously.\n\nThe above causes ext4_xattr_block_set() to enter an infinite loop about\n\"inserted\" and cannot release the inode lock, ultimately leading to the\n143s blocking problem mentioned in [1].\n\nIf the metadata is corrupted, then trying to remove some extent space\ncan do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE\nwas passed, remove space wrongly update quota information.\nJan Kara suggests distinguishing between two cases:\n\n1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully\nconsistent and we must maintain its consistency including all the\naccounting. However these errors can happen only early before we've\ninserted the extent into the extent tree. So current code works correctly\nfor this case.\n\n2) Some other error - this means metadata is corrupted. We should strive to\ndo as few modifications as possible to limit damage. So I'd just skip\nfreeing of allocated blocks.\n\n[1]\nINFO: task syz.0.17:5995 blocked for more than 143 seconds.\nCall Trace:\n inode_lock_nested include/linux/fs.h:1073 [inline]\n __start_dirop fs/namei.c:2923 [inline]\n start_dirop fs/namei.c:2934 [inline]"}],"id":"CVE-2026-31448","lastModified":"2026-11-10T13:18:54.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31448","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:25.858485Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:38.760","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a7667595bcad84da53fc156a418e110267c3412"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/416c86f30f91b4fb2642ef6b102596ca898f41a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5422fe71d26d42af6c454ca9527faaad4e677d6c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/64f425b06b3bea9abc8977fd3982779b3ad070c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c66545e83a802c3851d9be27a41c0479dd29ff0c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ecc50bfca9b5c2ee6aeef998181689b80477367b"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-835"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/extents.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c66545e83a802c3851d9be27a41c0479dd29ff0c","status":"affected","version":"315054f023d28ee64f308adf8b5737831541776b","versionType":"git"},{"lessThan":"ecc50bfca9b5c2ee6aeef998181689b80477367b","status":"affected","version":"315054f023d28ee64f308adf8b5737831541776b","versionType":"git"},{"lessThan":"3a7667595bcad84da53fc156a418e110267c3412","status":"affected","version":"315054f023d28ee64f308adf8b5737831541776b","versionType":"git"},{"lessThan":"416c86f30f91b4fb2642ef6b102596ca898f41a5","status":"affected","version":"315054f023d28ee64f308adf8b5737831541776b","versionType":"git"},{"lessThan":"64f425b06b3bea9abc8977fd3982779b3ad070c9","status":"affected","version":"315054f023d28ee64f308adf8b5737831541776b","versionType":"git"},{"lessThan":"5422fe71d26d42af6c454ca9527faaad4e677d6c","status":"affected","version":"315054f023d28ee64f308adf8b5737831541776b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/extents.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"09A2CD65-1CD4-45BC-AB86-2A903D823B07","versionEndExcluding":"6.1.168","versionStartIncluding":"2.6.22.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:-:*:*:*:*:*:*","matchCriteriaId":"7F7D6C66-3384-4ACC-9D08-C5A26B4FD004","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:rc4:*:*:*:*:*:*","matchCriteriaId":"6465E61D-0238-4ED3-B4CB-E3B93F4F324F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:rc5:*:*:*:*:*:*","matchCriteriaId":"830B8340-2B8F-4F0A-8943-F4413411573C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:rc6:*:*:*:*:*:*","matchCriteriaId":"D123AAFE-3F17-45C4-9382-BA392FD022C4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:rc7:*:*:*:*:*:*","matchCriteriaId":"E0C256E6-2691-4478-A51C-DE580A717AB9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid infinite loops caused by residual data\n\nOn the mkdir/mknod path, when mapping logical blocks to physical blocks,\nif inserting a new extent into the extent tree fails (in this example,\nbecause the file system disabled the huge file feature when marking the\ninode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to\nreclaim the physical block without deleting the corresponding data in\nthe extent tree. This causes subsequent mkdir operations to reference\nthe previously reclaimed physical block number again, even though this\nphysical block is already being used by the xattr block. Therefore, a\nsituation arises where both the directory and xattr are using the same\nbuffer head block in memory simultaneously.\n\nThe above causes ext4_xattr_block_set() to enter an infinite loop about\n\"inserted\" and cannot release the inode lock, ultimately leading to the\n143s blocking problem mentioned in [1].\n\nIf the metadata is corrupted, then trying to remove some extent space\ncan do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE\nwas passed, remove space wrongly update quota information.\nJan Kara suggests distinguishing between two cases:\n\n1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully\nconsistent and we must maintain its consistency including all the\naccounting. However these errors can happen only early before we've\ninserted the extent into the extent tree. So current code works correctly\nfor this case.\n\n2) Some other error - this means metadata is corrupted. We should strive to\ndo as few modifications as possible to limit damage. So I'd just skip\nfreeing of allocated blocks.\n\n[1]\nINFO: task syz.0.17:5995 blocked for more than 143 seconds.\nCall Trace:\n inode_lock_nested include/linux/fs.h:1073 [inline]\n __start_dirop fs/namei.c:2923 [inline]\n start_dirop fs/namei.c:2934 [inline]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: evitar bucles infinitos causados por datos residuales\n\nEn la ruta mkdir/mknod, al mapear bloques lógicos a bloques físicos, si la inserción de un nuevo extent en el árbol de extents falla (en este ejemplo, porque el sistema de archivos deshabilitó la característica de archivos grandes al marcar el inodo como sucio), ext4_ext_map_blocks() solo llama a ext4_free_blocks() para reclamar el bloque físico sin eliminar los datos correspondientes en el árbol de extents. Esto hace que las operaciones mkdir posteriores referencien de nuevo el número de bloque físico previamente reclamado, aunque este bloque físico ya esté siendo utilizado por el bloque xattr. Por lo tanto, surge una situación en la que tanto el directorio como xattr están utilizando el mismo bloque de cabecera de búfer en memoria simultáneamente.\n\nLo anterior hace que ext4_xattr_block_set() entre en un bucle infinito sobre ’inserted’ y no pueda liberar el bloqueo del inodo, lo que finalmente lleva al problema de bloqueo de 143s mencionado en [1].\n\nSi los metadatos están corruptos, entonces intentar eliminar algo de espacio de extent puede causar aún más daño. También en caso de que se pasara EXT4_GET_BLOCKS_DELALLOC_RESERVE, la eliminación de espacio actualiza erróneamente la información de cuota. Jan Kara sugiere distinguir entre dos casos:\n\n1) El error es ENOSPC o EDQUOT - en este caso el sistema de archivos es totalmente consistente y debemos mantener su consistencia incluyendo toda la contabilidad. Sin embargo, estos errores solo pueden ocurrir temprano antes de haber insertado el extent en el árbol de extents. Por lo tanto, el código actual funciona correctamente para este caso.\n\n2) Algún otro error - esto significa que los metadatos están corruptos. Debemos esforzarnos por hacer la menor cantidad de modificaciones posible para limitar el daño. Así que simplemente omitiría la liberación de bloques asignados.\n\n[1]\nINFO: la tarea syz.0.17:5995 bloqueada durante más de 143 segundos.\nTraza de Llamada:\n inode_lock_nested include/linux/fs.h:1073 [inline]\n __start_dirop fs/namei.c:2923 [inline]\n start_dirop fs/namei.c:2934 [inline]"}],"id":"CVE-2026-31448","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31448","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:25.858485Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:38.760","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a7667595bcad84da53fc156a418e110267c3412"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/416c86f30f91b4fb2642ef6b102596ca898f41a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5422fe71d26d42af6c454ca9527faaad4e677d6c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/64f425b06b3bea9abc8977fd3982779b3ad070c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c66545e83a802c3851d9be27a41c0479dd29ff0c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ecc50bfca9b5c2ee6aeef998181689b80477367b"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-835"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31449.json b/data/2026/CVE-2026-31449.json index 9e0e1c58b1..a254d945ec 100644 --- a/data/2026/CVE-2026-31449.json +++ b/data/2026/CVE-2026-31449.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/extents.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"39d6e2b67651614bac0dc6592fa9836321910067","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"c5839b34704c9c2f47f079451bdbb22de0da1ed1","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"10242e640b36b91ad03d25f3dc77854bbdff8358","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"4d08401aa13f1531216f1a7ae281ca4806e90a5c","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"407c944f217c17d4343148011acafebc604d55e1","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"93f2e975ed658ce09db4d4c2877ca2c06540df83","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"01bf1e0b997d82c0e353b51ed74ef99698043c33","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/extents.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.19"},{"lessThan":"2.6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6126AEF2-0176-48D1-96AD-72781F726931","versionEndExcluding":"6.12.80","versionStartIncluding":"2.6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:-:*:*:*:*:*:*","matchCriteriaId":"9E2DBD4C-9DD9-4DD3-87CB-A0070A789CEA","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:rc2:*:*:*:*:*:*","matchCriteriaId":"8D97ED16-D6B7-4445-889C-4D6DE2EDC49A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:rc3:*:*:*:*:*:*","matchCriteriaId":"B2C2D5D4-9A4B-4CDF-8D71-D22EB5E97D5A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:rc4:*:*:*:*:*:*","matchCriteriaId":"DFFB2843-A867-48EC-97D7-B106C7BBAED0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:rc5:*:*:*:*:*:*","matchCriteriaId":"3CD3FE23-1A10-47E6-AD7E-D67F1BE3C5E2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:rc6:*:*:*:*:*:*","matchCriteriaId":"9F39FC76-7D77-4064-94D3-A16C436FA8D1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: validate p_idx bounds in ext4_ext_correct_indexes\n\next4_ext_correct_indexes() walks up the extent tree correcting\nindex entries when the first extent in a leaf is modified. Before\naccessing path[k].p_idx->ei_block, there is no validation that\np_idx falls within the valid range of index entries for that\nlevel.\n\nIf the on-disk extent header contains a corrupted or crafted\neh_entries value, p_idx can point past the end of the allocated\nbuffer, causing a slab-out-of-bounds read.\n\nFix this by validating path[k].p_idx against EXT_LAST_INDEX() at\nboth access sites: before the while loop and inside it. Return\n-EFSCORRUPTED if the index pointer is out of range, consistent\nwith how other bounds violations are handled in the ext4 extent\ntree code."}],"id":"CVE-2026-31449","lastModified":"2026-11-10T13:18:55.167","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31449","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:29.200842Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:38.933","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/01bf1e0b997d82c0e353b51ed74ef99698043c33"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/10242e640b36b91ad03d25f3dc77854bbdff8358"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/39d6e2b67651614bac0dc6592fa9836321910067"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/407c944f217c17d4343148011acafebc604d55e1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4d08401aa13f1531216f1a7ae281ca4806e90a5c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/93f2e975ed658ce09db4d4c2877ca2c06540df83"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c5839b34704c9c2f47f079451bdbb22de0da1ed1"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/extents.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"39d6e2b67651614bac0dc6592fa9836321910067","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"c5839b34704c9c2f47f079451bdbb22de0da1ed1","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"10242e640b36b91ad03d25f3dc77854bbdff8358","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"4d08401aa13f1531216f1a7ae281ca4806e90a5c","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"407c944f217c17d4343148011acafebc604d55e1","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"93f2e975ed658ce09db4d4c2877ca2c06540df83","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"01bf1e0b997d82c0e353b51ed74ef99698043c33","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"},{"lessThan":"2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8","status":"affected","version":"a86c61812637c7dd0c57e29880cffd477b62f2e7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/extents.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.19"},{"lessThan":"2.6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6126AEF2-0176-48D1-96AD-72781F726931","versionEndExcluding":"6.12.80","versionStartIncluding":"2.6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:-:*:*:*:*:*:*","matchCriteriaId":"9E2DBD4C-9DD9-4DD3-87CB-A0070A789CEA","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:rc2:*:*:*:*:*:*","matchCriteriaId":"8D97ED16-D6B7-4445-889C-4D6DE2EDC49A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:rc3:*:*:*:*:*:*","matchCriteriaId":"B2C2D5D4-9A4B-4CDF-8D71-D22EB5E97D5A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:rc4:*:*:*:*:*:*","matchCriteriaId":"DFFB2843-A867-48EC-97D7-B106C7BBAED0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:rc5:*:*:*:*:*:*","matchCriteriaId":"3CD3FE23-1A10-47E6-AD7E-D67F1BE3C5E2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:rc6:*:*:*:*:*:*","matchCriteriaId":"9F39FC76-7D77-4064-94D3-A16C436FA8D1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: validate p_idx bounds in ext4_ext_correct_indexes\n\next4_ext_correct_indexes() walks up the extent tree correcting\nindex entries when the first extent in a leaf is modified. Before\naccessing path[k].p_idx->ei_block, there is no validation that\np_idx falls within the valid range of index entries for that\nlevel.\n\nIf the on-disk extent header contains a corrupted or crafted\neh_entries value, p_idx can point past the end of the allocated\nbuffer, causing a slab-out-of-bounds read.\n\nFix this by validating path[k].p_idx against EXT_LAST_INDEX() at\nboth access sites: before the while loop and inside it. Return\n-EFSCORRUPTED if the index pointer is out of range, consistent\nwith how other bounds violations are handled in the ext4 extent\ntree code."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: validar los límites de p_idx en ext4_ext_correct_indexes\n\next4_ext_correct_indexes() recorre el árbol de extensiones corrigiendo las entradas de índice cuando se modifica la primera extensión en una hoja. Antes de acceder a path[k].p_idx -> ei_block, no hay validación de que p_idx caiga dentro del rango válido de entradas de índice para ese nivel.\n\nSi el encabezado de extensión en disco contiene un valor eh_entries corrupto o manipulado, p_idx puede apuntar más allá del final del búfer asignado, causando una lectura fuera de límites de slab.\n\nEsto se soluciona validando path[k].p_idx contra EXT_LAST_INDEX() en ambos sitios de acceso: antes del bucle while y dentro de él. Devolver -EFSCORRUPTED si el puntero de índice está fuera de rango, consistente con cómo se manejan otras violaciones de límites en el código del árbol de extensiones ext4."}],"id":"CVE-2026-31449","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31449","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:29.200842Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:38.933","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/01bf1e0b997d82c0e353b51ed74ef99698043c33"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/10242e640b36b91ad03d25f3dc77854bbdff8358"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2acb5c12ebd860f30e4faf67e6cc8c44ddfe5fe8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/39d6e2b67651614bac0dc6592fa9836321910067"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/407c944f217c17d4343148011acafebc604d55e1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4d08401aa13f1531216f1a7ae281ca4806e90a5c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/93f2e975ed658ce09db4d4c2877ca2c06540df83"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c5839b34704c9c2f47f079451bdbb22de0da1ed1"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31450.json b/data/2026/CVE-2026-31450.json index 2ba8a2dab9..931c06264b 100644 --- a/data/2026/CVE-2026-31450.json +++ b/data/2026/CVE-2026-31450.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/fast_commit.c","fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2d2b648960147d078b000b9a7494017082024366","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"e4325e84727e539c8597bd5b8491349f57f7fb17","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"be54c0055407a73b60349c093c8ce621cb8fa232","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"a070d5a872ffe0e0fe5c46eda6386140ded39adb","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"e76bcb727e4874a2f9d0297f8e3f8eced89b0764","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"4855a59e21789c79f003a9b5f4135c95a7495c6b","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"33f486987af21531a7b18973d11795ede3da9ddd","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"1aec30021edd410b986c156f195f3d23959a9d11","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/fast_commit.c","fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.11"},{"lessThan":"3.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D551F379-6F0A-4DEB-8B71-04D5BA144557","versionEndExcluding":"5.10.253","versionStartIncluding":"3.11.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.11:-:*:*:*:*:*:*","matchCriteriaId":"FFA03B39-B26C-4A32-BCBD-7FA1D8A7CF66","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.11:rc6:*:*:*:*:*:*","matchCriteriaId":"0A9BB94F-A4F5-43A4-BF7E-BA9C7C9E8D65","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.11:rc7:*:*:*:*:*:*","matchCriteriaId":"6AD69FCC-EB5B-4565-861A-9D831BD541A2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: publish jinode after initialization\n\next4_inode_attach_jinode() publishes ei->jinode to concurrent users.\nIt used to set ei->jinode before jbd2_journal_init_jbd_inode(),\nallowing a reader to observe a non-NULL jinode with i_vfs_inode\nstill unset.\n\nThe fast commit flush path can then pass this jinode to\njbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and\nmay crash.\n\nBelow is the crash I observe:\n```\nBUG: unable to handle page fault for address: 000000010beb47f4\nPGD 110e51067 P4D 110e51067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\nRIP: 0010:xas_find_marked+0x3d/0x2e0\nCode: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02\nRSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246\nRAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003\nRDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10\nRBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec\nR10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000\nR13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88\nFS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n\nfilemap_get_folios_tag+0x87/0x2a0\n__filemap_fdatawait_range+0x5f/0xd0\n? srso_alias_return_thunk+0x5/0xfbef5\n? __schedule+0x3e7/0x10c0\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? cap_safe_nice+0x37/0x70\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\nfilemap_fdatawait_range_keep_errors+0x12/0x40\next4_fc_commit+0x697/0x8b0\n? ext4_file_write_iter+0x64b/0x950\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? vfs_write+0x356/0x480\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\next4_sync_file+0xf7/0x370\ndo_fsync+0x3b/0x80\n? syscall_trace_enter+0x108/0x1d0\n__x64_sys_fdatasync+0x16/0x20\ndo_syscall_64+0x62/0x2c0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n...\n```\n\nFix this by initializing the jbd2_inode first.\nUse smp_wmb() and WRITE_ONCE() to publish ei->jinode after\ninitialization. Readers use READ_ONCE() to fetch the pointer."}],"id":"CVE-2026-31450","lastModified":"2026-11-10T13:18:55.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31450","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:32.438868Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:39.083","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1aec30021edd410b986c156f195f3d23959a9d11"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2d2b648960147d078b000b9a7494017082024366"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33f486987af21531a7b18973d11795ede3da9ddd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4855a59e21789c79f003a9b5f4135c95a7495c6b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a070d5a872ffe0e0fe5c46eda6386140ded39adb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/be54c0055407a73b60349c093c8ce621cb8fa232"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e4325e84727e539c8597bd5b8491349f57f7fb17"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e76bcb727e4874a2f9d0297f8e3f8eced89b0764"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/fast_commit.c","fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2d2b648960147d078b000b9a7494017082024366","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"e4325e84727e539c8597bd5b8491349f57f7fb17","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"be54c0055407a73b60349c093c8ce621cb8fa232","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"a070d5a872ffe0e0fe5c46eda6386140ded39adb","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"e76bcb727e4874a2f9d0297f8e3f8eced89b0764","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"4855a59e21789c79f003a9b5f4135c95a7495c6b","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"33f486987af21531a7b18973d11795ede3da9ddd","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"},{"lessThan":"1aec30021edd410b986c156f195f3d23959a9d11","status":"affected","version":"a361293f5fedea0016a10599f409631a15d47ee7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/fast_commit.c","fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.11"},{"lessThan":"3.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D551F379-6F0A-4DEB-8B71-04D5BA144557","versionEndExcluding":"5.10.253","versionStartIncluding":"3.11.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.11:-:*:*:*:*:*:*","matchCriteriaId":"FFA03B39-B26C-4A32-BCBD-7FA1D8A7CF66","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.11:rc6:*:*:*:*:*:*","matchCriteriaId":"0A9BB94F-A4F5-43A4-BF7E-BA9C7C9E8D65","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.11:rc7:*:*:*:*:*:*","matchCriteriaId":"6AD69FCC-EB5B-4565-861A-9D831BD541A2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: publish jinode after initialization\n\next4_inode_attach_jinode() publishes ei->jinode to concurrent users.\nIt used to set ei->jinode before jbd2_journal_init_jbd_inode(),\nallowing a reader to observe a non-NULL jinode with i_vfs_inode\nstill unset.\n\nThe fast commit flush path can then pass this jinode to\njbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and\nmay crash.\n\nBelow is the crash I observe:\n```\nBUG: unable to handle page fault for address: 000000010beb47f4\nPGD 110e51067 P4D 110e51067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\nRIP: 0010:xas_find_marked+0x3d/0x2e0\nCode: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02\nRSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246\nRAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003\nRDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10\nRBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec\nR10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000\nR13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88\nFS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n\nfilemap_get_folios_tag+0x87/0x2a0\n__filemap_fdatawait_range+0x5f/0xd0\n? srso_alias_return_thunk+0x5/0xfbef5\n? __schedule+0x3e7/0x10c0\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? cap_safe_nice+0x37/0x70\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\nfilemap_fdatawait_range_keep_errors+0x12/0x40\next4_fc_commit+0x697/0x8b0\n? ext4_file_write_iter+0x64b/0x950\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? vfs_write+0x356/0x480\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\next4_sync_file+0xf7/0x370\ndo_fsync+0x3b/0x80\n? syscall_trace_enter+0x108/0x1d0\n__x64_sys_fdatasync+0x16/0x20\ndo_syscall_64+0x62/0x2c0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n...\n```\n\nFix this by initializing the jbd2_inode first.\nUse smp_wmb() and WRITE_ONCE() to publish ei->jinode after\ninitialization. Readers use READ_ONCE() to fetch the pointer."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: ext4: publicar jinode después de la inicialización ext4_inode_attach_jinode() publica ei -> jinode a usuarios concurrentes.\nSolía establecer ei -> jinode antes de jbd2_journal_init_jbd_inode(), permitiendo a un lector observar un jinode no nulo con i_vfs_inode aún sin establecer. La ruta de vaciado de commit rápido puede entonces pasar este jinode a jbd2_wait_inode_data(), que desreferencia i_vfs_inode -> i_mapping y puede fallar. A continuación se muestra el fallo que observo:\n””“\nBUG: unable to handle page fault for address: 000000010beb47f4\nPGD 110e51067 P4D 110e51067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\nRIP: 0010:xas_find_marked+0x3d/0x2e0\nCode: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f menor que 49mayor que 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02\nRSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246\nRAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003\nRDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10\nRBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec\nR10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000\nR13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88\nFS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n[TASK]\nfilemap_get_folios_tag+0x87/0x2a0\n__filemap_fdatawait_range+0x5f/0xd0\n? srso_alias_return_thunk+0x5/0x fbef5\n? __schedule+0x3e7/0x 10c0\n? srso_alias_return_thunk+0x5/0x fbef5\n? srso_alias_return_thunk+0x5/0x fbef5\n? srso_alias_return_thunk+0x5/0x fbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0x fbef5\n? cap_safe_nice+0x37/0x70\n? srso_alias_return_thunk+0x5/0x fbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0x fbef5\nfilemap_fdatawait_range_keep_errors+0x12/0x40\next4_fc_commit+0x697/0x8b0\n? ext4_file_write_iter+0x64b/0x950\n? srso_alias_return_thunk+0x5/0x fbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0x fbef5\n? vfs_write+0x356/0x480\n? srso_alias_return_thunk+0x5/0x fbef5\n? preempt_count_sub+0x5f/0x80\next4_sync_file+0xf7/0x370\ndo_fsync+0x3b/0x80\n? syscall_trace_enter+0x108/0x1d0\n__x64_sys_fdatasync+0x16/0x20\ndo_syscall_64+0x62/0x2c0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n...\n””” Solucione esto inicializando primero el jbd2_inode.\nUse smp_wmb() y WRITE_ONCE() para publicar ei -> jinode después de la inicialización. Los lectores usan READ_ONCE() para obtener el puntero."}],"id":"CVE-2026-31450","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31450","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:32.438868Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:39.083","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1aec30021edd410b986c156f195f3d23959a9d11"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2d2b648960147d078b000b9a7494017082024366"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33f486987af21531a7b18973d11795ede3da9ddd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4855a59e21789c79f003a9b5f4135c95a7495c6b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a070d5a872ffe0e0fe5c46eda6386140ded39adb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/be54c0055407a73b60349c093c8ce621cb8fa232"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e4325e84727e539c8597bd5b8491349f57f7fb17"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e76bcb727e4874a2f9d0297f8e3f8eced89b0764"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31451.json b/data/2026/CVE-2026-31451.json index bdbc090f41..7d88c4f38b 100644 --- a/data/2026/CVE-2026-31451.json +++ b/data/2026/CVE-2026-31451.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/inline.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3462a3f0716d27af51896dc8688bcf0628fb17ee","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"636e8d85a36ab6c31aafd04ee66a69b18eebee7b","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"af25a6affeac4919e8d8c5cccc01a9d53478447e","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"65c6c30ce6362c1c684568744ea510c921a756cd","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"823849a26af089ffc5dfdd2ae4b9d446b46a0cda","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"a7d600e04732a7d29b107c91fe3aec64cf6ce7f2","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"356227096eb66e41b23caf7045e6304877322edf","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/inline.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.8"},{"lessThan":"3.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.260","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.211","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C7421A18-3E1B-4F5B-B109-BF19C115EA7A","versionEndExcluding":"6.6.131","versionStartIncluding":"3.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: replace BUG_ON with proper error handling in ext4_read_inline_folio\n\nReplace BUG_ON() with proper error handling when inline data size\nexceeds PAGE_SIZE. This prevents kernel panic and allows the system to\ncontinue running while properly reporting the filesystem corruption.\n\nThe error is logged via ext4_error_inode(), the buffer head is released\nto prevent memory leak, and -EFSCORRUPTED is returned to indicate\nfilesystem corruption."}],"id":"CVE-2026-31451","lastModified":"2026-11-05T22:18:32.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31451","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:45.502116Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:39.310","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3462a3f0716d27af51896dc8688bcf0628fb17ee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/356227096eb66e41b23caf7045e6304877322edf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/636e8d85a36ab6c31aafd04ee66a69b18eebee7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65c6c30ce6362c1c684568744ea510c921a756cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/823849a26af089ffc5dfdd2ae4b9d446b46a0cda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7d600e04732a7d29b107c91fe3aec64cf6ce7f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/af25a6affeac4919e8d8c5cccc01a9d53478447e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/inline.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3462a3f0716d27af51896dc8688bcf0628fb17ee","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"636e8d85a36ab6c31aafd04ee66a69b18eebee7b","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"af25a6affeac4919e8d8c5cccc01a9d53478447e","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"65c6c30ce6362c1c684568744ea510c921a756cd","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"823849a26af089ffc5dfdd2ae4b9d446b46a0cda","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"a7d600e04732a7d29b107c91fe3aec64cf6ce7f2","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"},{"lessThan":"356227096eb66e41b23caf7045e6304877322edf","status":"affected","version":"46c7f254543dedcf134ad05091ed2b935a9a597d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/inline.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.8"},{"lessThan":"3.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.260","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.211","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C7421A18-3E1B-4F5B-B109-BF19C115EA7A","versionEndExcluding":"6.6.131","versionStartIncluding":"3.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: replace BUG_ON with proper error handling in ext4_read_inline_folio\n\nReplace BUG_ON() with proper error handling when inline data size\nexceeds PAGE_SIZE. This prevents kernel panic and allows the system to\ncontinue running while properly reporting the filesystem corruption.\n\nThe error is logged via ext4_error_inode(), the buffer head is released\nto prevent memory leak, and -EFSCORRUPTED is returned to indicate\nfilesystem corruption."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: reemplazar BUG_ON con un manejo de errores adecuado en ext4_read_inline_folio\n\nReemplazar BUG_ON() con un manejo de errores adecuado cuando el tamaño de los datos en línea excede PAGE_SIZE. Esto previene un pánico del kernel y permite que el sistema continúe ejecutándose mientras informa adecuadamente la corrupción del sistema de archivos.\n\nEl error se registra a través de ext4_error_inode(), el encabezado del búfer se libera para prevenir una fuga de memoria, y se devuelve -EFSCORRUPTED para indicar corrupción del sistema de archivos."}],"id":"CVE-2026-31451","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31451","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:45.502116Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:39.310","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3462a3f0716d27af51896dc8688bcf0628fb17ee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/356227096eb66e41b23caf7045e6304877322edf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/636e8d85a36ab6c31aafd04ee66a69b18eebee7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65c6c30ce6362c1c684568744ea510c921a756cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/823849a26af089ffc5dfdd2ae4b9d446b46a0cda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7d600e04732a7d29b107c91fe3aec64cf6ce7f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/af25a6affeac4919e8d8c5cccc01a9d53478447e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31452.json b/data/2026/CVE-2026-31452.json index cca9edcf46..7e1c513fb4 100644 --- a/data/2026/CVE-2026-31452.json +++ b/data/2026/CVE-2026-31452.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"110d7ef602659ce4d7947c5480f7ca2779696aaf","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"f53a5d9f32924bc2a810d2df243b7714da58b636","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"c047332be7195833a5c5126816c2502df8269fe4","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"699bac4d4c951974d55b045c983d1de777215949","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"7920dcc571cef3d8aa9ee109c136125d61d41669","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"07c1a31af18290054da3d18221b8bf58983c5d3a","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"ed9356a30e59c7cc3198e7fc46cfedf3767b9b17","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.8"},{"lessThan":"3.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"75026C47-58A0-4758-8F32-8C374525DEA1","versionEndExcluding":"5.10.253","versionStartIncluding":"3.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: convert inline data to extents when truncate exceeds inline size\n\nAdd a check in ext4_setattr() to convert files from inline data storage\nto extent-based storage when truncate() grows the file size beyond the\ninline capacity. This prevents the filesystem from entering an\ninconsistent state where the inline data flag is set but the file size\nexceeds what can be stored inline.\n\nWithout this fix, the following sequence causes a kernel BUG_ON():\n\n1. Mount filesystem with inode that has inline flag set and small size\n2. truncate(file, 50MB) - grows size but inline flag remains set\n3. sendfile() attempts to write data\n4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity)\n\nThe crash occurs because ext4_write_inline_data() expects inline storage\nto accommodate the write, but the actual inline capacity (~60 bytes for\ni_block + ~96 bytes for xattrs) is far smaller than the file size and\nwrite request.\n\nThe fix checks if the new size from setattr exceeds the inode's actual\ninline capacity (EXT4_I(inode)->i_inline_size) and converts the file to\nextent-based storage before proceeding with the size change.\n\nThis addresses the root cause by ensuring the inline data flag and file\nsize remain consistent during truncate operations."}],"id":"CVE-2026-31452","lastModified":"2026-11-10T13:18:55.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31452","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:52.534537Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:39.460","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07c1a31af18290054da3d18221b8bf58983c5d3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/110d7ef602659ce4d7947c5480f7ca2779696aaf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/699bac4d4c951974d55b045c983d1de777215949"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7920dcc571cef3d8aa9ee109c136125d61d41669"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c047332be7195833a5c5126816c2502df8269fe4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ed9356a30e59c7cc3198e7fc46cfedf3767b9b17"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f53a5d9f32924bc2a810d2df243b7714da58b636"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"110d7ef602659ce4d7947c5480f7ca2779696aaf","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"f53a5d9f32924bc2a810d2df243b7714da58b636","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"c047332be7195833a5c5126816c2502df8269fe4","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"699bac4d4c951974d55b045c983d1de777215949","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"7920dcc571cef3d8aa9ee109c136125d61d41669","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"07c1a31af18290054da3d18221b8bf58983c5d3a","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"},{"lessThan":"ed9356a30e59c7cc3198e7fc46cfedf3767b9b17","status":"affected","version":"67cf5b09a46f72e048501b84996f2f77bc42e947","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.8"},{"lessThan":"3.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"75026C47-58A0-4758-8F32-8C374525DEA1","versionEndExcluding":"5.10.253","versionStartIncluding":"3.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: convert inline data to extents when truncate exceeds inline size\n\nAdd a check in ext4_setattr() to convert files from inline data storage\nto extent-based storage when truncate() grows the file size beyond the\ninline capacity. This prevents the filesystem from entering an\ninconsistent state where the inline data flag is set but the file size\nexceeds what can be stored inline.\n\nWithout this fix, the following sequence causes a kernel BUG_ON():\n\n1. Mount filesystem with inode that has inline flag set and small size\n2. truncate(file, 50MB) - grows size but inline flag remains set\n3. sendfile() attempts to write data\n4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity)\n\nThe crash occurs because ext4_write_inline_data() expects inline storage\nto accommodate the write, but the actual inline capacity (~60 bytes for\ni_block + ~96 bytes for xattrs) is far smaller than the file size and\nwrite request.\n\nThe fix checks if the new size from setattr exceeds the inode's actual\ninline capacity (EXT4_I(inode)->i_inline_size) and converts the file to\nextent-based storage before proceeding with the size change.\n\nThis addresses the root cause by ensuring the inline data flag and file\nsize remain consistent during truncate operations."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\next4: convertir datos en línea a extensiones cuando truncate excede el tamaño en línea\n\nAñadir una comprobación en ext4_setattr() para convertir archivos de almacenamiento de datos en línea a almacenamiento basado en extensiones cuando truncate() aumenta el tamaño del archivo más allá de la capacidad en línea. Esto evita que el sistema de archivos entre en un estado inconsistente donde el indicador de datos en línea está establecido pero el tamaño del archivo excede lo que se puede almacenar en línea.\n\nSin esta corrección, la siguiente secuencia causa un BUG_ON() del kernel:\n\n1. Montar el sistema de archivos con un inodo que tiene el indicador en línea establecido y tamaño pequeño\n2. truncate(archivo, 50MB) - aumenta el tamaño pero el indicador en línea permanece establecido\n3. sendfile() intenta escribir datos\n4. ext4_write_inline_data() alcanza BUG_ON(write_size > inline_capacity)\n\nEl fallo ocurre porque ext4_write_inline_data() espera que el almacenamiento en línea acomode la escritura, pero la capacidad en línea real (~60 bytes para i_block + ~96 bytes para xattrs) es mucho menor que el tamaño del archivo y la solicitud de escritura.\n\nLa corrección comprueba si el nuevo tamaño de setattr excede la capacidad en línea real del inodo (EXT4_I(inode) -> i_inline_size) y convierte el archivo a almacenamiento basado en extensiones antes de proceder con el cambio de tamaño.\n\nEsto aborda la causa raíz al asegurar que el indicador de datos en línea y el tamaño del archivo permanezcan consistentes durante las operaciones de truncate."}],"id":"CVE-2026-31452","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31452","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:52.534537Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:39.460","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07c1a31af18290054da3d18221b8bf58983c5d3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/110d7ef602659ce4d7947c5480f7ca2779696aaf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/699bac4d4c951974d55b045c983d1de777215949"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7920dcc571cef3d8aa9ee109c136125d61d41669"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c047332be7195833a5c5126816c2502df8269fe4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ed9356a30e59c7cc3198e7fc46cfedf3767b9b17"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f53a5d9f32924bc2a810d2df243b7714da58b636"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31453.json b/data/2026/CVE-2026-31453.json index f0620d526e..7ebcd459eb 100644 --- a/data/2026/CVE-2026-31453.json +++ b/data/2026/CVE-2026-31453.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/xfs/xfs_trace.h","fs/xfs/xfs_trans_ail.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c8a2ab339b88d10fc34a3318c92f07d8a467019d","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"7121b22b0bac89394cc4c6a54b5aebc15347bdf5","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"c4d603e8e58a3bf35480135ccca2b4f7238abda5","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"95fb5d643cc70959baa54cd17f52f80ffc3295e7","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"451c6329d9afa45862c36fe6677eb7750db60617","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"79ef34ec0554ec04bdbafafbc9836423734e1bd6","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/xfs/xfs_trace.h","fs/xfs/xfs_trans_ail.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"414365AB-14F7-4EE5-87C1-E6EAD2BEFA8F","versionEndExcluding":"6.1.168","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: avoid dereferencing log items after push callbacks\n\nAfter xfsaild_push_item() calls iop_push(), the log item may have been\nfreed if the AIL lock was dropped during the push. Background inode\nreclaim or the dquot shrinker can free the log item while the AIL lock\nis not held, and the tracepoints in the switch statement dereference\nthe log item after iop_push() returns.\n\nFix this by capturing the log item type, flags, and LSN before calling\nxfsaild_push_item(), and introducing a new xfs_ail_push_class trace\nevent class that takes these pre-captured values and the ailp pointer\ninstead of the log item pointer."}],"id":"CVE-2026-31453","lastModified":"2026-10-19T19:17:54.777","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31453","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:37.370268Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:39.653","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/451c6329d9afa45862c36fe6677eb7750db60617"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7121b22b0bac89394cc4c6a54b5aebc15347bdf5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/79ef34ec0554ec04bdbafafbc9836423734e1bd6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95fb5d643cc70959baa54cd17f52f80ffc3295e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4d603e8e58a3bf35480135ccca2b4f7238abda5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8a2ab339b88d10fc34a3318c92f07d8a467019d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/xfs/xfs_trace.h","fs/xfs/xfs_trans_ail.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c8a2ab339b88d10fc34a3318c92f07d8a467019d","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"7121b22b0bac89394cc4c6a54b5aebc15347bdf5","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"c4d603e8e58a3bf35480135ccca2b4f7238abda5","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"95fb5d643cc70959baa54cd17f52f80ffc3295e7","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"451c6329d9afa45862c36fe6677eb7750db60617","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"79ef34ec0554ec04bdbafafbc9836423734e1bd6","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/xfs/xfs_trace.h","fs/xfs/xfs_trans_ail.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"414365AB-14F7-4EE5-87C1-E6EAD2BEFA8F","versionEndExcluding":"6.1.168","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: avoid dereferencing log items after push callbacks\n\nAfter xfsaild_push_item() calls iop_push(), the log item may have been\nfreed if the AIL lock was dropped during the push. Background inode\nreclaim or the dquot shrinker can free the log item while the AIL lock\nis not held, and the tracepoints in the switch statement dereference\nthe log item after iop_push() returns.\n\nFix this by capturing the log item type, flags, and LSN before calling\nxfsaild_push_item(), and introducing a new xfs_ail_push_class trace\nevent class that takes these pre-captured values and the ailp pointer\ninstead of the log item pointer."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfs: evitar la desreferenciación de elementos de registro después de las devoluciones de llamada de ’push’\n\nDespués de que xfsaild_push_item() llama a iop_push(), el elemento de registro puede haber sido liberado si el bloqueo AIL se liberó durante el ’push’. La recuperación de inodos en segundo plano o el reductor de dquot pueden liberar el elemento de registro mientras el bloqueo AIL no está retenido, y los puntos de rastreo en la instrucción ’switch’ desreferencian el elemento de registro después de que iop_push() regresa.\n\nEsto se soluciona capturando el tipo de elemento de registro, las banderas y el LSN antes de llamar a xfsaild_push_item(), e introduciendo una nueva clase de evento de rastreo xfs_ail_push_class que toma estos valores pre-capturados y el puntero ailp en lugar del puntero del elemento de registro."}],"id":"CVE-2026-31453","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31453","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:37.370268Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:39.653","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/451c6329d9afa45862c36fe6677eb7750db60617"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7121b22b0bac89394cc4c6a54b5aebc15347bdf5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/79ef34ec0554ec04bdbafafbc9836423734e1bd6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95fb5d643cc70959baa54cd17f52f80ffc3295e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4d603e8e58a3bf35480135ccca2b4f7238abda5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8a2ab339b88d10fc34a3318c92f07d8a467019d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31454.json b/data/2026/CVE-2026-31454.json index cf0bc2c091..13dd7ff128 100644 --- a/data/2026/CVE-2026-31454.json +++ b/data/2026/CVE-2026-31454.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/xfs/xfs_dquot_item.c","fs/xfs/xfs_inode_item.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"edd1637d4e3911ab6c760f553f2040fe72f61a13","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"19437e4f7bb909afde832b39372aa2f3ce3cfd88","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"6dbe17f19c290a72ce57d5abc70e1fad0c3e14e5","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"75669e987137f49c99ca44406bf0200d1892dd16","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"d8fc60bbaf5aea1604bf9f4ed565da6a1ac7a87d","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"50f5f056807b7bed74f4f307f2ca0ed92f3e556d","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"4c7d50147316cf049462f327c4a3e9dc2b7f1dd0","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"394d70b86fae9fe865e7e6d9540b7696f73aa9b6","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/xfs/xfs_dquot_item.c","fs/xfs/xfs_inode_item.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"21B274FB-38BA-4107-B442-283511DC26AB","versionEndExcluding":"5.10.253","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: save ailp before dropping the AIL lock in push callbacks\n\nIn xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock\nis dropped to perform buffer IO. Once the cluster buffer no longer\nprotects the log item from reclaim, the log item may be freed by\nbackground reclaim or the dquot shrinker. The subsequent spin_lock()\ncall dereferences lip->li_ailp, which is a use-after-free.\n\nFix this by saving the ailp pointer in a local variable while the AIL\nlock is held and the log item is guaranteed to be valid."}],"id":"CVE-2026-31454","lastModified":"2026-10-19T19:17:54.943","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31454","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:39.757301Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:39.823","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/19437e4f7bb909afde832b39372aa2f3ce3cfd88"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/394d70b86fae9fe865e7e6d9540b7696f73aa9b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c7d50147316cf049462f327c4a3e9dc2b7f1dd0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/50f5f056807b7bed74f4f307f2ca0ed92f3e556d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6dbe17f19c290a72ce57d5abc70e1fad0c3e14e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75669e987137f49c99ca44406bf0200d1892dd16"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8fc60bbaf5aea1604bf9f4ed565da6a1ac7a87d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/edd1637d4e3911ab6c760f553f2040fe72f61a13"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/xfs/xfs_dquot_item.c","fs/xfs/xfs_inode_item.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"edd1637d4e3911ab6c760f553f2040fe72f61a13","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"19437e4f7bb909afde832b39372aa2f3ce3cfd88","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"6dbe17f19c290a72ce57d5abc70e1fad0c3e14e5","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"75669e987137f49c99ca44406bf0200d1892dd16","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"d8fc60bbaf5aea1604bf9f4ed565da6a1ac7a87d","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"50f5f056807b7bed74f4f307f2ca0ed92f3e556d","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"4c7d50147316cf049462f327c4a3e9dc2b7f1dd0","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"394d70b86fae9fe865e7e6d9540b7696f73aa9b6","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/xfs/xfs_dquot_item.c","fs/xfs/xfs_inode_item.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"21B274FB-38BA-4107-B442-283511DC26AB","versionEndExcluding":"5.10.253","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: save ailp before dropping the AIL lock in push callbacks\n\nIn xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock\nis dropped to perform buffer IO. Once the cluster buffer no longer\nprotects the log item from reclaim, the log item may be freed by\nbackground reclaim or the dquot shrinker. The subsequent spin_lock()\ncall dereferences lip->li_ailp, which is a use-after-free.\n\nFix this by saving the ailp pointer in a local variable while the AIL\nlock is held and the log item is guaranteed to be valid."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfs: guardar ailp antes de liberar el bloqueo AIL en las retrollamadas de ’push’\n\nEn xfs_inode_item_push() y xfs_qm_dquot_logitem_push(), el bloqueo AIL es liberado para realizar E/S de búfer. Una vez que el búfer de clúster ya no protege el elemento de registro de la reclamación, el elemento de registro puede ser liberado por la reclamación en segundo plano o el ’shrinker’ de dquot. La llamada subsiguiente a spin_lock() desreferencia lip -> li_ailp, lo cual es un uso después de liberación.\n\nSolucionar esto guardando el puntero ailp en una variable local mientras el bloqueo AIL está retenido y se garantiza que el elemento de registro es válido."}],"id":"CVE-2026-31454","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31454","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:39.757301Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:39.823","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/19437e4f7bb909afde832b39372aa2f3ce3cfd88"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/394d70b86fae9fe865e7e6d9540b7696f73aa9b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c7d50147316cf049462f327c4a3e9dc2b7f1dd0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/50f5f056807b7bed74f4f307f2ca0ed92f3e556d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6dbe17f19c290a72ce57d5abc70e1fad0c3e14e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75669e987137f49c99ca44406bf0200d1892dd16"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8fc60bbaf5aea1604bf9f4ed565da6a1ac7a87d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/edd1637d4e3911ab6c760f553f2040fe72f61a13"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31455.json b/data/2026/CVE-2026-31455.json index e6ab9b01b1..421501f373 100644 --- a/data/2026/CVE-2026-31455.json +++ b/data/2026/CVE-2026-31455.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/xfs/xfs_mount.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e6cc490048f78b009259a5f032acead9f789c34c","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"239d734c00644072862fa833805c4471573b1445","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"bda27fc0b4eb3a425d9a18475c4cb94fbe862c60","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"d38135af04a3ad8a585c899d176efc8e97853115","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"a89434a6188d8430ea31120da96e3e4cefb58686","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"8147e304d7d32fd5c3e943babc296ce2873dc279","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"558e3275d8a3b101be18a7fe7d1634053e9d9b07","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"4f24a767e3d64a5f58c595b5c29b6063a201f1e3","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/xfs/xfs_mount.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"21B274FB-38BA-4107-B442-283511DC26AB","versionEndExcluding":"5.10.253","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: stop reclaim before pushing AIL during unmount\n\nThe unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while\nbackground reclaim and inodegc are still running. This is broken\nindependently of any use-after-free issues - background reclaim and\ninodegc should not be running while the AIL is being pushed during\nunmount, as inodegc can dirty and insert inodes into the AIL during the\nflush, and background reclaim can race to abort and free dirty inodes.\n\nReorder xfs_unmount_flush_inodes() to stop inodegc and cancel background\nreclaim before pushing the AIL. Stop inodegc before cancelling\nm_reclaim_work because the inodegc worker can re-queue m_reclaim_work\nvia xfs_inodegc_set_reclaimable."}],"id":"CVE-2026-31455","lastModified":"2026-11-05T22:18:32.450","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:58.259693Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:40.013","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/239d734c00644072862fa833805c4471573b1445"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f24a767e3d64a5f58c595b5c29b6063a201f1e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/558e3275d8a3b101be18a7fe7d1634053e9d9b07"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8147e304d7d32fd5c3e943babc296ce2873dc279"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a89434a6188d8430ea31120da96e3e4cefb58686"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bda27fc0b4eb3a425d9a18475c4cb94fbe862c60"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d38135af04a3ad8a585c899d176efc8e97853115"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6cc490048f78b009259a5f032acead9f789c34c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/xfs/xfs_mount.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e6cc490048f78b009259a5f032acead9f789c34c","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"239d734c00644072862fa833805c4471573b1445","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"bda27fc0b4eb3a425d9a18475c4cb94fbe862c60","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"d38135af04a3ad8a585c899d176efc8e97853115","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"a89434a6188d8430ea31120da96e3e4cefb58686","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"8147e304d7d32fd5c3e943babc296ce2873dc279","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"558e3275d8a3b101be18a7fe7d1634053e9d9b07","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"},{"lessThan":"4f24a767e3d64a5f58c595b5c29b6063a201f1e3","status":"affected","version":"90c60e16401248a4900f3f9387f563d0178dcf34","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/xfs/xfs_mount.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"21B274FB-38BA-4107-B442-283511DC26AB","versionEndExcluding":"5.10.253","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: stop reclaim before pushing AIL during unmount\n\nThe unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while\nbackground reclaim and inodegc are still running. This is broken\nindependently of any use-after-free issues - background reclaim and\ninodegc should not be running while the AIL is being pushed during\nunmount, as inodegc can dirty and insert inodes into the AIL during the\nflush, and background reclaim can race to abort and free dirty inodes.\n\nReorder xfs_unmount_flush_inodes() to stop inodegc and cancel background\nreclaim before pushing the AIL. Stop inodegc before cancelling\nm_reclaim_work because the inodegc worker can re-queue m_reclaim_work\nvia xfs_inodegc_set_reclaimable."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfs: detener la recuperación antes de empujar el AIL durante el desmontaje\n\nLa secuencia de desmontaje en xfs_unmount_flush_inodes() empujaba el AIL mientras la recuperación en segundo plano y inodegc todavía están en ejecución. Esto está roto independientemente de cualquier problema de uso después de liberación - la recuperación en segundo plano y inodegc no deberían estar en ejecución mientras el AIL está siendo empujado durante el desmontaje, ya que inodegc puede ensuciar e insertar inodos en el AIL durante la descarga, y la recuperación en segundo plano puede competir para abortar y liberar inodos sucios.\n\nReordenar xfs_unmount_flush_inodes() para detener inodegc y cancelar la recuperación en segundo plano antes de empujar el AIL. Detener inodegc antes de cancelar m_reclaim_work porque el trabajador de inodegc puede volver a encolar m_reclaim_work a través de xfs_inodegc_set_reclaimable."}],"id":"CVE-2026-31455","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:33:58.259693Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:40.013","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/239d734c00644072862fa833805c4471573b1445"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f24a767e3d64a5f58c595b5c29b6063a201f1e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/558e3275d8a3b101be18a7fe7d1634053e9d9b07"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8147e304d7d32fd5c3e943babc296ce2873dc279"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a89434a6188d8430ea31120da96e3e4cefb58686"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bda27fc0b4eb3a425d9a18475c4cb94fbe862c60"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d38135af04a3ad8a585c899d176efc8e97853115"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6cc490048f78b009259a5f032acead9f789c34c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31456.json b/data/2026/CVE-2026-31456.json index 78f20e2c1d..80dbed5350 100644 --- a/data/2026/CVE-2026-31456.json +++ b/data/2026/CVE-2026-31456.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/pagewalk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"138ada1337b47cc5efb08e517674d46f86268274","status":"affected","version":"f9e54c3a2f5b79ecc57c7bc7d0d3521e461a2101","versionType":"git"},{"lessThan":"38ec58670a0c5fc1edabdeccd857e586b7b3f318","status":"affected","version":"f9e54c3a2f5b79ecc57c7bc7d0d3521e461a2101","versionType":"git"},{"lessThan":"9bbbebd94dd5be25ec8c899d46ef01b33d5d22c0","status":"affected","version":"f9e54c3a2f5b79ecc57c7bc7d0d3521e461a2101","versionType":"git"},{"lessThan":"3b89863c3fa482912911cd65a12a3aeef662c250","status":"affected","version":"f9e54c3a2f5b79ecc57c7bc7d0d3521e461a2101","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/pagewalk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"93477C16-86F4-42D8-A83F-3E95FF0B26F8","versionEndExcluding":"6.18.21","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/pagewalk: fix race between concurrent split and refault\n\nThe splitting of a PUD entry in walk_pud_range() can race with a\nconcurrent thread refaulting the PUD leaf entry causing it to try walking\na PMD range that has disappeared.\n\nAn example and reproduction of this is to try reading numa_maps of a\nprocess while VFIO-PCI is setting up DMA (specifically the\nvfio_pin_pages_remote call) on a large BAR for that process.\n\nThis will trigger a kernel BUG:\nvfio-pci 0000:03:00.0: enabling device (0000 -> 0002)\nBUG: unable to handle page fault for address: ffffa23980000000\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\n...\nRIP: 0010:walk_pgd_range+0x3b5/0x7a0\nCode: 8d 43 ff 48 89 44 24 28 4d 89 ce 4d 8d a7 00 00 20 00 48 8b 4c 24\n28 49 81 e4 00 00 e0 ff 49 8d 44 24 ff 48 39 c8 4c 0f 43 e3 <49> f7 06\n 9f ff ff ff 75 3b 48 8b 44 24 20 48 8b 40 28 48 85 c0 74\nRSP: 0018:ffffac23e1ecf808 EFLAGS: 00010287\nRAX: 00007f44c01fffff RBX: 00007f4500000000 RCX: 00007f44ffffffff\nRDX: 0000000000000000 RSI: 000ffffffffff000 RDI: ffffffff93378fe0\nRBP: ffffac23e1ecf918 R08: 0000000000000004 R09: ffffa23980000000\nR10: 0000000000000020 R11: 0000000000000004 R12: 00007f44c0200000\nR13: 00007f44c0000000 R14: ffffa23980000000 R15: 00007f44c0000000\nFS: 00007fe884739580(0000) GS:ffff9b7d7a9c0000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffa23980000000 CR3: 000000c0650e2005 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace:\n \n __walk_page_range+0x195/0x1b0\n walk_page_vma+0x62/0xc0\n show_numa_map+0x12b/0x3b0\n seq_read_iter+0x297/0x440\n seq_read+0x11d/0x140\n vfs_read+0xc2/0x340\n ksys_read+0x5f/0xe0\n do_syscall_64+0x68/0x130\n ? get_page_from_freelist+0x5c2/0x17e0\n ? mas_store_prealloc+0x17e/0x360\n ? vma_set_page_prot+0x4c/0xa0\n ? __alloc_pages_noprof+0x14e/0x2d0\n ? __mod_memcg_lruvec_state+0x8d/0x140\n ? __lruvec_stat_mod_folio+0x76/0xb0\n ? __folio_mod_stat+0x26/0x80\n ? do_anonymous_page+0x705/0x900\n ? __handle_mm_fault+0xa8d/0x1000\n ? __count_memcg_events+0x53/0xf0\n ? handle_mm_fault+0xa5/0x360\n ? do_user_addr_fault+0x342/0x640\n ? arch_exit_to_user_mode_prepare.constprop.0+0x16/0xa0\n ? irqentry_exit_to_user_mode+0x24/0x100\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7fe88464f47e\nCode: c0 e9 b6 fe ff ff 50 48 8d 3d be 07 0b 00 e8 69 01 02 00 66 0f 1f\n84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00\n f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28\nRSP: 002b:00007ffe6cd9a9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\nRAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fe88464f47e\nRDX: 0000000000020000 RSI: 00007fe884543000 RDI: 0000000000000003\nRBP: 00007fe884543000 R08: 00007fe884542010 R09: 0000000000000000\nR10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000\n \n\nFix this by validating the PUD entry in walk_pmd_range() using a stable\nsnapshot (pudp_get()). If the PUD is not present or is a leaf, retry the\nwalk via ACTION_AGAIN instead of descending further. This mirrors the\nretry logic in walk_pte_range(), which lets walk_pmd_range() retry if the\nPTE is not being got by pte_offset_map_lock()."}],"id":"CVE-2026-31456","lastModified":"2026-11-05T22:18:32.627","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:05.906495Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:40.203","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/138ada1337b47cc5efb08e517674d46f86268274"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/38ec58670a0c5fc1edabdeccd857e586b7b3f318"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b89863c3fa482912911cd65a12a3aeef662c250"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9bbbebd94dd5be25ec8c899d46ef01b33d5d22c0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/pagewalk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"138ada1337b47cc5efb08e517674d46f86268274","status":"affected","version":"f9e54c3a2f5b79ecc57c7bc7d0d3521e461a2101","versionType":"git"},{"lessThan":"38ec58670a0c5fc1edabdeccd857e586b7b3f318","status":"affected","version":"f9e54c3a2f5b79ecc57c7bc7d0d3521e461a2101","versionType":"git"},{"lessThan":"9bbbebd94dd5be25ec8c899d46ef01b33d5d22c0","status":"affected","version":"f9e54c3a2f5b79ecc57c7bc7d0d3521e461a2101","versionType":"git"},{"lessThan":"3b89863c3fa482912911cd65a12a3aeef662c250","status":"affected","version":"f9e54c3a2f5b79ecc57c7bc7d0d3521e461a2101","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/pagewalk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"93477C16-86F4-42D8-A83F-3E95FF0B26F8","versionEndExcluding":"6.18.21","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/pagewalk: fix race between concurrent split and refault\n\nThe splitting of a PUD entry in walk_pud_range() can race with a\nconcurrent thread refaulting the PUD leaf entry causing it to try walking\na PMD range that has disappeared.\n\nAn example and reproduction of this is to try reading numa_maps of a\nprocess while VFIO-PCI is setting up DMA (specifically the\nvfio_pin_pages_remote call) on a large BAR for that process.\n\nThis will trigger a kernel BUG:\nvfio-pci 0000:03:00.0: enabling device (0000 -> 0002)\nBUG: unable to handle page fault for address: ffffa23980000000\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\n...\nRIP: 0010:walk_pgd_range+0x3b5/0x7a0\nCode: 8d 43 ff 48 89 44 24 28 4d 89 ce 4d 8d a7 00 00 20 00 48 8b 4c 24\n28 49 81 e4 00 00 e0 ff 49 8d 44 24 ff 48 39 c8 4c 0f 43 e3 <49> f7 06\n 9f ff ff ff 75 3b 48 8b 44 24 20 48 8b 40 28 48 85 c0 74\nRSP: 0018:ffffac23e1ecf808 EFLAGS: 00010287\nRAX: 00007f44c01fffff RBX: 00007f4500000000 RCX: 00007f44ffffffff\nRDX: 0000000000000000 RSI: 000ffffffffff000 RDI: ffffffff93378fe0\nRBP: ffffac23e1ecf918 R08: 0000000000000004 R09: ffffa23980000000\nR10: 0000000000000020 R11: 0000000000000004 R12: 00007f44c0200000\nR13: 00007f44c0000000 R14: ffffa23980000000 R15: 00007f44c0000000\nFS: 00007fe884739580(0000) GS:ffff9b7d7a9c0000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffa23980000000 CR3: 000000c0650e2005 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace:\n \n __walk_page_range+0x195/0x1b0\n walk_page_vma+0x62/0xc0\n show_numa_map+0x12b/0x3b0\n seq_read_iter+0x297/0x440\n seq_read+0x11d/0x140\n vfs_read+0xc2/0x340\n ksys_read+0x5f/0xe0\n do_syscall_64+0x68/0x130\n ? get_page_from_freelist+0x5c2/0x17e0\n ? mas_store_prealloc+0x17e/0x360\n ? vma_set_page_prot+0x4c/0xa0\n ? __alloc_pages_noprof+0x14e/0x2d0\n ? __mod_memcg_lruvec_state+0x8d/0x140\n ? __lruvec_stat_mod_folio+0x76/0xb0\n ? __folio_mod_stat+0x26/0x80\n ? do_anonymous_page+0x705/0x900\n ? __handle_mm_fault+0xa8d/0x1000\n ? __count_memcg_events+0x53/0xf0\n ? handle_mm_fault+0xa5/0x360\n ? do_user_addr_fault+0x342/0x640\n ? arch_exit_to_user_mode_prepare.constprop.0+0x16/0xa0\n ? irqentry_exit_to_user_mode+0x24/0x100\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7fe88464f47e\nCode: c0 e9 b6 fe ff ff 50 48 8d 3d be 07 0b 00 e8 69 01 02 00 66 0f 1f\n84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00\n f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28\nRSP: 002b:00007ffe6cd9a9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\nRAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fe88464f47e\nRDX: 0000000000020000 RSI: 00007fe884543000 RDI: 0000000000000003\nRBP: 00007fe884543000 R08: 00007fe884542010 R09: 0000000000000000\nR10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000\n \n\nFix this by validating the PUD entry in walk_pmd_range() using a stable\nsnapshot (pudp_get()). If the PUD is not present or is a leaf, retry the\nwalk via ACTION_AGAIN instead of descending further. This mirrors the\nretry logic in walk_pte_range(), which lets walk_pmd_range() retry if the\nPTE is not being got by pte_offset_map_lock()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: mm/pagewalk: corregir condición de carrera entre división concurrente y refault La división de una entrada PUD en walk_pud_range() puede entrar en condición de carrera con un hilo concurrente que provoca un refault en la entrada hoja PUD, haciendo que intente recorrer un rango PMD que ha desaparecido. Un ejemplo y reproducción de esto es intentar leer los numa_maps de un proceso mientras VFIO-PCI está configurando DMA (específicamente la llamada vfio_pin_pages_remote) en un BAR grande para ese proceso. Esto activará un BUG del kernel:\nvfio-pci 0000:03:00.0: enabling device (0000 -mayor que 0002)\nBUG: unable to handle page fault for address: ffffa23980000000\nPGD 0 P4D 0\nOops: Oops: 0000 [#1] SMP NOPTI\n...\nRIP: 0010:walk_pgd_range+0x3b5/0x7a0\nCode: 8d 43 ff 48 89 44 24 28 4d 89 ce 4d 8d a7 00 00 20 00 48 8b 4c 24\n28 49 81 e4 00 00 e0 ff 49 8d 44 24 ff 48 39 c8 4c 0f 43 e3 menor que 49> f7 06 9f ff ff ff 75 3b 48 8b 44 24 20 48 8b 40 28 48 85 c0 74\nRSP: 0018:ffffac23e1ecf808 EFLAGS: 00010287\nRAX: 00007f44c01fffff RBX: 00007f4500000000 RCX: 00007f44ffffffff\nRDX: 0000000000000000 RSI: 000ffffffffff000 RDI: ffffffff93378fe0\nRBP: ffffac23e1ecf918 R08: 0000000000000004 R09: ffffa23980000000\nR10: 0000000000000020 R11: 0000000000000004 R12: 00007f44c0200000\nR13: 00007f44c0000000 R14: ffffa23980000000 R15: 00007f44c0000000\nFS: 00007fe884739580(0000) GS:ffff9b7d7a9c0000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffa23980000000 CR3: 000000c0650e2005 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace: [TASK] __walk_page_range+0x195/0x1b0 walk_page_vma+0x62/0xc0 show_numa_map+0x12b/0x3b0 seq_read_iter+0x297/0x440 seq_read+0x11d/0x140 vfs_read+0xc2/0x340 ksys_read+0x5f/0xe0 do_syscall_64+0x68/0x130 ? get_page_from_freelist+0x5c2/0x 17e0 ? mas_store_prealloc+0x17e/0x360 ? vma_set_page_prot+0x4c/0xa0 ? __alloc_pages_noprof+0x14e/0x2d0 ? __mod_memcg_lruvec_state+0x8d/0x140 ? __lruvec_stat_mod_folio+0x76/0xb0 ? __folio_mod_stat+0x26/0x80 ? do_anonymous_page+0x705/0x900 ? __handle_mm_fault+0xa8d/0x 1000 ? __count_memcg_events+0x53/0xf0 ? handle_mm_fault+0xa5/0x360 ? do_user_addr_fault+0x342/0x640 ? arch_exit_to_user_mode_prepare.constprop.0+0x16/0xa0 ? irqentry_exit_to_user_mode+0x24/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x 7fe88464f47e\nCode: c0 e9 b6 fe ff ff 50 48 8d 3d be 07 0b 00 e8 69 01 02 00 66 0f 1f\n84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 menor que 48mayor que 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28\nRSP: 002b:00007ffe6cd9a9b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\nRAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fe88464f47e\nRDX: 0000000000020000 RSI: 00007fe884543000 RDI: 0000000000000003\nRBP: 00007fe884543000 R08: 00007fe884542010 R09: 0000000000000000\nR10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 [/TASK] Solucione esto validando la entrada PUD en walk_pmd_range() usando una instantánea estable (pudp_get()). Si la PUD no está presente o es una hoja, reintente el recorrido a través de ACTION_AGAIN en lugar de descender más. Esto refleja la lógica de reintento en walk_pte_range(), que permite a walk_pmd_range() reintentar si la PTE no está siendo obtenida por pte_offset_map_lock()."}],"id":"CVE-2026-31456","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:05.906495Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:40.203","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/138ada1337b47cc5efb08e517674d46f86268274"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/38ec58670a0c5fc1edabdeccd857e586b7b3f318"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b89863c3fa482912911cd65a12a3aeef662c250"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9bbbebd94dd5be25ec8c899d46ef01b33d5d22c0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31457.json b/data/2026/CVE-2026-31457.json index a0908fc72c..6d06fd8a21 100644 --- a/data/2026/CVE-2026-31457.json +++ b/data/2026/CVE-2026-31457.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3527e9fdc38570cea0f6ddb7a2c9303d4044b217","status":"affected","version":"d809a7c64ba8229286b333c0cba03b1cdfb50238","versionType":"git"},{"lessThan":"652cd0641a763dd0e846b0d12814977fadb2b7d8","status":"affected","version":"d809a7c64ba8229286b333c0cba03b1cdfb50238","versionType":"git"},{"lessThan":"6557004a8b59c7701e695f02be03c7e20ed1cc15","status":"affected","version":"d809a7c64ba8229286b333c0cba03b1cdfb50238","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8D13D961-0092-4AE8-81A5-114EBA80D8ED","versionEndExcluding":"6.18.21","versionStartIncluding":"6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: check contexts->nr in repeat_call_fn\n\ndamon_sysfs_repeat_call_fn() calls damon_sysfs_upd_tuned_intervals(),\ndamon_sysfs_upd_schemes_stats(), and\ndamon_sysfs_upd_schemes_effective_quotas() without checking contexts->nr. \nIf nr_contexts is set to 0 via sysfs while DAMON is running, these\nfunctions dereference contexts_arr[0] and cause a NULL pointer\ndereference. Add the missing check.\n\nFor example, the issue can be reproduced using DAMON sysfs interface and\nDAMON user-space tool (damo) [1] like below.\n\n $ sudo damo start --refresh_interval 1s\n $ echo 0 | sudo tee \\\n /sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contexts"}],"id":"CVE-2026-31457","lastModified":"2026-06-17T10:33:46.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:41.133","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3527e9fdc38570cea0f6ddb7a2c9303d4044b217"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/652cd0641a763dd0e846b0d12814977fadb2b7d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6557004a8b59c7701e695f02be03c7e20ed1cc15"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3527e9fdc38570cea0f6ddb7a2c9303d4044b217","status":"affected","version":"d809a7c64ba8229286b333c0cba03b1cdfb50238","versionType":"git"},{"lessThan":"652cd0641a763dd0e846b0d12814977fadb2b7d8","status":"affected","version":"d809a7c64ba8229286b333c0cba03b1cdfb50238","versionType":"git"},{"lessThan":"6557004a8b59c7701e695f02be03c7e20ed1cc15","status":"affected","version":"d809a7c64ba8229286b333c0cba03b1cdfb50238","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8D13D961-0092-4AE8-81A5-114EBA80D8ED","versionEndExcluding":"6.18.21","versionStartIncluding":"6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: check contexts->nr in repeat_call_fn\n\ndamon_sysfs_repeat_call_fn() calls damon_sysfs_upd_tuned_intervals(),\ndamon_sysfs_upd_schemes_stats(), and\ndamon_sysfs_upd_schemes_effective_quotas() without checking contexts->nr. \nIf nr_contexts is set to 0 via sysfs while DAMON is running, these\nfunctions dereference contexts_arr[0] and cause a NULL pointer\ndereference. Add the missing check.\n\nFor example, the issue can be reproduced using DAMON sysfs interface and\nDAMON user-space tool (damo) [1] like below.\n\n $ sudo damo start --refresh_interval 1s\n $ echo 0 | sudo tee \\\n /sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contexts"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/damon/sysfs: comprobar contexts -> nr en repeat_call_fn\n\ndamon_sysfs_repeat_call_fn() llama a damon_sysfs_upd_tuned_intervals(), damon_sysfs_upd_schemes_stats() y damon_sysfs_upd_schemes_effective_quotas() sin comprobar contexts -> nr. Si nr_contexts se establece en 0 a través de sysfs mientras DAMON está en ejecución, estas funciones desreferencian contexts_arr[0] y causan una desreferencia de puntero NULL. Añadir la comprobación que falta.\n\nPor ejemplo, el problema puede reproducirse utilizando la interfaz sysfs de DAMON y la herramienta de espacio de usuario de DAMON (damo) [1] como se muestra a continuación.\n\n $ sudo damo start - -refresh_interval 1s\n $ echo 0 | sudo tee \\\n /sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contexts"}],"id":"CVE-2026-31457","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:41.133","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3527e9fdc38570cea0f6ddb7a2c9303d4044b217"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/652cd0641a763dd0e846b0d12814977fadb2b7d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6557004a8b59c7701e695f02be03c7e20ed1cc15"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31458.json b/data/2026/CVE-2026-31458.json index 7755a1a1c4..59692ee418 100644 --- a/data/2026/CVE-2026-31458.json +++ b/data/2026/CVE-2026-31458.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"aba546061341b56e9ffb37e1eb661a3628b6ec12","status":"affected","version":"0ac32b8affb5a384253dbb8339bd2d0e91add0b7","versionType":"git"},{"lessThan":"1e8da792672481d603fa7cd0d815577220a3ee27","status":"affected","version":"0ac32b8affb5a384253dbb8339bd2d0e91add0b7","versionType":"git"},{"lessThan":"708033c231bd782858f4ddbb46ee874a5a5fbdab","status":"affected","version":"0ac32b8affb5a384253dbb8339bd2d0e91add0b7","versionType":"git"},{"lessThan":"bbe03ad3fb9e714191757ca7b41582f930be7be2","status":"affected","version":"0ac32b8affb5a384253dbb8339bd2d0e91add0b7","versionType":"git"},{"lessThan":"1bfe9fb5ed2667fb075682408b776b5273162615","status":"affected","version":"0ac32b8affb5a384253dbb8339bd2d0e91add0b7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D97A2DBE-7050-465E-8B7D-E7D3C8122FA9","versionEndExcluding":"6.6.131","versionStartIncluding":"5.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]\n\nMultiple sysfs command paths dereference contexts_arr[0] without first\nverifying that kdamond->contexts->nr == 1. A user can set nr_contexts to\n0 via sysfs while DAMON is running, causing NULL pointer dereferences.\n\nIn more detail, the issue can be triggered by privileged users like\nbelow.\n\nFirst, start DAMON and make contexts directory empty\n(kdamond->contexts->nr == 0).\n\n # damo start\n # cd /sys/kernel/mm/damon/admin/kdamonds/0\n # echo 0 > contexts/nr_contexts\n\nThen, each of below commands will cause the NULL pointer dereference.\n\n # echo update_schemes_stats > state\n # echo update_schemes_tried_regions > state\n # echo update_schemes_tried_bytes > state\n # echo update_schemes_effective_quotas > state\n # echo update_tuned_intervals > state\n\nGuard all commands (except OFF) at the entry point of\ndamon_sysfs_handle_cmd()."}],"id":"CVE-2026-31458","lastModified":"2026-11-05T22:18:32.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31458","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:11.121096Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:41.260","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1bfe9fb5ed2667fb075682408b776b5273162615"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1e8da792672481d603fa7cd0d815577220a3ee27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/708033c231bd782858f4ddbb46ee874a5a5fbdab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aba546061341b56e9ffb37e1eb661a3628b6ec12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bbe03ad3fb9e714191757ca7b41582f930be7be2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"aba546061341b56e9ffb37e1eb661a3628b6ec12","status":"affected","version":"0ac32b8affb5a384253dbb8339bd2d0e91add0b7","versionType":"git"},{"lessThan":"1e8da792672481d603fa7cd0d815577220a3ee27","status":"affected","version":"0ac32b8affb5a384253dbb8339bd2d0e91add0b7","versionType":"git"},{"lessThan":"708033c231bd782858f4ddbb46ee874a5a5fbdab","status":"affected","version":"0ac32b8affb5a384253dbb8339bd2d0e91add0b7","versionType":"git"},{"lessThan":"bbe03ad3fb9e714191757ca7b41582f930be7be2","status":"affected","version":"0ac32b8affb5a384253dbb8339bd2d0e91add0b7","versionType":"git"},{"lessThan":"1bfe9fb5ed2667fb075682408b776b5273162615","status":"affected","version":"0ac32b8affb5a384253dbb8339bd2d0e91add0b7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D97A2DBE-7050-465E-8B7D-E7D3C8122FA9","versionEndExcluding":"6.6.131","versionStartIncluding":"5.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: check contexts->nr before accessing contexts_arr[0]\n\nMultiple sysfs command paths dereference contexts_arr[0] without first\nverifying that kdamond->contexts->nr == 1. A user can set nr_contexts to\n0 via sysfs while DAMON is running, causing NULL pointer dereferences.\n\nIn more detail, the issue can be triggered by privileged users like\nbelow.\n\nFirst, start DAMON and make contexts directory empty\n(kdamond->contexts->nr == 0).\n\n # damo start\n # cd /sys/kernel/mm/damon/admin/kdamonds/0\n # echo 0 > contexts/nr_contexts\n\nThen, each of below commands will cause the NULL pointer dereference.\n\n # echo update_schemes_stats > state\n # echo update_schemes_tried_regions > state\n # echo update_schemes_tried_bytes > state\n # echo update_schemes_effective_quotas > state\n # echo update_tuned_intervals > state\n\nGuard all commands (except OFF) at the entry point of\ndamon_sysfs_handle_cmd()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/damon/sysfs: verificar contexts -> nr antes de acceder a contexts_arr[0]\n\nMúltiples rutas de comandos sysfs desreferencian contexts_arr[0] sin verificar primero que kdamond -> contexts -> nr == 1. Un usuario puede establecer nr_contexts en 0 a través de sysfs mientras DAMON está en ejecución, causando desreferencias de puntero NULL.\n\nEn más detalle, el problema puede ser activado por usuarios privilegiados como se muestra a continuación.\n\nPrimero, inicie DAMON y deje el directorio contexts vacío (kdamond -> contexts -> nr == 0).\n\n # damo start\n # cd /sys/kernel/mm/damon/admin/kdamonds/0\n # echo 0 > contexts/nr_contexts\n\nLuego, cada uno de los siguientes comandos causará la desreferencia del puntero NULL.\n\n # echo update_schemes_stats > state\n # echo update_schemes_tried_regions > state\n # echo update_schemes_tried_bytes > state\n # echo update_schemes_effective_quotas > state\n # echo update_tuned_intervals > state\n\nProteja todos los comandos (excepto OFF) en el punto de entrada de damon_sysfs_handle_cmd()."}],"id":"CVE-2026-31458","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31458","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:11.121096Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:41.260","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1bfe9fb5ed2667fb075682408b776b5273162615"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1e8da792672481d603fa7cd0d815577220a3ee27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/708033c231bd782858f4ddbb46ee874a5a5fbdab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aba546061341b56e9ffb37e1eb661a3628b6ec12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bbe03ad3fb9e714191757ca7b41582f930be7be2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31459.json b/data/2026/CVE-2026-31459.json index dd689ef0c8..fc604e4bcb 100644 --- a/data/2026/CVE-2026-31459.json +++ b/data/2026/CVE-2026-31459.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e9de9f3ce06b133a348006668bc8d25c6e504867","status":"affected","version":"f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f","versionType":"git"},{"lessThan":"f76f0a964bc3d7b7e253b43c669c41356bc54e71","status":"affected","version":"f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f","versionType":"git"},{"lessThan":"7fe000eb32904758a85e62f6ea9483f89d5dabfc","status":"affected","version":"f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f","versionType":"git"},{"status":"affected","version":"5b3609d9b9650bdea0bfdf643e0ce57e1aed67fc","versionType":"git"},{"lessThan":"6.18","status":"affected","version":"6.17.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2E98868-4027-46EE-AD08-92C9D7283181","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17.6:*:*:*:*:*:*:*","matchCriteriaId":"96264160-AE1C-4D8A-B740-47BD026914A4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*","matchCriteriaId":"DCE57113-2223-4308-A0F2-5E6ECFBB3C23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*","matchCriteriaId":"26CA425A-E44F-49D2-92D9-1DDD56398440","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*","matchCriteriaId":"BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*","matchCriteriaId":"2545FB83-C4A6-4F62-9ED1-09F75D2E3C78","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*","matchCriteriaId":"E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*","matchCriteriaId":"38C4D89F-9A13-4D29-8645-C9785C142C07","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure\n\nPatch series \"mm/damon/sysfs: fix memory leak and NULL dereference\nissues\", v4.\n\nDAMON_SYSFS can leak memory under allocation failure, and do NULL pointer\ndereference when a privileged user make wrong sequences of control. Fix\nthose.\n\n\nThis patch (of 3):\n\nWhen damon_sysfs_new_test_ctx() fails in damon_sysfs_commit_input(),\nparam_ctx is leaked because the early return skips the cleanup at the out\nlabel. Destroy param_ctx before returning."}],"id":"CVE-2026-31459","lastModified":"2026-06-17T10:33:46.980","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:41.417","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7fe000eb32904758a85e62f6ea9483f89d5dabfc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e9de9f3ce06b133a348006668bc8d25c6e504867"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f76f0a964bc3d7b7e253b43c669c41356bc54e71"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e9de9f3ce06b133a348006668bc8d25c6e504867","status":"affected","version":"f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f","versionType":"git"},{"lessThan":"f76f0a964bc3d7b7e253b43c669c41356bc54e71","status":"affected","version":"f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f","versionType":"git"},{"lessThan":"7fe000eb32904758a85e62f6ea9483f89d5dabfc","status":"affected","version":"f0c5118ebb0eb7e4fd6f0d2ace3315ca141b317f","versionType":"git"},{"status":"affected","version":"5b3609d9b9650bdea0bfdf643e0ce57e1aed67fc","versionType":"git"},{"lessThan":"6.18","status":"affected","version":"6.17.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2E98868-4027-46EE-AD08-92C9D7283181","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17.6:*:*:*:*:*:*:*","matchCriteriaId":"96264160-AE1C-4D8A-B740-47BD026914A4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*","matchCriteriaId":"DCE57113-2223-4308-A0F2-5E6ECFBB3C23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc3:*:*:*:*:*:*","matchCriteriaId":"26CA425A-E44F-49D2-92D9-1DDD56398440","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc4:*:*:*:*:*:*","matchCriteriaId":"BEEBB43A-4C9F-46BE-AA6D-9DBFD2244E55","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:*","matchCriteriaId":"2545FB83-C4A6-4F62-9ED1-09F75D2E3C78","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:*","matchCriteriaId":"E955EC5D-4684-4B5D-AE4D-F2BF9ADDBA1D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*","matchCriteriaId":"38C4D89F-9A13-4D29-8645-C9785C142C07","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure\n\nPatch series \"mm/damon/sysfs: fix memory leak and NULL dereference\nissues\", v4.\n\nDAMON_SYSFS can leak memory under allocation failure, and do NULL pointer\ndereference when a privileged user make wrong sequences of control. Fix\nthose.\n\n\nThis patch (of 3):\n\nWhen damon_sysfs_new_test_ctx() fails in damon_sysfs_commit_input(),\nparam_ctx is leaked because the early return skips the cleanup at the out\nlabel. Destroy param_ctx before returning."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/damon/sysfs: corregir fuga de param_ctx al fallar damon_sysfs_new_test_ctx()\n\nSerie de parches ’mm/damon/sysfs: corregir fuga de memoria y problemas de desreferencia de NULL’, v4.\n\nDAMON_SYSFS puede fugar memoria en caso de fallo de asignación y realizar desreferencia de puntero NULL cuando un usuario privilegiado realiza secuencias de control incorrectas. Corregir estos.\n\nEste parche (de 3):\n\nCuando damon_sysfs_new_test_ctx() falla en damon_sysfs_commit_input(), param_ctx se fuga porque el retorno anticipado omite la limpieza en la etiqueta ’out’. Destruir param_ctx antes de retornar."}],"id":"CVE-2026-31459","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:41.417","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7fe000eb32904758a85e62f6ea9483f89d5dabfc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e9de9f3ce06b133a348006668bc8d25c6e504867"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f76f0a964bc3d7b7e253b43c669c41356bc54e71"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31460.json b/data/2026/CVE-2026-31460.json index a59db4a05e..d9d0c5d791 100644 --- a/data/2026/CVE-2026-31460.json +++ b/data/2026/CVE-2026-31460.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"60b0524bfb7d691ab378cdc788209f11cd34da89","status":"affected","version":"1454642960b0a4fafd48b08919d39350ee2ac372","versionType":"git"},{"lessThan":"9da4f9964abcaeb6e19797d5e3b10faad338a786","status":"affected","version":"1454642960b0a4fafd48b08919d39350ee2ac372","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: check if ext_caps is valid in BL setup\n\nLVDS connectors don't have extended backlight caps so check\nif the pointer is valid before accessing it.\n\n(cherry picked from commit 3f797396d7f4eb9bb6eded184bbc6f033628a6f6)"}],"id":"CVE-2026-31460","lastModified":"2026-11-05T22:18:32.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:15.354899Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:41.550","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/60b0524bfb7d691ab378cdc788209f11cd34da89"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9da4f9964abcaeb6e19797d5e3b10faad338a786"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"60b0524bfb7d691ab378cdc788209f11cd34da89","status":"affected","version":"1454642960b0a4fafd48b08919d39350ee2ac372","versionType":"git"},{"lessThan":"9da4f9964abcaeb6e19797d5e3b10faad338a786","status":"affected","version":"1454642960b0a4fafd48b08919d39350ee2ac372","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: check if ext_caps is valid in BL setup\n\nLVDS connectors don't have extended backlight caps so check\nif the pointer is valid before accessing it.\n\n(cherry picked from commit 3f797396d7f4eb9bb6eded184bbc6f033628a6f6)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amd/display: comprobar si ext_caps es válido en la configuración de BL\n\nLos conectores LVDS no tienen capacidades de retroiluminación extendidas, así que comprobar si el puntero es válido antes de acceder a él.\n\n(extraído de la confirmación 3f797396d7f4eb9bb6eded184bbc6f033628a6f6)"}],"id":"CVE-2026-31460","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:15.354899Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:41.550","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/60b0524bfb7d691ab378cdc788209f11cd34da89"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9da4f9964abcaeb6e19797d5e3b10faad338a786"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31461.json b/data/2026/CVE-2026-31461.json index 4c5b593506..4621345bef 100644 --- a/data/2026/CVE-2026-31461.json +++ b/data/2026/CVE-2026-31461.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"eb95595194e4755b62360aa821f40a79b0953105","status":"affected","version":"48edb2a4256eedf6c92eecf2bc7744e6ecb44b5e","versionType":"git"},{"lessThan":"52db857e94b9be4e6315586602b0257d1d2b165a","status":"affected","version":"48edb2a4256eedf6c92eecf2bc7744e6ecb44b5e","versionType":"git"},{"lessThan":"37c2caa167b0b8aca4f74c32404c5288b876a2a3","status":"affected","version":"48edb2a4256eedf6c92eecf2bc7744e6ecb44b5e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix drm_edid leak in amdgpu_dm\n\n[WHAT]\nWhen a sink is connected, aconnector->drm_edid was overwritten without\nfreeing the previous allocation, causing a memory leak on resume.\n\n[HOW]\nFree the previous drm_edid before updating it.\n\n(cherry picked from commit 52024a94e7111366141cfc5d888b2ef011f879e5)"}],"id":"CVE-2026-31461","lastModified":"2026-11-05T22:18:33.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:20.064440Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:41.670","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/37c2caa167b0b8aca4f74c32404c5288b876a2a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/52db857e94b9be4e6315586602b0257d1d2b165a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb95595194e4755b62360aa821f40a79b0953105"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"eb95595194e4755b62360aa821f40a79b0953105","status":"affected","version":"48edb2a4256eedf6c92eecf2bc7744e6ecb44b5e","versionType":"git"},{"lessThan":"52db857e94b9be4e6315586602b0257d1d2b165a","status":"affected","version":"48edb2a4256eedf6c92eecf2bc7744e6ecb44b5e","versionType":"git"},{"lessThan":"37c2caa167b0b8aca4f74c32404c5288b876a2a3","status":"affected","version":"48edb2a4256eedf6c92eecf2bc7744e6ecb44b5e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix drm_edid leak in amdgpu_dm\n\n[WHAT]\nWhen a sink is connected, aconnector->drm_edid was overwritten without\nfreeing the previous allocation, causing a memory leak on resume.\n\n[HOW]\nFree the previous drm_edid before updating it.\n\n(cherry picked from commit 52024a94e7111366141cfc5d888b2ef011f879e5)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amd/display: Corrección de fuga de drm_edid en amdgpu_dm\n\n[QUÉ]\nCuando se conecta un sink, aconnector -> drm_edid era sobrescrito sin liberar la asignación anterior, causando una fuga de memoria al reanudar.\n\n[CÓMO]\nLiberar el drm_edid anterior antes de actualizarlo.\n\n(seleccionado del commit 52024a94e7111366141cfc5d888b2ef011f879e5)"}],"id":"CVE-2026-31461","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:20.064440Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:41.670","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/37c2caa167b0b8aca4f74c32404c5288b876a2a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/52db857e94b9be4e6315586602b0257d1d2b165a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb95595194e4755b62360aa821f40a79b0953105"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31462.json b/data/2026/CVE-2026-31462.json index d10e5bcb3a..fe329dc749 100644 --- a/data/2026/CVE-2026-31462.json +++ b/data/2026/CVE-2026-31462.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ids.h","drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"185a5e779c259869b8d5c20bd90e7a780c56576b","status":"affected","version":"02208441cc3a5110191996bb129db39ff10e7395","versionType":"git"},{"lessThan":"f69491478e3de0e3c6aac2ee89b3cda3f2471301","status":"affected","version":"02208441cc3a5110191996bb129db39ff10e7395","versionType":"git"},{"lessThan":"c0b3882836de8ac991b626823966f385555bbcff","status":"affected","version":"02208441cc3a5110191996bb129db39ff10e7395","versionType":"git"},{"lessThan":"51ccaf0e30c303149244c34820def83d74c86288","status":"affected","version":"02208441cc3a5110191996bb129db39ff10e7395","versionType":"git"},{"lessThan":"9e5ebfe99b223bb0eb9c50a125c9c02f4ef4c71b","status":"affected","version":"02208441cc3a5110191996bb129db39ff10e7395","versionType":"git"},{"lessThan":"14b81abe7bdc25f8097906fc2f91276ffedb2d26","status":"affected","version":"02208441cc3a5110191996bb129db39ff10e7395","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ids.h","drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5A3E723E-F905-4618-A51B-438D33EE9CAC","versionEndExcluding":"6.12.80","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: prevent immediate PASID reuse case\n\nPASID resue could cause interrupt issue when process\nimmediately runs into hw state left by previous\nprocess exited with the same PASID, it's possible that\npage faults are still pending in the IH ring buffer when\nthe process exits and frees up its PASID. To prevent the\ncase, it uses idr cyclic allocator same as kernel pid's.\n\n(cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d)"}],"id":"CVE-2026-31462","lastModified":"2026-11-05T22:18:33.247","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31462","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:25.763510Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:41.787","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14b81abe7bdc25f8097906fc2f91276ffedb2d26"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/185a5e779c259869b8d5c20bd90e7a780c56576b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51ccaf0e30c303149244c34820def83d74c86288"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e5ebfe99b223bb0eb9c50a125c9c02f4ef4c71b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c0b3882836de8ac991b626823966f385555bbcff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f69491478e3de0e3c6aac2ee89b3cda3f2471301"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ids.h","drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"185a5e779c259869b8d5c20bd90e7a780c56576b","status":"affected","version":"02208441cc3a5110191996bb129db39ff10e7395","versionType":"git"},{"lessThan":"f69491478e3de0e3c6aac2ee89b3cda3f2471301","status":"affected","version":"02208441cc3a5110191996bb129db39ff10e7395","versionType":"git"},{"lessThan":"c0b3882836de8ac991b626823966f385555bbcff","status":"affected","version":"02208441cc3a5110191996bb129db39ff10e7395","versionType":"git"},{"lessThan":"51ccaf0e30c303149244c34820def83d74c86288","status":"affected","version":"02208441cc3a5110191996bb129db39ff10e7395","versionType":"git"},{"lessThan":"9e5ebfe99b223bb0eb9c50a125c9c02f4ef4c71b","status":"affected","version":"02208441cc3a5110191996bb129db39ff10e7395","versionType":"git"},{"lessThan":"14b81abe7bdc25f8097906fc2f91276ffedb2d26","status":"affected","version":"02208441cc3a5110191996bb129db39ff10e7395","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ids.h","drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5A3E723E-F905-4618-A51B-438D33EE9CAC","versionEndExcluding":"6.12.80","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: prevent immediate PASID reuse case\n\nPASID resue could cause interrupt issue when process\nimmediately runs into hw state left by previous\nprocess exited with the same PASID, it's possible that\npage faults are still pending in the IH ring buffer when\nthe process exits and frees up its PASID. To prevent the\ncase, it uses idr cyclic allocator same as kernel pid's.\n\n(cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amdgpu: prevenir el caso de reutilización inmediata de PASID\n\nLa reutilización de PASID podría causar un problema de interrupción cuando un proceso se encuentra inmediatamente con el estado de hardware dejado por un proceso anterior que salió con el mismo PASID; es posible que las fallas de página aún estén pendientes en el búfer de anillo IH cuando el proceso sale y libera su PASID. Para prevenir el caso, utiliza un asignador cíclico idr igual que los pid del kernel.\n\n(seleccionado de la confirmación 8f1de51f49be692de137c8525106e0fce2d1912d)"}],"id":"CVE-2026-31462","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31462","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:25.763510Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:41.787","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14b81abe7bdc25f8097906fc2f91276ffedb2d26"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/185a5e779c259869b8d5c20bd90e7a780c56576b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51ccaf0e30c303149244c34820def83d74c86288"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e5ebfe99b223bb0eb9c50a125c9c02f4ef4c71b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c0b3882836de8ac991b626823966f385555bbcff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f69491478e3de0e3c6aac2ee89b3cda3f2471301"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31463.json b/data/2026/CVE-2026-31463.json index 479b54f613..9142166c59 100644 --- a/data/2026/CVE-2026-31463.json +++ b/data/2026/CVE-2026-31463.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/iomap/buffered-io.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4a927f670cdb0def226f9f85f42a9f19d9e09c88","status":"affected","version":"b2f35ac4146d32d4424aaa941bbc681f12c1b9e6","versionType":"git"},{"lessThan":"bd71fb3fea9945987053968f028a948997cba8cc","status":"affected","version":"b2f35ac4146d32d4424aaa941bbc681f12c1b9e6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/iomap/buffered-io.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: fix invalid folio access when i_blkbits differs from I/O granularity\n\nCommit aa35dd5cbc06 (\"iomap: fix invalid folio access after\nfolio_end_read()\") partially addressed invalid folio access for folios\nwithout an ifs attached, but it did not handle the case where\n1 << inode->i_blkbits matches the folio size but is different from the\ngranularity used for the IO, which means IO can be submitted for less\nthan the full folio for the !ifs case.\n\nIn this case, the condition:\n\n if (*bytes_submitted == folio_len)\n ctx->cur_folio = NULL;\n\nin iomap_read_folio_iter() will not invalidate ctx->cur_folio, and\niomap_read_end() will still be called on the folio even though the IO\nhelper owns it and will finish the read on it.\n\nFix this by unconditionally invalidating ctx->cur_folio for the !ifs\ncase."}],"id":"CVE-2026-31463","lastModified":"2026-06-17T10:33:47.373","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:42.323","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4a927f670cdb0def226f9f85f42a9f19d9e09c88"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd71fb3fea9945987053968f028a948997cba8cc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/iomap/buffered-io.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4a927f670cdb0def226f9f85f42a9f19d9e09c88","status":"affected","version":"b2f35ac4146d32d4424aaa941bbc681f12c1b9e6","versionType":"git"},{"lessThan":"bd71fb3fea9945987053968f028a948997cba8cc","status":"affected","version":"b2f35ac4146d32d4424aaa941bbc681f12c1b9e6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/iomap/buffered-io.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niomap: fix invalid folio access when i_blkbits differs from I/O granularity\n\nCommit aa35dd5cbc06 (\"iomap: fix invalid folio access after\nfolio_end_read()\") partially addressed invalid folio access for folios\nwithout an ifs attached, but it did not handle the case where\n1 << inode->i_blkbits matches the folio size but is different from the\ngranularity used for the IO, which means IO can be submitted for less\nthan the full folio for the !ifs case.\n\nIn this case, the condition:\n\n if (*bytes_submitted == folio_len)\n ctx->cur_folio = NULL;\n\nin iomap_read_folio_iter() will not invalidate ctx->cur_folio, and\niomap_read_end() will still be called on the folio even though the IO\nhelper owns it and will finish the read on it.\n\nFix this by unconditionally invalidating ctx->cur_folio for the !ifs\ncase."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niomap: corrige el acceso a folio inválido cuando i_blkbits difiere de la granularidad de E/S\n\nEl commit aa35dd5cbc06 (’iomap: corrige el acceso a folio inválido después de folio_end_read()’) abordó parcialmente el acceso a folio inválido para folios sin un ’ifs’ adjunto, pero no manejó el caso en que 1 << inode -> i_blkbits coincide con el tamaño del folio pero es diferente de la granularidad utilizada para la E/S, lo que significa que la E/S puede enviarse por menos del folio completo para el caso !ifs.\n\nEn este caso, la condición:\n\n if (bytes_submitted == folio_len)\n ctx -> cur_folio = NULL;\n\nen iomap_read_folio_iter() no invalidará ctx -> cur_folio, y iomap_read_end() seguirá siendo llamado en el folio aunque el ayudante de E/S lo posea y finalizará la lectura en él.\n\nSoluciona esto invalidando incondicionalmente ctx -> cur_folio para el caso !ifs."}],"id":"CVE-2026-31463","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:42.323","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4a927f670cdb0def226f9f85f42a9f19d9e09c88"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd71fb3fea9945987053968f028a948997cba8cc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31464.json b/data/2026/CVE-2026-31464.json index caa4fa8334..0fbf5f73b1 100644 --- a/data/2026/CVE-2026-31464.json +++ b/data/2026/CVE-2026-31464.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/scsi/ibmvscsi/ibmvfc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d842348f8a00d5b1d7358f207eb34ffcf5b16df3","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"a007246cb6c9ebdc93dafbf63cc2d43d98f402cc","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"4ed727e35b0ab17d3eeeb1e8023768396e2be161","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"d1466bf991b2343cf2ba8336e440c8faf3cbb780","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"786f10b1966e485046839f992e89f2c18cbd1983","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"bae4df0a643fa7f84663473aa3082a9c2ed139db","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/scsi/ibmvscsi/ibmvfc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.27"},{"lessThan":"2.6.27","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A01FA99D-A279-4156-BCB7-C23B63339A60","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()\n\nA malicious or compromised VIO server can return a num_written value in the\ndiscover targets MAD response that exceeds max_targets. This value is\nstored directly in vhost->num_targets without validation, and is then used\nas the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which\nis only allocated for max_targets entries. Indices at or beyond max_targets\naccess kernel memory outside the DMA-coherent allocation. The\nout-of-bounds data is subsequently embedded in Implicit Logout and PLOGI\nMADs that are sent back to the VIO server, leaking kernel memory.\n\nFix by clamping num_written to max_targets before storing it."}],"id":"CVE-2026-31464","lastModified":"2026-10-19T19:17:55.123","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31464","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:42.415310Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:42.450","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4ed727e35b0ab17d3eeeb1e8023768396e2be161"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/786f10b1966e485046839f992e89f2c18cbd1983"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a007246cb6c9ebdc93dafbf63cc2d43d98f402cc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bae4df0a643fa7f84663473aa3082a9c2ed139db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d1466bf991b2343cf2ba8336e440c8faf3cbb780"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d842348f8a00d5b1d7358f207eb34ffcf5b16df3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/scsi/ibmvscsi/ibmvfc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d842348f8a00d5b1d7358f207eb34ffcf5b16df3","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"a007246cb6c9ebdc93dafbf63cc2d43d98f402cc","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"4ed727e35b0ab17d3eeeb1e8023768396e2be161","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"d1466bf991b2343cf2ba8336e440c8faf3cbb780","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"786f10b1966e485046839f992e89f2c18cbd1983","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"bae4df0a643fa7f84663473aa3082a9c2ed139db","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"},{"lessThan":"61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f","status":"affected","version":"072b91f9c6510d0ec4a49d07dbc318760c7da7b3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/scsi/ibmvscsi/ibmvfc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.27"},{"lessThan":"2.6.27","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A01FA99D-A279-4156-BCB7-C23B63339A60","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()\n\nA malicious or compromised VIO server can return a num_written value in the\ndiscover targets MAD response that exceeds max_targets. This value is\nstored directly in vhost->num_targets without validation, and is then used\nas the loop bound in ibmvfc_alloc_targets() to index into disc_buf[], which\nis only allocated for max_targets entries. Indices at or beyond max_targets\naccess kernel memory outside the DMA-coherent allocation. The\nout-of-bounds data is subsequently embedded in Implicit Logout and PLOGI\nMADs that are sent back to the VIO server, leaking kernel memory.\n\nFix by clamping num_written to max_targets before storing it."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nscsi: ibmvfc: Corrección de acceso fuera de límites en ibmvfc_discover_targets_done()\n\nUn servidor VIO malicioso o comprometido puede devolver un valor num_written en la respuesta MAD de descubrimiento de objetivos que excede max_targets. Este valor se almacena directamente en vhost -> num_targets sin validación, y luego se utiliza como límite de bucle en ibmvfc_alloc_targets() para indexar en disc_buf[], que solo se asigna para entradas max_targets. Los índices en o más allá de max_targets acceden a memoria del kernel fuera de la asignación coherente con DMA. Los datos fuera de límites se incrustan posteriormente en MADs de Implicit Logout y PLOGI que se envían de vuelta al servidor VIO, filtrando memoria del kernel.\n\nCorrección mediante la limitación de num_written a max_targets antes de almacenarlo."}],"id":"CVE-2026-31464","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31464","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:42.415310Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:42.450","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/394a1cac3c12fdd7d77f19ccfd222ab5ff87ef89"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4ed727e35b0ab17d3eeeb1e8023768396e2be161"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/61d099ac4a7a8fb11ebdb6e2ec8d77f38e77362f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/786f10b1966e485046839f992e89f2c18cbd1983"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a007246cb6c9ebdc93dafbf63cc2d43d98f402cc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bae4df0a643fa7f84663473aa3082a9c2ed139db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d1466bf991b2343cf2ba8336e440c8faf3cbb780"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d842348f8a00d5b1d7358f207eb34ffcf5b16df3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31465.json b/data/2026/CVE-2026-31465.json index 2861b50ed4..4e938a55af 100644 --- a/data/2026/CVE-2026-31465.json +++ b/data/2026/CVE-2026-31465.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/fs-writeback.c","fs/fuse/file.c","fs/fuse/inode.c","include/linux/fs/super_types.h","include/linux/pagemap.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"83800f8ef358ea2fc9b1ae4986b83f2bc24be927","status":"affected","version":"0c58a97f919c24fe4245015f4375a39ff05665b6","versionType":"git"},{"lessThan":"5c24a13d8a0466ca0446e58309e51f2606520164","status":"affected","version":"0c58a97f919c24fe4245015f4375a39ff05665b6","versionType":"git"},{"lessThan":"76f9377cd2ab7a9220c25d33940d9ca20d368172","status":"affected","version":"0c58a97f919c24fe4245015f4375a39ff05665b6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/fs-writeback.c","fs/fuse/file.c","fs/fuse/inode.c","include/linux/fs/super_types.h","include/linux/pagemap.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A6CA36DA-3783-4321-81A6-485364836084","versionEndExcluding":"6.18.21","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: don't block sync for filesystems with no data integrity guarantees\n\nAdd a SB_I_NO_DATA_INTEGRITY superblock flag for filesystems that cannot\nguarantee data persistence on sync (eg fuse). For superblocks with this\nflag set, sync kicks off writeback of dirty inodes but does not wait\nfor the flusher threads to complete the writeback.\n\nThis replaces the per-inode AS_NO_DATA_INTEGRITY mapping flag added in\ncommit f9a49aa302a0 (\"fs/writeback: skip AS_NO_DATA_INTEGRITY mappings\nin wait_sb_inodes()\"). The flag belongs at the superblock level because\ndata integrity is a filesystem-wide property, not a per-inode one.\nHaving this flag at the superblock level also allows us to skip having\nto iterate every dirty inode in wait_sb_inodes() only to skip each inode\nindividually.\n\nPrior to this commit, mappings with no data integrity guarantees skipped\nwaiting on writeback completion but still waited on the flusher threads\nto finish initiating the writeback. Waiting on the flusher threads is\nunnecessary. This commit kicks off writeback but does not wait on the\nflusher threads. This change properly addresses a recent report [1] for\na suspend-to-RAM hang seen on fuse-overlayfs that was caused by waiting\non the flusher threads to finish:\n\nWorkqueue: pm_fs_sync pm_fs_sync_work_fn\nCall Trace:\n \n __schedule+0x457/0x1720\n schedule+0x27/0xd0\n wb_wait_for_completion+0x97/0xe0\n sync_inodes_sb+0xf8/0x2e0\n __iterate_supers+0xdc/0x160\n ksys_sync+0x43/0xb0\n pm_fs_sync_work_fn+0x17/0xa0\n process_one_work+0x193/0x350\n worker_thread+0x1a1/0x310\n kthread+0xfc/0x240\n ret_from_fork+0x243/0x280\n ret_from_fork_asm+0x1a/0x30\n \n\nOn fuse this is problematic because there are paths that may cause the\nflusher thread to block (eg if systemd freezes the user session cgroups\nfirst, which freezes the fuse daemon, before invoking the kernel\nsuspend. The kernel suspend triggers ->write_node() which on fuse issues\na synchronous setattr request, which cannot be processed since the\ndaemon is frozen. Or if the daemon is buggy and cannot properly complete\nwriteback, initiating writeback on a dirty folio already under writeback\nleads to writeback_get_folio() -> folio_prepare_writeback() ->\nunconditional wait on writeback to finish, which will cause a hang).\nThis commit restores fuse to its prior behavior before tmp folios were\nremoved, where sync was essentially a no-op.\n\n[1] https://lore.kernel.org/linux-fsdevel/CAJnrk1a-asuvfrbKXbEwwDSctvemF+6zfhdnuzO65Pt8HsFSRw@mail.gmail.com/T/#m632c4648e9cafc4239299887109ebd880ac6c5c1"}],"id":"CVE-2026-31465","lastModified":"2026-06-17T10:33:47.600","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:42.633","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5c24a13d8a0466ca0446e58309e51f2606520164"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76f9377cd2ab7a9220c25d33940d9ca20d368172"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83800f8ef358ea2fc9b1ae4986b83f2bc24be927"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/fs-writeback.c","fs/fuse/file.c","fs/fuse/inode.c","include/linux/fs/super_types.h","include/linux/pagemap.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"83800f8ef358ea2fc9b1ae4986b83f2bc24be927","status":"affected","version":"0c58a97f919c24fe4245015f4375a39ff05665b6","versionType":"git"},{"lessThan":"5c24a13d8a0466ca0446e58309e51f2606520164","status":"affected","version":"0c58a97f919c24fe4245015f4375a39ff05665b6","versionType":"git"},{"lessThan":"76f9377cd2ab7a9220c25d33940d9ca20d368172","status":"affected","version":"0c58a97f919c24fe4245015f4375a39ff05665b6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/fs-writeback.c","fs/fuse/file.c","fs/fuse/inode.c","include/linux/fs/super_types.h","include/linux/pagemap.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A6CA36DA-3783-4321-81A6-485364836084","versionEndExcluding":"6.18.21","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: don't block sync for filesystems with no data integrity guarantees\n\nAdd a SB_I_NO_DATA_INTEGRITY superblock flag for filesystems that cannot\nguarantee data persistence on sync (eg fuse). For superblocks with this\nflag set, sync kicks off writeback of dirty inodes but does not wait\nfor the flusher threads to complete the writeback.\n\nThis replaces the per-inode AS_NO_DATA_INTEGRITY mapping flag added in\ncommit f9a49aa302a0 (\"fs/writeback: skip AS_NO_DATA_INTEGRITY mappings\nin wait_sb_inodes()\"). The flag belongs at the superblock level because\ndata integrity is a filesystem-wide property, not a per-inode one.\nHaving this flag at the superblock level also allows us to skip having\nto iterate every dirty inode in wait_sb_inodes() only to skip each inode\nindividually.\n\nPrior to this commit, mappings with no data integrity guarantees skipped\nwaiting on writeback completion but still waited on the flusher threads\nto finish initiating the writeback. Waiting on the flusher threads is\nunnecessary. This commit kicks off writeback but does not wait on the\nflusher threads. This change properly addresses a recent report [1] for\na suspend-to-RAM hang seen on fuse-overlayfs that was caused by waiting\non the flusher threads to finish:\n\nWorkqueue: pm_fs_sync pm_fs_sync_work_fn\nCall Trace:\n \n __schedule+0x457/0x1720\n schedule+0x27/0xd0\n wb_wait_for_completion+0x97/0xe0\n sync_inodes_sb+0xf8/0x2e0\n __iterate_supers+0xdc/0x160\n ksys_sync+0x43/0xb0\n pm_fs_sync_work_fn+0x17/0xa0\n process_one_work+0x193/0x350\n worker_thread+0x1a1/0x310\n kthread+0xfc/0x240\n ret_from_fork+0x243/0x280\n ret_from_fork_asm+0x1a/0x30\n \n\nOn fuse this is problematic because there are paths that may cause the\nflusher thread to block (eg if systemd freezes the user session cgroups\nfirst, which freezes the fuse daemon, before invoking the kernel\nsuspend. The kernel suspend triggers ->write_node() which on fuse issues\na synchronous setattr request, which cannot be processed since the\ndaemon is frozen. Or if the daemon is buggy and cannot properly complete\nwriteback, initiating writeback on a dirty folio already under writeback\nleads to writeback_get_folio() -> folio_prepare_writeback() ->\nunconditional wait on writeback to finish, which will cause a hang).\nThis commit restores fuse to its prior behavior before tmp folios were\nremoved, where sync was essentially a no-op.\n\n[1] https://lore.kernel.org/linux-fsdevel/CAJnrk1a-asuvfrbKXbEwwDSctvemF+6zfhdnuzO65Pt8HsFSRw@mail.gmail.com/T/#m632c4648e9cafc4239299887109ebd880ac6c5c1"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwriteback: no bloquear la sincronización para sistemas de archivos sin garantías de integridad de datos\n\nAñadir una bandera de superbloque SB_I_NO_DATA_INTEGRITY para sistemas de archivos que no pueden garantizar la persistencia de datos en la sincronización (por ejemplo, fuse). Para superbloques con esta bandera establecida, la sincronización inicia el writeback de inodos sucios pero no espera a que los hilos de vaciado completen el writeback.\n\nEsto reemplaza la bandera de mapeo AS_NO_DATA_INTEGRITY por inodo añadida en el commit f9a49aa302a0 (’fs/writeback: omitir mapeos AS_NO_DATA_INTEGRITY en wait_sb_inodes()’). La bandera pertenece al nivel del superbloque porque la integridad de los datos es una propiedad de todo el sistema de archivos, no una por inodo. Tener esta bandera a nivel de superbloque también nos permite evitar tener que iterar cada inodo sucio en wait_sb_inodes() solo para omitir cada inodo individualmente.\n\nAntes de este commit, los mapeos sin garantías de integridad de datos omitían esperar la finalización del writeback pero aún esperaban a que los hilos de vaciado terminaran de iniciar el writeback. Esperar a los hilos de vaciado es innecesario. Este commit inicia el writeback pero no espera a los hilos de vaciado. Este cambio aborda correctamente un informe reciente [1] por un cuelgue de suspensión a RAM visto en fuse-overlayfs que fue causado por esperar a que los hilos de vaciado terminaran:\n\nWorkqueue: pm_fs_sync pm_fs_sync_work_fn\nRastro de Llamada:\n [TAREA]\n __schedule+0x457/0x 1720\n schedule+0x27/0xd0\n wb_wait_for_completion+0x97/0xe0\n sync_inodes_sb+0xf8/0x2e0\n __iterate_supers+0xdc/0x160\n ksys_sync+0x43/0xb0\n pm_fs_sync_work_fn+0x17/0xa0\n process_one_work+0x193/0x350\n worker_thread+0x1a1/0x310\n kthread+0xfc/0x240\n ret_from_fork+0x243/0x280\n ret_from_fork_asm+0x1a/0x30\n [/TAREA]\n\nEn fuse esto es problemático porque hay rutas que pueden causar que el hilo de vaciado se bloquee (por ejemplo, si systemd congela primero los cgroups de la sesión de usuario, lo que congela el demonio fuse, antes de invocar la suspensión del kernel. La suspensión del kernel activa -> write_node() que en fuse emite una solicitud setattr síncrona, que no puede procesarse ya que el demonio está congelado. O si el demonio tiene errores y no puede completar correctamente el writeback, iniciar el writeback en un folio sucio que ya está en writeback lleva a writeback_get_folio() -> folio_prepare_writeback() -> espera incondicional a que el writeback termine, lo que causará un cuelgue). Este commit restaura fuse a su comportamiento anterior antes de que se eliminaran los folios temporales, donde la sincronización era esencialmente una operación nula.\n\n[1] https://lore.kernel.org/linux-fsdevel/CAJnrk1a-asuvfrbKXbEwwDSctvemF+6zfhdnuzO65Pt8HsFSRw@mail.gmail.com/T/#m632c4648e9cafc4239299887109ebd880ac6c5c1"}],"id":"CVE-2026-31465","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:42.633","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5c24a13d8a0466ca0446e58309e51f2606520164"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76f9377cd2ab7a9220c25d33940d9ca20d368172"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83800f8ef358ea2fc9b1ae4986b83f2bc24be927"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31466.json b/data/2026/CVE-2026-31466.json index 0c893bf9a3..1a90b938a4 100644 --- a/data/2026/CVE-2026-31466.json +++ b/data/2026/CVE-2026-31466.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/leafops.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"426ee10711586617da869c8bb798214965337617","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"f1acf5887c2bbaf998dc3fe32c72b7a8b84a3ddd","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"722cfaf6b31d31123439e67b5deac6b1261a3dea","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"7ddcf4a245c1c5a91fdd9698757e3d95179ffe41","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"b8c49ad888892ad7b77062b9c102b799a3e9b4f8","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"7ad1997b9bc8032603df8f091761114479285769","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"8bfb8414e9f2ce6f5f2f0e3d0da52f2d132128e7","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"4c5e7f0fcd592801c9cc18f29f80fbee84eb8669","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/leafops.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.5"},{"lessThan":"4.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5817BDB6-4C64-4AB6-83FF-CC693A5E4906","versionEndExcluding":"5.10.253","versionStartIncluding":"4.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix folio isn't locked in softleaf_to_folio()\n\nOn arm64 server, we found folio that get from migration entry isn't locked\nin softleaf_to_folio(). This issue triggers when mTHP splitting and\nzap_nonpresent_ptes() races, and the root cause is lack of memory barrier\nin softleaf_to_folio(). The race is as follows:\n\n\tCPU0 CPU1\n\ndeferred_split_scan() zap_nonpresent_ptes()\n lock folio\n split_folio()\n unmap_folio()\n change ptes to migration entries\n __split_folio_to_order() softleaf_to_folio()\n set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry))\n smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))\n prep_compound_page() for tail pages\n\nIn __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages\nare visible before the tail page becomes non-compound. smp_wmb() should\nbe paired with smp_rmb() in softleaf_to_folio(), which is missed. As a\nresult, if zap_nonpresent_ptes() accesses migration entry that stores tail\npfn, softleaf_to_folio() may see the updated compound_head of tail page\nbefore page->flags.\n\nThis issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()\nbecause of the race between folio split and zap_nonpresent_ptes()\nleading to a folio incorrectly undergoing modification without a folio\nlock being held.\n\nThis is a BUG_ON() before commit 93976a20345b (\"mm: eliminate further\nswapops predicates\"), which in merged in v6.19-rc1.\n\nTo fix it, add missing smp_rmb() if the softleaf entry is migration entry\nin softleaf_to_folio() and softleaf_to_page().\n\n[tujinjiang@huawei.com: update function name and comments]"}],"id":"CVE-2026-31466","lastModified":"2026-11-10T13:18:55.837","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31466","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:30.187623Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:42.780","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/426ee10711586617da869c8bb798214965337617"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c5e7f0fcd592801c9cc18f29f80fbee84eb8669"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/722cfaf6b31d31123439e67b5deac6b1261a3dea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ad1997b9bc8032603df8f091761114479285769"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ddcf4a245c1c5a91fdd9698757e3d95179ffe41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8bfb8414e9f2ce6f5f2f0e3d0da52f2d132128e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b8c49ad888892ad7b77062b9c102b799a3e9b4f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1acf5887c2bbaf998dc3fe32c72b7a8b84a3ddd"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/leafops.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"426ee10711586617da869c8bb798214965337617","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"f1acf5887c2bbaf998dc3fe32c72b7a8b84a3ddd","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"722cfaf6b31d31123439e67b5deac6b1261a3dea","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"7ddcf4a245c1c5a91fdd9698757e3d95179ffe41","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"b8c49ad888892ad7b77062b9c102b799a3e9b4f8","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"7ad1997b9bc8032603df8f091761114479285769","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"8bfb8414e9f2ce6f5f2f0e3d0da52f2d132128e7","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"},{"lessThan":"4c5e7f0fcd592801c9cc18f29f80fbee84eb8669","status":"affected","version":"e9b61f19858a5d6c42ce2298cf138279375d0d9b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/leafops.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.5"},{"lessThan":"4.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5817BDB6-4C64-4AB6-83FF-CC693A5E4906","versionEndExcluding":"5.10.253","versionStartIncluding":"4.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix folio isn't locked in softleaf_to_folio()\n\nOn arm64 server, we found folio that get from migration entry isn't locked\nin softleaf_to_folio(). This issue triggers when mTHP splitting and\nzap_nonpresent_ptes() races, and the root cause is lack of memory barrier\nin softleaf_to_folio(). The race is as follows:\n\n\tCPU0 CPU1\n\ndeferred_split_scan() zap_nonpresent_ptes()\n lock folio\n split_folio()\n unmap_folio()\n change ptes to migration entries\n __split_folio_to_order() softleaf_to_folio()\n set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry))\n smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))\n prep_compound_page() for tail pages\n\nIn __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages\nare visible before the tail page becomes non-compound. smp_wmb() should\nbe paired with smp_rmb() in softleaf_to_folio(), which is missed. As a\nresult, if zap_nonpresent_ptes() accesses migration entry that stores tail\npfn, softleaf_to_folio() may see the updated compound_head of tail page\nbefore page->flags.\n\nThis issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()\nbecause of the race between folio split and zap_nonpresent_ptes()\nleading to a folio incorrectly undergoing modification without a folio\nlock being held.\n\nThis is a BUG_ON() before commit 93976a20345b (\"mm: eliminate further\nswapops predicates\"), which in merged in v6.19-rc1.\n\nTo fix it, add missing smp_rmb() if the softleaf entry is migration entry\nin softleaf_to_folio() and softleaf_to_page().\n\n[tujinjiang@huawei.com: update function name and comments]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/huge_memory: corrección: folio no está bloqueado en softleaf_to_folio()\n\nEn un servidor arm64, encontramos que el folio obtenido de una entrada de migración no está bloqueado en softleaf_to_folio(). Este problema se activa cuando la división de mTHP y zap_nonpresent_ptes() entran en una condición de carrera, y la causa raíz es la falta de una barrera de memoria en softleaf_to_folio(). La condición de carrera es la siguiente:\n\n\tCPU0 CPU1\n\ndeferred_split_scan() zap_nonpresent_ptes()\n bloquear folio\n split_folio()\n unmap_folio()\n cambiar ptes a entradas de migración\n __split_folio_to_order() softleaf_to_folio()\n establecer flags (incluyendo PG_locked) para páginas de cola folio = pfn_folio(softleaf_to_pfn(entry))\n smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))\n prep_compound_page() para páginas de cola\n\nEn __split_folio_to_order(), smp_wmb() garantiza que los flags de página de las páginas de cola sean visibles antes de que la página de cola se vuelva no-compuesta. smp_wmb() debería emparejarse con smp_rmb() en softleaf_to_folio(), lo cual se ha omitido. Como resultado, si zap_nonpresent_ptes() accede a una entrada de migración que almacena el pfn de cola, softleaf_to_folio() puede ver el compound_head actualizado de la página de cola antes de page -> flags.\n\nEste problema activará VM_WARN_ON_ONCE() en pfn_swap_entry_folio() debido a la condición de carrera entre la división de folio y zap_nonpresent_ptes(), lo que lleva a que un folio se modifique incorrectamente sin que se mantenga un bloqueo de folio.\n\nEsto es un BUG_ON() antes del commit 93976a20345b (’mm: eliminate further swapops predicates’), el cual se fusionó en v6.19-rc1.\n\nPara solucionarlo, añadir el smp_rmb() faltante si la entrada softleaf es una entrada de migración en softleaf_to_folio() y softleaf_to_page().\n\n[tujinjiang@huawei.com: actualizar nombre de función y comentarios]"}],"id":"CVE-2026-31466","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31466","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:30.187623Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:42.780","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/426ee10711586617da869c8bb798214965337617"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c5e7f0fcd592801c9cc18f29f80fbee84eb8669"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/722cfaf6b31d31123439e67b5deac6b1261a3dea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ad1997b9bc8032603df8f091761114479285769"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ddcf4a245c1c5a91fdd9698757e3d95179ffe41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8bfb8414e9f2ce6f5f2f0e3d0da52f2d132128e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b8c49ad888892ad7b77062b9c102b799a3e9b4f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1acf5887c2bbaf998dc3fe32c72b7a8b84a3ddd"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31467.json b/data/2026/CVE-2026-31467.json index 55fba233b9..cb7d3045df 100644 --- a/data/2026/CVE-2026-31467.json +++ b/data/2026/CVE-2026-31467.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/erofs/zdata.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d6565ea662e17d45a577184b0011bd69de22dc2b","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"},{"lessThan":"d9d8360cb66e3b599d89d2526e7da8b530ebf2ff","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"},{"lessThan":"5c8ecdcfbfb0b0c6a82a4ebadc1ddea61609b902","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"},{"lessThan":"378949f46e897204384f3f5f91e42e93e3f87568","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"},{"lessThan":"da40464064599eefe78749f75cd2bba371044c04","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"},{"lessThan":"e83e20b82859f0588e9a52a6fa9fea704a2061cf","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"},{"lessThan":"c23df30915f83e7257c8625b690a1cece94142a0","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/erofs/zdata.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"985804EB-66D2-4D4A-AF5D-D7A87E940EEE","versionEndExcluding":"5.15.203","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: add GFP_NOIO in the bio completion if needed\n\nThe bio completion path in the process context (e.g. dm-verity)\nwill directly call into decompression rather than trigger another\nworkqueue context for minimal scheduling latencies, which can\nthen call vm_map_ram() with GFP_KERNEL.\n\nDue to insufficient memory, vm_map_ram() may generate memory\nswapping I/O, which can cause submit_bio_wait to deadlock\nin some scenarios.\n\nTrimmed down the call stack, as follows:\n\nf2fs_submit_read_io\n submit_bio //bio_list is initialized.\n mmc_blk_mq_recovery\n z_erofs_endio\n vm_map_ram\n __pte_alloc_kernel\n __alloc_pages_direct_reclaim\n shrink_folio_list\n __swap_writepage\n submit_bio_wait //bio_list is non-NULL, hang!!!\n\nUse memalloc_noio_{save,restore}() to wrap up this path."}],"id":"CVE-2026-31467","lastModified":"2026-06-17T10:33:47.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:42.977","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/378949f46e897204384f3f5f91e42e93e3f87568"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5c8ecdcfbfb0b0c6a82a4ebadc1ddea61609b902"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c23df30915f83e7257c8625b690a1cece94142a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d6565ea662e17d45a577184b0011bd69de22dc2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d9d8360cb66e3b599d89d2526e7da8b530ebf2ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/da40464064599eefe78749f75cd2bba371044c04"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e83e20b82859f0588e9a52a6fa9fea704a2061cf"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/erofs/zdata.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d6565ea662e17d45a577184b0011bd69de22dc2b","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"},{"lessThan":"d9d8360cb66e3b599d89d2526e7da8b530ebf2ff","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"},{"lessThan":"5c8ecdcfbfb0b0c6a82a4ebadc1ddea61609b902","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"},{"lessThan":"378949f46e897204384f3f5f91e42e93e3f87568","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"},{"lessThan":"da40464064599eefe78749f75cd2bba371044c04","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"},{"lessThan":"e83e20b82859f0588e9a52a6fa9fea704a2061cf","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"},{"lessThan":"c23df30915f83e7257c8625b690a1cece94142a0","status":"affected","version":"648f2de053a882c87c05f0060f47d3b11841fdbe","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/erofs/zdata.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"985804EB-66D2-4D4A-AF5D-D7A87E940EEE","versionEndExcluding":"5.15.203","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: add GFP_NOIO in the bio completion if needed\n\nThe bio completion path in the process context (e.g. dm-verity)\nwill directly call into decompression rather than trigger another\nworkqueue context for minimal scheduling latencies, which can\nthen call vm_map_ram() with GFP_KERNEL.\n\nDue to insufficient memory, vm_map_ram() may generate memory\nswapping I/O, which can cause submit_bio_wait to deadlock\nin some scenarios.\n\nTrimmed down the call stack, as follows:\n\nf2fs_submit_read_io\n submit_bio //bio_list is initialized.\n mmc_blk_mq_recovery\n z_erofs_endio\n vm_map_ram\n __pte_alloc_kernel\n __alloc_pages_direct_reclaim\n shrink_folio_list\n __swap_writepage\n submit_bio_wait //bio_list is non-NULL, hang!!!\n\nUse memalloc_noio_{save,restore}() to wrap up this path."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nerofs: añadir GFP_NOIO en la completación de bio si es necesario\n\nLa ruta de completación de bio en el contexto del proceso (p. ej., dm-verity) llamará directamente a la descompresión en lugar de activar otro contexto de workqueue para latencias de planificación mínimas, lo que luego puede llamar a vm_map_ram() con GFP_KERNEL.\n\nDebido a memoria insuficiente, vm_map_ram() puede generar E/S de intercambio de memoria, lo que puede causar que submit_bio_wait entre en interbloqueo en algunos escenarios.\n\nSe ha reducido la pila de llamadas, como sigue:\n\nf2fs_submit_read_io\n submit_bio //bio_list está inicializada.\n mmc_blk_mq_recovery\n z_erofs_endio\n vm_map_ram\n __pte_alloc_kernel\n __alloc_pages_direct_reclaim\n shrink_folio_list\n __swap_writepage\n submit_bio_wait //bio_list no es nula, ¡¡¡cuelgue!!!\n\nUsar memalloc_noio_{save,restore}() para envolver esta ruta."}],"id":"CVE-2026-31467","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:42.977","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/378949f46e897204384f3f5f91e42e93e3f87568"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5c8ecdcfbfb0b0c6a82a4ebadc1ddea61609b902"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c23df30915f83e7257c8625b690a1cece94142a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d6565ea662e17d45a577184b0011bd69de22dc2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d9d8360cb66e3b599d89d2526e7da8b530ebf2ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/da40464064599eefe78749f75cd2bba371044c04"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e83e20b82859f0588e9a52a6fa9fea704a2061cf"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31468.json b/data/2026/CVE-2026-31468.json index 7c647128f0..29013e4f83 100644 --- a/data/2026/CVE-2026-31468.json +++ b/data/2026/CVE-2026-31468.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/vfio/pci/vfio_pci_dmabuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"83ad334afc9a645cef1062f5346526b1e36d6516","status":"affected","version":"5d74781ebc86c5fa9e9d6934024c505412de9b52","versionType":"git"},{"lessThan":"e98137f0a874ab36d0946de4707aa48cb7137d1c","status":"affected","version":"5d74781ebc86c5fa9e9d6934024c505412de9b52","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/vfio/pci/vfio_pci_dmabuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Fix double free in dma-buf feature\n\nThe error path through vfio_pci_core_feature_dma_buf() ignores its\nown advice to only use dma_buf_put() after dma_buf_export(), instead\nfalling through the entire unwind chain. In the unlikely event that\nwe encounter file descriptor exhaustion, this can result in an\nunbalanced refcount on the vfio device and double free of allocated\nobjects.\n\nAvoid this by moving the \"put\" directly into the error path and return\nthe errno rather than entering the unwind chain."}],"id":"CVE-2026-31468","lastModified":"2026-10-19T19:17:55.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31468","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:44.917281Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:43.143","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83ad334afc9a645cef1062f5346526b1e36d6516"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e98137f0a874ab36d0946de4707aa48cb7137d1c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/vfio/pci/vfio_pci_dmabuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"83ad334afc9a645cef1062f5346526b1e36d6516","status":"affected","version":"5d74781ebc86c5fa9e9d6934024c505412de9b52","versionType":"git"},{"lessThan":"e98137f0a874ab36d0946de4707aa48cb7137d1c","status":"affected","version":"5d74781ebc86c5fa9e9d6934024c505412de9b52","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/vfio/pci/vfio_pci_dmabuf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/pci: Fix double free in dma-buf feature\n\nThe error path through vfio_pci_core_feature_dma_buf() ignores its\nown advice to only use dma_buf_put() after dma_buf_export(), instead\nfalling through the entire unwind chain. In the unlikely event that\nwe encounter file descriptor exhaustion, this can result in an\nunbalanced refcount on the vfio device and double free of allocated\nobjects.\n\nAvoid this by moving the \"put\" directly into the error path and return\nthe errno rather than entering the unwind chain."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvfio/pci: Corrección de doble liberación en la característica dma-buf\n\nLa ruta de error a través de vfio_pci_core_feature_dma_buf() ignora su propio consejo de usar dma_buf_put() solo después de dma_buf_export(), cayendo en su lugar por toda la cadena de desenrollado. En el improbable caso de que encontremos agotamiento de descriptores de archivo, esto puede resultar en un recuento de referencias desequilibrado en el dispositivo vfio y doble liberación de objetos asignados.\n\nEvite esto al mover el put directamente a la ruta de error y devolver el errno en lugar de entrar en la cadena de desenrollado."}],"id":"CVE-2026-31468","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31468","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:44.917281Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:43.143","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83ad334afc9a645cef1062f5346526b1e36d6516"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e98137f0a874ab36d0946de4707aa48cb7137d1c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31469.json b/data/2026/CVE-2026-31469.json index 882653a334..11d67cb42f 100644 --- a/data/2026/CVE-2026-31469.json +++ b/data/2026/CVE-2026-31469.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/virtio_net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"be0e63f3b97bbaf453c542e8a15ba2a536e2ac01","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"c1ec36cb3768574b916f20d2d7415fd14fa1bf12","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"8a4790850e710fd6771e4d2112168ed1dd6c0e54","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"fedd2e1630cac920844997227ccbe7b26a76375a","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"f04733c4dc40c43899c3d1c97afbae5831a3770f","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"9a18629f2525781f0f3dda7be72b204e4cf77d08","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"63d45077b97bb0e0fe0c75931acbbca7a47af141","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"ba8bda9a0896746053aa97ac6c3e08168729172c","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/virtio_net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.26"},{"lessThan":"2.6.26","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"12FCCED5-075B-4D9E-9684-F4F99BF08DE6","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.26","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n\nA UAF issue occurs when the virtio_net driver is configured with napi_tx=N\nand the device's IFF_XMIT_DST_RELEASE flag is cleared\n(e.g., during the configuration of tc route filter rules).\n\nWhen IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack\nexpects the driver to hold the reference to skb->dst until the packet\nis fully transmitted and freed. In virtio_net with napi_tx=N,\nskbs may remain in the virtio transmit ring for an extended period.\n\nIf the network namespace is destroyed while these skbs are still pending,\nthe corresponding dst_ops structure has freed. When a subsequent packet\nis transmitted, free_old_xmit() is triggered to clean up old skbs.\nIt then calls dst_release() on the skb associated with the stale dst_entry.\nSince the dst_ops (referenced by the dst_entry) has already been freed,\na UAF kernel paging request occurs.\n\nfix it by adds skb_dst_drop(skb) in start_xmit to explicitly release\nthe dst reference before the skb is queued in virtio_net.\n\nCall Trace:\n Unable to handle kernel paging request at virtual address ffff80007e150000\n CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT\n ...\n percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)\n dst_release+0xe0/0x110 net/core/dst.c:177\n skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177\n sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255\n dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469\n napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527\n __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]\n free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]\n start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]\n ...\n\nReproduction Steps:\nNETDEV=\"enp3s0\"\n\nconfig_qdisc_route_filter() {\n tc qdisc del dev $NETDEV root\n tc qdisc add dev $NETDEV root handle 1: prio\n tc filter add dev $NETDEV parent 1:0 \\\n\tprotocol ip prio 100 route to 100 flowid 1:1\n ip route add 192.168.1.100/32 dev $NETDEV realm 100\n}\n\ntest_ns() {\n ip netns add testns\n ip link set $NETDEV netns testns\n ip netns exec testns ifconfig $NETDEV 10.0.32.46/24\n ip netns exec testns ping -c 1 10.0.32.1\n ip netns del testns\n}\n\nconfig_qdisc_route_filter\n\ntest_ns\nsleep 2\ntest_ns"}],"id":"CVE-2026-31469","lastModified":"2026-11-10T13:18:56.047","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31469","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:47.364337Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:43.260","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63d45077b97bb0e0fe0c75931acbbca7a47af141"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a4790850e710fd6771e4d2112168ed1dd6c0e54"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a18629f2525781f0f3dda7be72b204e4cf77d08"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba8bda9a0896746053aa97ac6c3e08168729172c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/be0e63f3b97bbaf453c542e8a15ba2a536e2ac01"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c1ec36cb3768574b916f20d2d7415fd14fa1bf12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f04733c4dc40c43899c3d1c97afbae5831a3770f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fedd2e1630cac920844997227ccbe7b26a76375a"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/virtio_net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"be0e63f3b97bbaf453c542e8a15ba2a536e2ac01","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"c1ec36cb3768574b916f20d2d7415fd14fa1bf12","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"8a4790850e710fd6771e4d2112168ed1dd6c0e54","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"fedd2e1630cac920844997227ccbe7b26a76375a","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"f04733c4dc40c43899c3d1c97afbae5831a3770f","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"9a18629f2525781f0f3dda7be72b204e4cf77d08","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"63d45077b97bb0e0fe0c75931acbbca7a47af141","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"},{"lessThan":"ba8bda9a0896746053aa97ac6c3e08168729172c","status":"affected","version":"f2fc6a54585a1be6669613a31fbaba2ecbadcd36","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/virtio_net.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.26"},{"lessThan":"2.6.26","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"12FCCED5-075B-4D9E-9684-F4F99BF08DE6","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.26","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n\nA UAF issue occurs when the virtio_net driver is configured with napi_tx=N\nand the device's IFF_XMIT_DST_RELEASE flag is cleared\n(e.g., during the configuration of tc route filter rules).\n\nWhen IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack\nexpects the driver to hold the reference to skb->dst until the packet\nis fully transmitted and freed. In virtio_net with napi_tx=N,\nskbs may remain in the virtio transmit ring for an extended period.\n\nIf the network namespace is destroyed while these skbs are still pending,\nthe corresponding dst_ops structure has freed. When a subsequent packet\nis transmitted, free_old_xmit() is triggered to clean up old skbs.\nIt then calls dst_release() on the skb associated with the stale dst_entry.\nSince the dst_ops (referenced by the dst_entry) has already been freed,\na UAF kernel paging request occurs.\n\nfix it by adds skb_dst_drop(skb) in start_xmit to explicitly release\nthe dst reference before the skb is queued in virtio_net.\n\nCall Trace:\n Unable to handle kernel paging request at virtual address ffff80007e150000\n CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT\n ...\n percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)\n dst_release+0xe0/0x110 net/core/dst.c:177\n skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177\n sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255\n dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469\n napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527\n __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]\n free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]\n start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]\n ...\n\nReproduction Steps:\nNETDEV=\"enp3s0\"\n\nconfig_qdisc_route_filter() {\n tc qdisc del dev $NETDEV root\n tc qdisc add dev $NETDEV root handle 1: prio\n tc filter add dev $NETDEV parent 1:0 \\\n\tprotocol ip prio 100 route to 100 flowid 1:1\n ip route add 192.168.1.100/32 dev $NETDEV realm 100\n}\n\ntest_ns() {\n ip netns add testns\n ip link set $NETDEV netns testns\n ip netns exec testns ifconfig $NETDEV 10.0.32.46/24\n ip netns exec testns ping -c 1 10.0.32.1\n ip netns del testns\n}\n\nconfig_qdisc_route_filter\n\ntest_ns\nsleep 2\ntest_ns"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvirtio_net: Corrección de UAF en dst_ops cuando IFF_XMIT_DST_RELEASE es borrado y napi_tx es falso\n\nUn problema de UAF ocurre cuando el controlador virtio_net está configurado con napi_tx=N y el flag IFF_XMIT_DST_RELEASE del dispositivo es borrado (p. ej., durante la configuración de reglas de filtro de ruta tc).\n\nCuando IFF_XMIT_DST_RELEASE es eliminado del net_device, la pila de red espera que el controlador mantenga la referencia a skb -> dst hasta que el paquete sea completamente transmitido y liberado. En virtio_net con napi_tx=N, los skbs pueden permanecer en el anillo de transmisión virtio por un período extendido.\n\nSi el espacio de nombres de red es destruido mientras estos skbs aún están pendientes, la estructura dst_ops correspondiente ha sido liberada. Cuando un paquete subsiguiente es transmitido, free_old_xmit() es activado para limpiar los skbs antiguos. Luego llama a dst_release() en el skb asociado con el dst_entry obsoleto. Dado que el dst_ops (referenciado por el dst_entry) ya ha sido liberado, una solicitud de paginación del kernel UAF ocurre.\n\nSe corrige añadiendo skb_dst_drop(skb) en start_xmit para liberar explícitamente la referencia dst antes de que el skb sea encolado en virtio_net.\n\nTraza de Llamada:\n No se puede manejar la solicitud de paginación del kernel en la dirección virtual ffff80007e150000\n CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT\n ...\n percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)\n dst_release+0xe0/0x110 net/core/dst.c:177\n skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177\n sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255\n dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469\n napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527\n __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]\n free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]\n start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]\n ...\n\nPasos de Reproducción:\nNETDEV=“enp3s0”\n\nconfig_qdisc_route_filter() {\n tc qdisc del dev $NETDEV root\n tc qdisc add dev $NETDEV root handle 1: prio\n tc filter add dev $NETDEV parent 1:0 \\\n\tprotocol ip prio 100 route to 100 flowid 1:1\n ip route add 192.168.1.100/32 dev $NETDEV realm 100\n}\n\ntest_ns() {\n ip netns add testns\n ip link set $NETDEV netns testns\n ip netns exec testns ifconfig $NETDEV 10.0.32.46/24\n ip netns exec testns ping -c 1 10.0.32.1\n ip netns del testns\n}\n\nconfig_qdisc_route_filter\n\ntest_ns\nsleep 2\ntest_ns"}],"id":"CVE-2026-31469","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31469","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:47.364337Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:43.260","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63d45077b97bb0e0fe0c75931acbbca7a47af141"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a4790850e710fd6771e4d2112168ed1dd6c0e54"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a18629f2525781f0f3dda7be72b204e4cf77d08"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba8bda9a0896746053aa97ac6c3e08168729172c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/be0e63f3b97bbaf453c542e8a15ba2a536e2ac01"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c1ec36cb3768574b916f20d2d7415fd14fa1bf12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f04733c4dc40c43899c3d1c97afbae5831a3770f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fedd2e1630cac920844997227ccbe7b26a76375a"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31470.json b/data/2026/CVE-2026-31470.json index 1c97513dcf..7bd414afb5 100644 --- a/data/2026/CVE-2026-31470.json +++ b/data/2026/CVE-2026-31470.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/virt/coco/tdx-guest/tdx-guest.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a079a62883e3365de592cea9f7a669d8115433b0","status":"affected","version":"f4738f56d1dc62aaba69b33702a5ab098f1b8c63","versionType":"git"},{"lessThan":"6f3c8795ae9ba74fa10fe979293d1904712d3fb1","status":"affected","version":"f4738f56d1dc62aaba69b33702a5ab098f1b8c63","versionType":"git"},{"lessThan":"02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b","status":"affected","version":"f4738f56d1dc62aaba69b33702a5ab098f1b8c63","versionType":"git"},{"lessThan":"c3fd16c3b98ed726294feab2f94f876290bf7b61","status":"affected","version":"f4738f56d1dc62aaba69b33702a5ab098f1b8c63","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/virt/coco/tdx-guest/tdx-guest.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: tdx-guest: Fix handling of host controlled 'quote' buffer length\n\nValidate host controlled value `quote_buf->out_len` that determines how\nmany bytes of the quote are copied out to guest userspace. In TDX\nenvironments with remote attestation, quotes are not considered private,\nand can be forwarded to an attestation server.\n\nCatch scenarios where the host specifies a response length larger than\nthe guest's allocation, or otherwise races modifying the response while\nthe guest consumes it.\n\nThis prevents contents beyond the pages allocated for `quote_buf`\n(up to TSM_REPORT_OUTBLOB_MAX) from being read out to guest userspace,\nand possibly forwarded in attestation requests.\n\nRecall that some deployments want per-container configs-tsm-report\ninterfaces, so the leak may cross container protection boundaries, not\njust local root."}],"id":"CVE-2026-31470","lastModified":"2026-10-19T19:17:55.667","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31470","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:50.983675Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:43.473","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6f3c8795ae9ba74fa10fe979293d1904712d3fb1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a079a62883e3365de592cea9f7a669d8115433b0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c3fd16c3b98ed726294feab2f94f876290bf7b61"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/virt/coco/tdx-guest/tdx-guest.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a079a62883e3365de592cea9f7a669d8115433b0","status":"affected","version":"f4738f56d1dc62aaba69b33702a5ab098f1b8c63","versionType":"git"},{"lessThan":"6f3c8795ae9ba74fa10fe979293d1904712d3fb1","status":"affected","version":"f4738f56d1dc62aaba69b33702a5ab098f1b8c63","versionType":"git"},{"lessThan":"02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b","status":"affected","version":"f4738f56d1dc62aaba69b33702a5ab098f1b8c63","versionType":"git"},{"lessThan":"c3fd16c3b98ed726294feab2f94f876290bf7b61","status":"affected","version":"f4738f56d1dc62aaba69b33702a5ab098f1b8c63","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/virt/coco/tdx-guest/tdx-guest.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: tdx-guest: Fix handling of host controlled 'quote' buffer length\n\nValidate host controlled value `quote_buf->out_len` that determines how\nmany bytes of the quote are copied out to guest userspace. In TDX\nenvironments with remote attestation, quotes are not considered private,\nand can be forwarded to an attestation server.\n\nCatch scenarios where the host specifies a response length larger than\nthe guest's allocation, or otherwise races modifying the response while\nthe guest consumes it.\n\nThis prevents contents beyond the pages allocated for `quote_buf`\n(up to TSM_REPORT_OUTBLOB_MAX) from being read out to guest userspace,\nand possibly forwarded in attestation requests.\n\nRecall that some deployments want per-container configs-tsm-report\ninterfaces, so the leak may cross container protection boundaries, not\njust local root."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nvirt: tdx-guest: Corrección del manejo de la longitud del búfer de ’quote’ controlado por el host\n\nValidar el valor controlado por el host ’quote_buf -> out_len’ que determina cuántos bytes de la ’quote’ se copian al espacio de usuario del invitado. En entornos TDX con atestación remota, las ’quotes’ no se consideran privadas y pueden ser reenviadas a un servidor de atestación.\n\nCapturar escenarios donde el host especifica una longitud de respuesta mayor que la asignación del invitado, o de otro modo compite modificando la respuesta mientras el invitado la consume.\n\nEsto evita que el contenido más allá de las páginas asignadas para ’quote_buf’ (hasta TSM_REPORT_OUTBLOB_MAX) sea leído al espacio de usuario del invitado y posiblemente reenviado en solicitudes de atestación.\n\nRecordar que algunas implementaciones quieren interfaces configs-tsm-report por contenedor, por lo que la fuga puede cruzar los límites de protección del contenedor, no solo la raíz local."}],"id":"CVE-2026-31470","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31470","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:50.983675Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:43.473","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/02ca2d9d197723696cb9cc0cb159eb7e8bf5f89b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6f3c8795ae9ba74fa10fe979293d1904712d3fb1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a079a62883e3365de592cea9f7a669d8115433b0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c3fd16c3b98ed726294feab2f94f876290bf7b61"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31471.json b/data/2026/CVE-2026-31471.json index dd32ae8c00..1db4f0b51d 100644 --- a/data/2026/CVE-2026-31471.json +++ b/data/2026/CVE-2026-31471.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1","status":"affected","version":"6be02e3e4f376fea468846c8562655ca5ee18204","versionType":"git"},{"lessThan":"5784a1e2889c9525a8f036cb586930e232170bf7","status":"affected","version":"6be02e3e4f376fea468846c8562655ca5ee18204","versionType":"git"},{"lessThan":"d849a2f7309fc0616e79d13b008b0a47e0458b6e","status":"affected","version":"6be02e3e4f376fea468846c8562655ca5ee18204","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A92793EC-8117-409C-996C-47A04124C722","versionEndExcluding":"6.18.21","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: only publish mode_data after clone setup\n\niptfs_clone_state() stores x->mode_data before allocating the reorder\nwindow. If that allocation fails, the code frees the cloned state and\nreturns -ENOMEM, leaving x->mode_data pointing at freed memory.\n\nThe xfrm clone unwind later runs destroy_state() through x->mode_data,\nso the failed clone path tears down IPTFS state that clone_state()\nalready freed.\n\nKeep the cloned IPTFS state private until all allocations succeed so\nfailed clones leave x->mode_data unset. The destroy path already\nhandles a NULL mode_data pointer."}],"id":"CVE-2026-31471","lastModified":"2026-06-17T10:33:48.340","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:43.610","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5784a1e2889c9525a8f036cb586930e232170bf7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d849a2f7309fc0616e79d13b008b0a47e0458b6e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1","status":"affected","version":"6be02e3e4f376fea468846c8562655ca5ee18204","versionType":"git"},{"lessThan":"5784a1e2889c9525a8f036cb586930e232170bf7","status":"affected","version":"6be02e3e4f376fea468846c8562655ca5ee18204","versionType":"git"},{"lessThan":"d849a2f7309fc0616e79d13b008b0a47e0458b6e","status":"affected","version":"6be02e3e4f376fea468846c8562655ca5ee18204","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A92793EC-8117-409C-996C-47A04124C722","versionEndExcluding":"6.18.21","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: only publish mode_data after clone setup\n\niptfs_clone_state() stores x->mode_data before allocating the reorder\nwindow. If that allocation fails, the code frees the cloned state and\nreturns -ENOMEM, leaving x->mode_data pointing at freed memory.\n\nThe xfrm clone unwind later runs destroy_state() through x->mode_data,\nso the failed clone path tears down IPTFS state that clone_state()\nalready freed.\n\nKeep the cloned IPTFS state private until all allocations succeed so\nfailed clones leave x->mode_data unset. The destroy path already\nhandles a NULL mode_data pointer."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm: iptfs: solo publicar mode_data después de configurar el clon\n\niptfs_clone_state() almacena x -> mode_data antes de asignar la ventana de reordenamiento. Si esa asignación falla, el código libera el estado clonado y devuelve -ENOMEM, dejando x -> mode_data apuntando a memoria liberada.\n\nEl desenrollado del clon xfrm más tarde ejecuta destroy_state() a través de x -> mode_data, por lo que la ruta de clonación fallida desmantela el estado IPTFS que clone_state() ya liberó.\n\nMantener el estado IPTFS clonado privado hasta que todas las asignaciones tengan éxito para que los clones fallidos dejen x -> mode_data sin establecer. La ruta de destrucción ya maneja un puntero mode_data NULL."}],"id":"CVE-2026-31471","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:43.610","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/371a43c4ac70cac0de9f9b1fc5b1660b9565b9f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5784a1e2889c9525a8f036cb586930e232170bf7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d849a2f7309fc0616e79d13b008b0a47e0458b6e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31472.json b/data/2026/CVE-2026-31472.json index 633a2b9751..f1f5fa041a 100644 --- a/data/2026/CVE-2026-31472.json +++ b/data/2026/CVE-2026-31472.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"de6d8e8ce5187f7402c9859b443355e7120c5f09","status":"affected","version":"6c82d2433671819a550227bf65bfb6043e3d3305","versionType":"git"},{"lessThan":"3db7d4f777a00164582061ccaa99569cd85011a3","status":"affected","version":"6c82d2433671819a550227bf65bfb6043e3d3305","versionType":"git"},{"lessThan":"0d10393d5eac33cbd92f7a41fddca12c41d3cb7e","status":"affected","version":"6c82d2433671819a550227bf65bfb6043e3d3305","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8BA62FCD-8829-4508-AFE2-0C12960267CD","versionEndExcluding":"6.18.21","versionStartIncluding":"6.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*","matchCriteriaId":"7DE421BA-0600-4401-A175-73CAB6A6FB4E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: validate inner IPv4 header length in IPTFS payload\n\nAdd validation of the inner IPv4 packet tot_len and ihl fields parsed\nfrom decrypted IPTFS payloads in __input_process_payload(). A crafted\nESP packet containing an inner IPv4 header with tot_len=0 causes an\ninfinite loop: iplen=0 leads to capturelen=min(0, remaining)=0, so the\ndata offset never advances and the while(data < tail) loop never\nterminates, spinning forever in softirq context.\n\nReject inner IPv4 packets where tot_len < ihl*4 or ihl*4 < sizeof(struct\niphdr), which catches both the tot_len=0 case and malformed ihl values.\nThe normal IP stack performs this validation in ip_rcv_core(), but IPTFS\nextracts and processes inner packets before they reach that layer."}],"id":"CVE-2026-31472","lastModified":"2026-06-17T10:33:48.440","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:43.740","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d10393d5eac33cbd92f7a41fddca12c41d3cb7e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3db7d4f777a00164582061ccaa99569cd85011a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de6d8e8ce5187f7402c9859b443355e7120c5f09"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"de6d8e8ce5187f7402c9859b443355e7120c5f09","status":"affected","version":"6c82d2433671819a550227bf65bfb6043e3d3305","versionType":"git"},{"lessThan":"3db7d4f777a00164582061ccaa99569cd85011a3","status":"affected","version":"6c82d2433671819a550227bf65bfb6043e3d3305","versionType":"git"},{"lessThan":"0d10393d5eac33cbd92f7a41fddca12c41d3cb7e","status":"affected","version":"6c82d2433671819a550227bf65bfb6043e3d3305","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8BA62FCD-8829-4508-AFE2-0C12960267CD","versionEndExcluding":"6.18.21","versionStartIncluding":"6.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*","matchCriteriaId":"7DE421BA-0600-4401-A175-73CAB6A6FB4E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: validate inner IPv4 header length in IPTFS payload\n\nAdd validation of the inner IPv4 packet tot_len and ihl fields parsed\nfrom decrypted IPTFS payloads in __input_process_payload(). A crafted\nESP packet containing an inner IPv4 header with tot_len=0 causes an\ninfinite loop: iplen=0 leads to capturelen=min(0, remaining)=0, so the\ndata offset never advances and the while(data < tail) loop never\nterminates, spinning forever in softirq context.\n\nReject inner IPv4 packets where tot_len < ihl*4 or ihl*4 < sizeof(struct\niphdr), which catches both the tot_len=0 case and malformed ihl values.\nThe normal IP stack performs this validation in ip_rcv_core(), but IPTFS\nextracts and processes inner packets before they reach that layer."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm: iptfs: validar la longitud del encabezado IPv4 interno en la carga útil de IPTFS\n\nAñadir validación de los campos tot_len e ihl del paquete IPv4 interno analizados de las cargas útiles de IPTFS descifradas en __input_process_payload(). Un paquete ESP manipulado que contiene un encabezado IPv4 interno con tot_len=0 causa un bucle infinito: iplen=0 lleva a capturelen=min(0, remaining)=0, por lo que el desplazamiento de datos nunca avanza y el bucle while(data < tail) nunca termina, girando indefinidamente en el contexto de softirq.\n\nRechazar paquetes IPv4 internos donde tot_len < ihl4 o ihl4 < sizeof(struct iphdr), lo que detecta tanto el caso de tot_len=0 como los valores ihl mal formados. La pila IP normal realiza esta validación en ip_rcv_core(), pero IPTFS extrae y procesa los paquetes internos antes de que lleguen a esa capa."}],"id":"CVE-2026-31472","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:43.740","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d10393d5eac33cbd92f7a41fddca12c41d3cb7e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3db7d4f777a00164582061ccaa99569cd85011a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de6d8e8ce5187f7402c9859b443355e7120c5f09"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31473.json b/data/2026/CVE-2026-31473.json index 402890c1e6..ce93ef3021 100644 --- a/data/2026/CVE-2026-31473.json +++ b/data/2026/CVE-2026-31473.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/mc/mc-request.c","drivers/media/v4l2-core/v4l2-ioctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"331242998a7ade5c2f65e14988901614629f3db5","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"2c685e99efb3b3bd2b78699fba6b1cf321975db0","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"585fd9a2063dacce8b2820f675ef23d5d17434c5","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"1a0d9083c24fbd5d22f7100f09d11e4d696a5f01","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"d8549a453d5bdc0a71de66ad47a1106703406a56","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"72b9e81e0203f03c40f3adb457f55bd4c8eb112d","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"cf2023e84f0888f96f4b65dc0804e7f3651969c1","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"bef4f4a88b73e4cc550d25f665b8a9952af22773","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/mc/mc-request.c","drivers/media/v4l2-core/v4l2-ioctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"99763E34-9798-4EED-94CE-E0AFF0E63F37","versionEndExcluding":"5.10.253","versionStartIncluding":"4.20.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.20:-:*:*:*:*:*:*","matchCriteriaId":"1072305B-94A8-4D68-9419-B786885AA310","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex\n\nMEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0)\nqueue teardown paths. This can race request object cleanup against vb2\nqueue cancellation and lead to use-after-free reports.\n\nWe already serialize request queueing against STREAMON/OFF with\nreq_queue_mutex. Extend that serialization to REQBUFS, and also take\nthe same mutex in media_request_ioctl_reinit() so REINIT is in the\nsame exclusion domain.\n\nThis keeps request cleanup and queue cancellation from running in\nparallel for request-capable devices."}],"id":"CVE-2026-31473","lastModified":"2026-10-19T19:17:55.820","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31473","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:53.356132Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:43.863","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a0d9083c24fbd5d22f7100f09d11e4d696a5f01"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c685e99efb3b3bd2b78699fba6b1cf321975db0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/331242998a7ade5c2f65e14988901614629f3db5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/585fd9a2063dacce8b2820f675ef23d5d17434c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/72b9e81e0203f03c40f3adb457f55bd4c8eb112d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bef4f4a88b73e4cc550d25f665b8a9952af22773"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cf2023e84f0888f96f4b65dc0804e7f3651969c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8549a453d5bdc0a71de66ad47a1106703406a56"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/mc/mc-request.c","drivers/media/v4l2-core/v4l2-ioctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"331242998a7ade5c2f65e14988901614629f3db5","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"2c685e99efb3b3bd2b78699fba6b1cf321975db0","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"585fd9a2063dacce8b2820f675ef23d5d17434c5","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"1a0d9083c24fbd5d22f7100f09d11e4d696a5f01","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"d8549a453d5bdc0a71de66ad47a1106703406a56","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"72b9e81e0203f03c40f3adb457f55bd4c8eb112d","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"cf2023e84f0888f96f4b65dc0804e7f3651969c1","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"},{"lessThan":"bef4f4a88b73e4cc550d25f665b8a9952af22773","status":"affected","version":"6093d3002eabd7c2913d97f1d1f4ce34b072acf9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/mc/mc-request.c","drivers/media/v4l2-core/v4l2-ioctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"99763E34-9798-4EED-94CE-E0AFF0E63F37","versionEndExcluding":"5.10.253","versionStartIncluding":"4.20.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.20:-:*:*:*:*:*:*","matchCriteriaId":"1072305B-94A8-4D68-9419-B786885AA310","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex\n\nMEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0)\nqueue teardown paths. This can race request object cleanup against vb2\nqueue cancellation and lead to use-after-free reports.\n\nWe already serialize request queueing against STREAMON/OFF with\nreq_queue_mutex. Extend that serialization to REQBUFS, and also take\nthe same mutex in media_request_ioctl_reinit() so REINIT is in the\nsame exclusion domain.\n\nThis keeps request cleanup and queue cancellation from running in\nparallel for request-capable devices."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: mc, v4l2: serializar REINIT y REQBUFS con req_queue_mutex\n\nMEDIA_REQUEST_IOC_REINIT puede ejecutarse concurrentemente con las rutas de desmantelamiento de cola de VIDIOC_REQBUFS(0). Esto puede provocar una condición de carrera entre la limpieza de objetos de solicitud y la cancelación de cola vb2, y conducir a informes de uso después de liberación.\n\nYa serializamos el encolamiento de solicitudes contra STREAMON/OFF con req_queue_mutex. Extender esa serialización a REQBUFS, y también tomar el mismo mutex en media_request_ioctl_reinit() para que REINIT esté en el mismo dominio de exclusión.\n\nEsto evita que la limpieza de solicitudes y la cancelación de cola se ejecuten en paralelo para dispositivos con capacidad de solicitud."}],"id":"CVE-2026-31473","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31473","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:53.356132Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:43.863","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a0d9083c24fbd5d22f7100f09d11e4d696a5f01"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c685e99efb3b3bd2b78699fba6b1cf321975db0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/331242998a7ade5c2f65e14988901614629f3db5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/585fd9a2063dacce8b2820f675ef23d5d17434c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/72b9e81e0203f03c40f3adb457f55bd4c8eb112d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bef4f4a88b73e4cc550d25f665b8a9952af22773"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cf2023e84f0888f96f4b65dc0804e7f3651969c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8549a453d5bdc0a71de66ad47a1106703406a56"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31474.json b/data/2026/CVE-2026-31474.json index 2055ba9f38..7aa3912490 100644 --- a/data/2026/CVE-2026-31474.json +++ b/data/2026/CVE-2026-31474.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/can/isotp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cb3d6efa78460e6d50bf68806d0db66265709f64","status":"affected","version":"96d1c81e6a0478535342dff6c730adb076cd84e8","versionType":"git"},{"lessThan":"9649d051e54413049c009638ec1dc23962c884a4","status":"affected","version":"96d1c81e6a0478535342dff6c730adb076cd84e8","versionType":"git"},{"lessThan":"eec8a1b18a79600bd4419079dc0026c1db72a830","status":"affected","version":"96d1c81e6a0478535342dff6c730adb076cd84e8","versionType":"git"},{"lessThan":"2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c","status":"affected","version":"96d1c81e6a0478535342dff6c730adb076cd84e8","versionType":"git"},{"lessThan":"424e95d62110cdbc8fd12b40918f37e408e35a92","status":"affected","version":"96d1c81e6a0478535342dff6c730adb076cd84e8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/can/isotp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.26.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.82.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.17.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"523F816F-7981-495C-95C0-E3588239D4B9","versionEndExcluding":"6.6.131","versionStartIncluding":"6.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*","matchCriteriaId":"DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: fix tx.buf use-after-free in isotp_sendmsg()\n\nisotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access\nto so->tx.buf. isotp_release() waits for ISOTP_IDLE via\nwait_event_interruptible() and then calls kfree(so->tx.buf).\n\nIf a signal interrupts the wait_event_interruptible() inside close()\nwhile tx.state is ISOTP_SENDING, the loop exits early and release\nproceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf)\nwhile sendmsg may still be reading so->tx.buf for the final CAN frame\nin isotp_fill_dataframe().\n\nThe so->tx.buf can be allocated once when the standard tx.buf length needs\nto be extended. Move the kfree() of this potentially extended tx.buf to\nsk_destruct time when either isotp_sendmsg() and isotp_release() are done."}],"id":"CVE-2026-31474","lastModified":"2026-10-19T19:17:56.000","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31474","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:55.947236Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:44.053","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/424e95d62110cdbc8fd12b40918f37e408e35a92"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9649d051e54413049c009638ec1dc23962c884a4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cb3d6efa78460e6d50bf68806d0db66265709f64"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eec8a1b18a79600bd4419079dc0026c1db72a830"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27288"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27731"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27789"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31474"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460646"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31474.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-364"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/can/isotp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cb3d6efa78460e6d50bf68806d0db66265709f64","status":"affected","version":"96d1c81e6a0478535342dff6c730adb076cd84e8","versionType":"git"},{"lessThan":"9649d051e54413049c009638ec1dc23962c884a4","status":"affected","version":"96d1c81e6a0478535342dff6c730adb076cd84e8","versionType":"git"},{"lessThan":"eec8a1b18a79600bd4419079dc0026c1db72a830","status":"affected","version":"96d1c81e6a0478535342dff6c730adb076cd84e8","versionType":"git"},{"lessThan":"2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c","status":"affected","version":"96d1c81e6a0478535342dff6c730adb076cd84e8","versionType":"git"},{"lessThan":"424e95d62110cdbc8fd12b40918f37e408e35a92","status":"affected","version":"96d1c81e6a0478535342dff6c730adb076cd84e8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/can/isotp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.26.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.82.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.17.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"523F816F-7981-495C-95C0-E3588239D4B9","versionEndExcluding":"6.6.131","versionStartIncluding":"6.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*","matchCriteriaId":"DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: fix tx.buf use-after-free in isotp_sendmsg()\n\nisotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access\nto so->tx.buf. isotp_release() waits for ISOTP_IDLE via\nwait_event_interruptible() and then calls kfree(so->tx.buf).\n\nIf a signal interrupts the wait_event_interruptible() inside close()\nwhile tx.state is ISOTP_SENDING, the loop exits early and release\nproceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf)\nwhile sendmsg may still be reading so->tx.buf for the final CAN frame\nin isotp_fill_dataframe().\n\nThe so->tx.buf can be allocated once when the standard tx.buf length needs\nto be extended. Move the kfree() of this potentially extended tx.buf to\nsk_destruct time when either isotp_sendmsg() and isotp_release() are done."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncan: isotp: corregir el uso después de liberación de tx.buf en isotp_sendmsg()\n\nisotp_sendmsg() usa solo cmpxchg() en so -> tx.state para serializar el acceso a so -> tx.buf. isotp_release() espera por ISOTP_IDLE a través de wait_event_interruptible() y luego llama a kfree(so -> tx.buf).\n\nSi una señal interrumpe wait_event_interruptible() dentro de close() mientras tx.state es ISOTP_SENDING, el bucle sale prematuramente y la liberación procede a forzar ISOTP_SHUTDOWN y continúa con kfree(so -> tx.buf) mientras sendmsg aún puede estar leyendo so -> tx.buf para el frame CAN final en isotp_fill_dataframe().\n\nEl so -> tx.buf puede ser asignado una vez cuando la longitud estándar de tx.buf necesita ser extendida. Mover el kfree() de este tx.buf potencialmente extendido al momento de sk_destruct cuando isotp_sendmsg() e isotp_release() hayan terminado."}],"id":"CVE-2026-31474","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31474","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:55.947236Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:44.053","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/424e95d62110cdbc8fd12b40918f37e408e35a92"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9649d051e54413049c009638ec1dc23962c884a4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cb3d6efa78460e6d50bf68806d0db66265709f64"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eec8a1b18a79600bd4419079dc0026c1db72a830"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27288"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27731"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27789"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31474"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460646"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31474.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-364"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31475.json b/data/2026/CVE-2026-31475.json index 3b72572b44..c3ae386a61 100644 --- a/data/2026/CVE-2026-31475.json +++ b/data/2026/CVE-2026-31475.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/soc/codecs/sma1307.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d472d1a52985211b92883bb64bbe710b45980190","status":"affected","version":"0ec6bd16705fe21d6429d6b8f7981eae2142bba8","versionType":"git"},{"lessThan":"1a82c3272626db9006f4c2cad3adf2916417aed6","status":"affected","version":"0ec6bd16705fe21d6429d6b8f7981eae2142bba8","versionType":"git"},{"lessThan":"fe757092d2329c397ecb32f2bf68a5b1c4bd9193","status":"affected","version":"0ec6bd16705fe21d6429d6b8f7981eae2142bba8","versionType":"git"},{"status":"affected","version":"f8434b8ba437d3f6cbcd9ffe8405bd16ed28fc5c","versionType":"git"},{"lessThan":"6.15","status":"affected","version":"6.14.9","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/soc/codecs/sma1307.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2932EEA2-2EDB-4FE6-9BF4-C1F90FF22950","versionEndExcluding":"6.15","versionStartIncluding":"6.14.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36BA90C1-6493-4928-A360-8DF69289C352","versionEndExcluding":"6.18.21","versionStartIncluding":"6.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*","matchCriteriaId":"A1ECC65A-EE37-4479-8E99-4BB68A22A31F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: sma1307: fix double free of devm_kzalloc() memory\n\nA previous change added NULL checks and cleanup for allocation\nfailures in sma1307_setting_loaded().\n\nHowever, the cleanup for mode_set entries is wrong. Those entries are\nallocated with devm_kzalloc(), so they are device-managed resources and\nmust not be freed with kfree(). Manually freeing them in the error path\ncan lead to a double free when devres later releases the same memory.\n\nDrop the manual kfree() loop and let devres handle the cleanup."}],"id":"CVE-2026-31475","lastModified":"2026-06-17T10:33:48.793","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:44.207","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a82c3272626db9006f4c2cad3adf2916417aed6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d472d1a52985211b92883bb64bbe710b45980190"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fe757092d2329c397ecb32f2bf68a5b1c4bd9193"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/soc/codecs/sma1307.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d472d1a52985211b92883bb64bbe710b45980190","status":"affected","version":"0ec6bd16705fe21d6429d6b8f7981eae2142bba8","versionType":"git"},{"lessThan":"1a82c3272626db9006f4c2cad3adf2916417aed6","status":"affected","version":"0ec6bd16705fe21d6429d6b8f7981eae2142bba8","versionType":"git"},{"lessThan":"fe757092d2329c397ecb32f2bf68a5b1c4bd9193","status":"affected","version":"0ec6bd16705fe21d6429d6b8f7981eae2142bba8","versionType":"git"},{"status":"affected","version":"f8434b8ba437d3f6cbcd9ffe8405bd16ed28fc5c","versionType":"git"},{"lessThan":"6.15","status":"affected","version":"6.14.9","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/soc/codecs/sma1307.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2932EEA2-2EDB-4FE6-9BF4-C1F90FF22950","versionEndExcluding":"6.15","versionStartIncluding":"6.14.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36BA90C1-6493-4928-A360-8DF69289C352","versionEndExcluding":"6.18.21","versionStartIncluding":"6.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*","matchCriteriaId":"A1ECC65A-EE37-4479-8E99-4BB68A22A31F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: sma1307: fix double free of devm_kzalloc() memory\n\nA previous change added NULL checks and cleanup for allocation\nfailures in sma1307_setting_loaded().\n\nHowever, the cleanup for mode_set entries is wrong. Those entries are\nallocated with devm_kzalloc(), so they are device-managed resources and\nmust not be freed with kfree(). Manually freeing them in the error path\ncan lead to a double free when devres later releases the same memory.\n\nDrop the manual kfree() loop and let devres handle the cleanup."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nASoC: sma1307: corrige doble liberación de memoria devm_kzalloc()\n\nUn cambio anterior añadió comprobaciones de NULL y limpieza para fallos de asignación en sma1307_setting_loaded().\n\nSin embargo, la limpieza para las entradas mode_set es incorrecta. Esas entradas se asignan con devm_kzalloc(), por lo que son recursos gestionados por el dispositivo y no deben liberarse con kfree(). Liberarlas manualmente en la ruta de error puede llevar a una doble liberación cuando devres libere posteriormente la misma memoria.\n\nEliminar el bucle kfree() manual y dejar que devres gestione la limpieza."}],"id":"CVE-2026-31475","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:44.207","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a82c3272626db9006f4c2cad3adf2916417aed6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d472d1a52985211b92883bb64bbe710b45980190"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fe757092d2329c397ecb32f2bf68a5b1c4bd9193"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31476.json b/data/2026/CVE-2026-31476.json index 7d9f3f7ea7..e27aefc883 100644 --- a/data/2026/CVE-2026-31476.json +++ b/data/2026/CVE-2026-31476.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4642ea35c03cf3d3558c009df4757cdb7af3f82d","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"},{"lessThan":"f5300690c23c5ac860499bb37dbc09cf43fd62e6","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"},{"lessThan":"6fafc4c4238e538969f1375f9ecdc6587c53f1cc","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"},{"lessThan":"1d1888b4a7aec518b707f6eca0bf08992c0e8da3","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"},{"lessThan":"a897064a457056acb976e20e3007cdf553de340f","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"},{"lessThan":"e0e5edc81b241c70355217de7e120c97c3429deb","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"},{"lessThan":"9bbb19d21ded7d78645506f20d8c44895e3d0fb9","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9CCD781C-B6A2-442F-817F-8C51A38AFB71","versionEndExcluding":"6.1.168","versionStartIncluding":"5.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*","matchCriteriaId":"40D9C0D1-0F32-4A2B-9840-1072F5497540","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: do not expire session on binding failure\n\nWhen a multichannel session binding request fails (e.g. wrong password),\nthe error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED.\nHowever, during binding, sess points to the target session looked up via\nksmbd_session_lookup_slowpath() -- which belongs to another connection's\nuser. This allows a remote attacker to invalidate any active session by\nsimply sending a binding request with a wrong password (DoS).\n\nFix this by skipping session expiration when the failed request was\na binding attempt, since the session does not belong to the current\nconnection. The reference taken by ksmbd_session_lookup_slowpath() is\nstill correctly released via ksmbd_user_session_put()."}],"id":"CVE-2026-31476","lastModified":"2026-06-17T10:33:48.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:44.337","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1d1888b4a7aec518b707f6eca0bf08992c0e8da3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4642ea35c03cf3d3558c009df4757cdb7af3f82d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6fafc4c4238e538969f1375f9ecdc6587c53f1cc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9bbb19d21ded7d78645506f20d8c44895e3d0fb9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a897064a457056acb976e20e3007cdf553de340f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0e5edc81b241c70355217de7e120c97c3429deb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f5300690c23c5ac860499bb37dbc09cf43fd62e6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4642ea35c03cf3d3558c009df4757cdb7af3f82d","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"},{"lessThan":"f5300690c23c5ac860499bb37dbc09cf43fd62e6","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"},{"lessThan":"6fafc4c4238e538969f1375f9ecdc6587c53f1cc","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"},{"lessThan":"1d1888b4a7aec518b707f6eca0bf08992c0e8da3","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"},{"lessThan":"a897064a457056acb976e20e3007cdf553de340f","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"},{"lessThan":"e0e5edc81b241c70355217de7e120c97c3429deb","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"},{"lessThan":"9bbb19d21ded7d78645506f20d8c44895e3d0fb9","status":"affected","version":"f5a544e3bab78142207e0242d22442db85ba1eff","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9CCD781C-B6A2-442F-817F-8C51A38AFB71","versionEndExcluding":"6.1.168","versionStartIncluding":"5.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*","matchCriteriaId":"40D9C0D1-0F32-4A2B-9840-1072F5497540","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: do not expire session on binding failure\n\nWhen a multichannel session binding request fails (e.g. wrong password),\nthe error path unconditionally sets sess->state = SMB2_SESSION_EXPIRED.\nHowever, during binding, sess points to the target session looked up via\nksmbd_session_lookup_slowpath() -- which belongs to another connection's\nuser. This allows a remote attacker to invalidate any active session by\nsimply sending a binding request with a wrong password (DoS).\n\nFix this by skipping session expiration when the failed request was\na binding attempt, since the session does not belong to the current\nconnection. The reference taken by ksmbd_session_lookup_slowpath() is\nstill correctly released via ksmbd_user_session_put()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: no expirar la sesión en caso de fallo de enlace\n\nCuando una solicitud de enlace de sesión multicanal falla (p. ej., contraseña incorrecta), la ruta de error establece incondicionalmente sess -> state = SMB2_SESSION_EXPIRED. Sin embargo, durante el enlace, sess apunta a la sesión objetivo buscada a través de ksmbd_session_lookup_slowpath() - - que pertenece al usuario de otra conexión. Esto permite a un atacante remoto invalidar cualquier sesión activa simplemente enviando una solicitud de enlace con una contraseña incorrecta (DoS).\n\nSolucione esto omitiendo la expiración de la sesión cuando la solicitud fallida fue un intento de enlace, ya que la sesión no pertenece a la conexión actual. La referencia tomada por ksmbd_session_lookup_slowpath() se sigue liberando correctamente a través de ksmbd_user_session_put()."}],"id":"CVE-2026-31476","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:44.337","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1d1888b4a7aec518b707f6eca0bf08992c0e8da3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4642ea35c03cf3d3558c009df4757cdb7af3f82d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6fafc4c4238e538969f1375f9ecdc6587c53f1cc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9bbb19d21ded7d78645506f20d8c44895e3d0fb9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a897064a457056acb976e20e3007cdf553de340f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0e5edc81b241c70355217de7e120c97c3429deb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f5300690c23c5ac860499bb37dbc09cf43fd62e6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31477.json b/data/2026/CVE-2026-31477.json index 4d457adbfd..27d6308ba6 100644 --- a/data/2026/CVE-2026-31477.json +++ b/data/2026/CVE-2026-31477.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cdac6f7e7e428dc70e3b5898ac6999a72ed13993","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"91aeaa7256006d79a37298f5a1df23325db91599","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"3cdacd11b41569ce75b3162142240f2355e04900","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"aab42f0795620cf0d3955a520f571f697d0f9a2a","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"309b44ed684496ed3f9c5715d10b899338623512","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9CCD781C-B6A2-442F-817F-8C51A38AFB71","versionEndExcluding":"6.1.168","versionStartIncluding":"5.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*","matchCriteriaId":"40D9C0D1-0F32-4A2B-9840-1072F5497540","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix memory leaks and NULL deref in smb2_lock()\n\nsmb2_lock() has three error handling issues after list_del() detaches\nsmb_lock from lock_list at no_check_cl:\n\n1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK\n path, goto out leaks smb_lock and its flock because the out:\n handler only iterates lock_list and rollback_list, neither of\n which contains the detached smb_lock.\n\n2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out\n leaks smb_lock and flock for the same reason. The error code\n returned to the dispatcher is also stale.\n\n3) In the rollback path, smb_flock_init() can return NULL on\n allocation failure. The result is dereferenced unconditionally,\n causing a kernel NULL pointer dereference. Add a NULL check to\n prevent the crash and clean up the bookkeeping; the VFS lock\n itself cannot be rolled back without the allocation and will be\n released at file or connection teardown.\n\nFix cases 1 and 2 by hoisting the locks_free_lock()/kfree() to before\nthe if(!rc) check in the UNLOCK branch so all exit paths share one\nfree site, and by freeing smb_lock and flock before goto out in the\nnon-UNLOCK branch. Propagate the correct error code in both cases.\nFix case 3 by wrapping the VFS unlock in an if(rlock) guard and adding\na NULL check for locks_free_lock(rlock) in the shared cleanup.\n\nFound via call-graph analysis using sqry."}],"id":"CVE-2026-31477","lastModified":"2026-06-17T10:33:49.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:44.440","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/309b44ed684496ed3f9c5715d10b899338623512"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3cdacd11b41569ce75b3162142240f2355e04900"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/91aeaa7256006d79a37298f5a1df23325db91599"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aab42f0795620cf0d3955a520f571f697d0f9a2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cdac6f7e7e428dc70e3b5898ac6999a72ed13993"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cdac6f7e7e428dc70e3b5898ac6999a72ed13993","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"91aeaa7256006d79a37298f5a1df23325db91599","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"3cdacd11b41569ce75b3162142240f2355e04900","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"aab42f0795620cf0d3955a520f571f697d0f9a2a","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"309b44ed684496ed3f9c5715d10b899338623512","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9CCD781C-B6A2-442F-817F-8C51A38AFB71","versionEndExcluding":"6.1.168","versionStartIncluding":"5.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.15:-:*:*:*:*:*:*","matchCriteriaId":"40D9C0D1-0F32-4A2B-9840-1072F5497540","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix memory leaks and NULL deref in smb2_lock()\n\nsmb2_lock() has three error handling issues after list_del() detaches\nsmb_lock from lock_list at no_check_cl:\n\n1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK\n path, goto out leaks smb_lock and its flock because the out:\n handler only iterates lock_list and rollback_list, neither of\n which contains the detached smb_lock.\n\n2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out\n leaks smb_lock and flock for the same reason. The error code\n returned to the dispatcher is also stale.\n\n3) In the rollback path, smb_flock_init() can return NULL on\n allocation failure. The result is dereferenced unconditionally,\n causing a kernel NULL pointer dereference. Add a NULL check to\n prevent the crash and clean up the bookkeeping; the VFS lock\n itself cannot be rolled back without the allocation and will be\n released at file or connection teardown.\n\nFix cases 1 and 2 by hoisting the locks_free_lock()/kfree() to before\nthe if(!rc) check in the UNLOCK branch so all exit paths share one\nfree site, and by freeing smb_lock and flock before goto out in the\nnon-UNLOCK branch. Propagate the correct error code in both cases.\nFix case 3 by wrapping the VFS unlock in an if(rlock) guard and adding\na NULL check for locks_free_lock(rlock) in the shared cleanup.\n\nFound via call-graph analysis using sqry."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: corrige fugas de memoria y desreferencia NULL en smb2_lock()\n\nsmb2_lock() tiene tres problemas de gestión de errores después de que list_del() desvincula smb_lock de lock_list en no_check_cl:\n\n1) Si vfs_lock_file() devuelve un error inesperado en la ruta que no es UNLOCK, goto out filtra smb_lock y su flock porque el gestor out: solo itera lock_list y rollback_list, ninguna de las cuales contiene el smb_lock desvinculado.\n\n2) Si vfs_lock_file() devuelve -ENOENT en la ruta UNLOCK, goto out filtra smb_lock y flock por la misma razón. El código de error devuelto al despachador también está obsoleto.\n\n3) En la ruta de reversión, smb_flock_init() puede devolver NULL en caso de fallo de asignación. El resultado es desreferenciado incondicionalmente, causando una desreferencia de puntero NULL del kernel. Añadir una comprobación de NULL para evitar el fallo y limpiar la contabilidad; el bloqueo VFS en sí mismo no puede ser revertido sin la asignación y será liberado al finalizar el archivo o la conexión.\n\nSoluciona los casos 1 y 2 elevando locks_free_lock()/kfree() a antes de la comprobación if(!rc) en la rama UNLOCK para que todas las rutas de salida compartan un único sitio de liberación, y liberando smb_lock y flock antes de goto out en la rama que no es UNLOCK. Propagar el código de error correcto en ambos casos. Soluciona el caso 3 envolviendo el desbloqueo VFS en una guarda if(rlock) y añadiendo una comprobación de NULL para locks_free_lock(rlock) en la limpieza compartida.\n\nEncontrado mediante análisis de grafo de llamadas usando sqry."}],"id":"CVE-2026-31477","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:44.440","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/309b44ed684496ed3f9c5715d10b899338623512"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3cdacd11b41569ce75b3162142240f2355e04900"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/91aeaa7256006d79a37298f5a1df23325db91599"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aab42f0795620cf0d3955a520f571f697d0f9a2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c9b95ef6f5039f19e46c3a521a4fe1752d91dfe9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cdac6f7e7e428dc70e3b5898ac6999a72ed13993"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31478.json b/data/2026/CVE-2026-31478.json index 0c7d81cb24..65c491e900 100644 --- a/data/2026/CVE-2026-31478.json +++ b/data/2026/CVE-2026-31478.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"70b4c414889492c522b6e4331562360f49be2361","status":"affected","version":"f2283680a80571ca82d710bc6ecd8f8beac67d63","versionType":"git"},{"lessThan":"9a7166f0ef8cbb7bb48dd05e2471d995566003f5","status":"affected","version":"9f297df20d93411c0b4ddad7f88ba04a7cd36e77","versionType":"git"},{"lessThan":"c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"6aef1765d6807e0f027cd87f6ac973eb0879a46d","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"80824c7e527b70cf9039534e60aff592e8f209d1","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"4cb537ae4f37d7d0f617815ed4bed7173fb50861","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"0e55f63dd08f09651d39e1b709a91705a8a0ddcb","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.145","versionType":"semver"},{"lessThan":"6.1.168","status":"affected","version":"6.1.71","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"120A3FBD-C86A-46F6-BD23-D862D4C6E574","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.145","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C6118D40-41D5-46EF-9C28-382159147BC9","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.71","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3EA624E3-2F2A-4DB3-B19B-6DE1E6D1BEA0","versionEndExcluding":"6.6.131","versionStartIncluding":"6.6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:*","matchCriteriaId":"E346B162-D566-4E62-ABDE-ECBFB21B8BFD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()\n\nAfter this commit (e2b76ab8b5c9 \"ksmbd: add support for read compound\"),\nresponse buffer management was changed to use dynamic iov array.\nIn the new design, smb2_calc_max_out_buf_len() expects the second\nargument (hdr2_len) to be the offset of ->Buffer field in the\nresponse structure, not a hardcoded magic number.\nFix the remaining call sites to use the correct offsetof() value."}],"id":"CVE-2026-31478","lastModified":"2026-10-19T19:17:56.283","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31478","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:58.409155Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:44.630","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e55f63dd08f09651d39e1b709a91705a8a0ddcb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cb537ae4f37d7d0f617815ed4bed7173fb50861"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6aef1765d6807e0f027cd87f6ac973eb0879a46d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70b4c414889492c522b6e4331562360f49be2361"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/80824c7e527b70cf9039534e60aff592e8f209d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a7166f0ef8cbb7bb48dd05e2471d995566003f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-131"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"70b4c414889492c522b6e4331562360f49be2361","status":"affected","version":"f2283680a80571ca82d710bc6ecd8f8beac67d63","versionType":"git"},{"lessThan":"9a7166f0ef8cbb7bb48dd05e2471d995566003f5","status":"affected","version":"9f297df20d93411c0b4ddad7f88ba04a7cd36e77","versionType":"git"},{"lessThan":"c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"6aef1765d6807e0f027cd87f6ac973eb0879a46d","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"80824c7e527b70cf9039534e60aff592e8f209d1","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"4cb537ae4f37d7d0f617815ed4bed7173fb50861","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"0e55f63dd08f09651d39e1b709a91705a8a0ddcb","status":"affected","version":"e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.145","versionType":"semver"},{"lessThan":"6.1.168","status":"affected","version":"6.1.71","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"120A3FBD-C86A-46F6-BD23-D862D4C6E574","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.145","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C6118D40-41D5-46EF-9C28-382159147BC9","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.71","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3EA624E3-2F2A-4DB3-B19B-6DE1E6D1BEA0","versionEndExcluding":"6.6.131","versionStartIncluding":"6.6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:*","matchCriteriaId":"E346B162-D566-4E62-ABDE-ECBFB21B8BFD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()\n\nAfter this commit (e2b76ab8b5c9 \"ksmbd: add support for read compound\"),\nresponse buffer management was changed to use dynamic iov array.\nIn the new design, smb2_calc_max_out_buf_len() expects the second\nargument (hdr2_len) to be the offset of ->Buffer field in the\nresponse structure, not a hardcoded magic number.\nFix the remaining call sites to use the correct offsetof() value."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: reemplazar hdr2_len codificado de forma rígida con offsetof() en smb2_calc_max_out_buf_len()\n\nDespués de este commit (e2b76ab8b5c9 ’ksmbd: añadir soporte para read compound’), la gestión del búfer de respuesta fue cambiada para usar un array iov dinámico. En el nuevo diseño, smb2_calc_max_out_buf_len() espera que el segundo argumento (hdr2_len) sea el desplazamiento del campo -> Buffer en la estructura de respuesta, no un número mágico codificado de forma rígida. Corregir los sitios de llamada restantes para usar el valor correcto de offsetof()."}],"id":"CVE-2026-31478","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31478","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:09:58.409155Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:44.630","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e55f63dd08f09651d39e1b709a91705a8a0ddcb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cb537ae4f37d7d0f617815ed4bed7173fb50861"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6aef1765d6807e0f027cd87f6ac973eb0879a46d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70b4c414889492c522b6e4331562360f49be2361"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/80824c7e527b70cf9039534e60aff592e8f209d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a7166f0ef8cbb7bb48dd05e2471d995566003f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c3a89e3ec1ccf64fa6a34e391e1581ebbcba8683"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-131"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31479.json b/data/2026/CVE-2026-31479.json index 7792c281d5..80653c768f 100644 --- a/data/2026/CVE-2026-31479.json +++ b/data/2026/CVE-2026-31479.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_pt.c","drivers/gpu/drm/xe/xe_vm.c","drivers/gpu/drm/xe/xe_vm_types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ccd41f110c608b3cc347b9be881c3e72cd634b2b","status":"affected","version":"8f33b4f054fc29a4774d8d10116ef460faeb84a8","versionType":"git"},{"lessThan":"5eda8001ebb5269755608d678dd1f3928ab077c9","status":"affected","version":"8f33b4f054fc29a4774d8d10116ef460faeb84a8","versionType":"git"},{"lessThan":"e6ba1749549e87b83c0c4885d84b543687c3740e","status":"affected","version":"8f33b4f054fc29a4774d8d10116ef460faeb84a8","versionType":"git"},{"lessThan":"bfe9e314d7574d1c5c851972e7aee342733819d2","status":"affected","version":"8f33b4f054fc29a4774d8d10116ef460faeb84a8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_pt.c","drivers/gpu/drm/xe/xe_vm.c","drivers/gpu/drm/xe/xe_vm_types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5D6E7FC1-C351-46F7-8992-750C075964CD","versionEndExcluding":"6.12.80","versionStartIncluding":"6.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:-:*:*:*:*:*:*","matchCriteriaId":"41E47F32-BA80-4333-96FD-4D25082B0FDD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: always keep track of remap prev/next\n\nDuring 3D workload, user is reporting hitting:\n\n[ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe], CPU#7: vkd3d_queue/9925\n[ 413.361944] CPU: 7 UID: 1000 PID: 9925 Comm: vkd3d_queue Kdump: loaded Not tainted 7.0.0-070000rc3-generic #202603090038 PREEMPT(lazy)\n[ 413.361949] RIP: 0010:vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe]\n[ 413.362074] RSP: 0018:ffffd4c25c3df930 EFLAGS: 00010282\n[ 413.362077] RAX: 0000000000000000 RBX: ffff8f3ee817ed10 RCX: 0000000000000000\n[ 413.362078] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 413.362079] RBP: ffffd4c25c3df980 R08: 0000000000000000 R09: 0000000000000000\n[ 413.362081] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8f41fbf99380\n[ 413.362082] R13: ffff8f3ee817e968 R14: 00000000ffffffef R15: ffff8f43d00bd380\n[ 413.362083] FS: 00000001040ff6c0(0000) GS:ffff8f4696d89000(0000) knlGS:00000000330b0000\n[ 413.362085] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033\n[ 413.362086] CR2: 00007ddfc4747000 CR3: 00000002e6262005 CR4: 0000000000f72ef0\n[ 413.362088] PKRU: 55555554\n[ 413.362089] Call Trace:\n[ 413.362092] \n[ 413.362096] xe_vm_bind_ioctl+0xa9a/0xc60 [xe]\n\nWhich seems to hint that the vma we are re-inserting for the ops unwind\nis either invalid or overlapping with something already inserted in the\nvm. It shouldn't be invalid since this is a re-insertion, so must have\nworked before. Leaving the likely culprit as something already placed\nwhere we want to insert the vma.\n\nFollowing from that, for the case where we do something like a rebind in\nthe middle of a vma, and one or both mapped ends are already compatible,\nwe skip doing the rebind of those vma and set next/prev to NULL. As well\nas then adjust the original unmap va range, to avoid unmapping the ends.\nHowever, if we trigger the unwind path, we end up with three va, with\nthe two ends never being removed and the original va range in the middle\nstill being the shrunken size.\n\nIf this occurs, one failure mode is when another unwind op needs to\ninteract with that range, which can happen with a vector of binds. For\nexample, if we need to re-insert something in place of the original va.\nIn this case the va is still the shrunken version, so when removing it\nand then doing a re-insert it can overlap with the ends, which were\nnever removed, triggering a warning like above, plus leaving the vm in a\nbad state.\n\nWith that, we need two things here:\n\n 1) Stop nuking the prev/next tracking for the skip cases. Instead\n relying on checking for skip prev/next, where needed. That way on the\n unwind path, we now correctly remove both ends.\n\n 2) Undo the unmap va shrinkage, on the unwind path. With the two ends\n now removed the unmap va should expand back to the original size again,\n before re-insertion.\n\nv2:\n - Update the explanation in the commit message, based on an actual IGT of\n triggering this issue, rather than conjecture.\n - Also undo the unmap shrinkage, for the skip case. With the two ends\n now removed, the original unmap va range should expand back to the\n original range.\nv3:\n - Track the old start/range separately. vma_size/start() uses the va\n info directly.\n\n(cherry picked from commit aec6969f75afbf4e01fd5fb5850ed3e9c27043ac)"}],"id":"CVE-2026-31479","lastModified":"2026-10-19T19:17:56.473","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31479","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:03.706925Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:44.993","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5eda8001ebb5269755608d678dd1f3928ab077c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bfe9e314d7574d1c5c851972e7aee342733819d2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ccd41f110c608b3cc347b9be881c3e72cd634b2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6ba1749549e87b83c0c4885d84b543687c3740e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-662"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_pt.c","drivers/gpu/drm/xe/xe_vm.c","drivers/gpu/drm/xe/xe_vm_types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ccd41f110c608b3cc347b9be881c3e72cd634b2b","status":"affected","version":"8f33b4f054fc29a4774d8d10116ef460faeb84a8","versionType":"git"},{"lessThan":"5eda8001ebb5269755608d678dd1f3928ab077c9","status":"affected","version":"8f33b4f054fc29a4774d8d10116ef460faeb84a8","versionType":"git"},{"lessThan":"e6ba1749549e87b83c0c4885d84b543687c3740e","status":"affected","version":"8f33b4f054fc29a4774d8d10116ef460faeb84a8","versionType":"git"},{"lessThan":"bfe9e314d7574d1c5c851972e7aee342733819d2","status":"affected","version":"8f33b4f054fc29a4774d8d10116ef460faeb84a8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_pt.c","drivers/gpu/drm/xe/xe_vm.c","drivers/gpu/drm/xe/xe_vm_types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5D6E7FC1-C351-46F7-8992-750C075964CD","versionEndExcluding":"6.12.80","versionStartIncluding":"6.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.8:-:*:*:*:*:*:*","matchCriteriaId":"41E47F32-BA80-4333-96FD-4D25082B0FDD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: always keep track of remap prev/next\n\nDuring 3D workload, user is reporting hitting:\n\n[ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe], CPU#7: vkd3d_queue/9925\n[ 413.361944] CPU: 7 UID: 1000 PID: 9925 Comm: vkd3d_queue Kdump: loaded Not tainted 7.0.0-070000rc3-generic #202603090038 PREEMPT(lazy)\n[ 413.361949] RIP: 0010:vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe]\n[ 413.362074] RSP: 0018:ffffd4c25c3df930 EFLAGS: 00010282\n[ 413.362077] RAX: 0000000000000000 RBX: ffff8f3ee817ed10 RCX: 0000000000000000\n[ 413.362078] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 413.362079] RBP: ffffd4c25c3df980 R08: 0000000000000000 R09: 0000000000000000\n[ 413.362081] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8f41fbf99380\n[ 413.362082] R13: ffff8f3ee817e968 R14: 00000000ffffffef R15: ffff8f43d00bd380\n[ 413.362083] FS: 00000001040ff6c0(0000) GS:ffff8f4696d89000(0000) knlGS:00000000330b0000\n[ 413.362085] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033\n[ 413.362086] CR2: 00007ddfc4747000 CR3: 00000002e6262005 CR4: 0000000000f72ef0\n[ 413.362088] PKRU: 55555554\n[ 413.362089] Call Trace:\n[ 413.362092] \n[ 413.362096] xe_vm_bind_ioctl+0xa9a/0xc60 [xe]\n\nWhich seems to hint that the vma we are re-inserting for the ops unwind\nis either invalid or overlapping with something already inserted in the\nvm. It shouldn't be invalid since this is a re-insertion, so must have\nworked before. Leaving the likely culprit as something already placed\nwhere we want to insert the vma.\n\nFollowing from that, for the case where we do something like a rebind in\nthe middle of a vma, and one or both mapped ends are already compatible,\nwe skip doing the rebind of those vma and set next/prev to NULL. As well\nas then adjust the original unmap va range, to avoid unmapping the ends.\nHowever, if we trigger the unwind path, we end up with three va, with\nthe two ends never being removed and the original va range in the middle\nstill being the shrunken size.\n\nIf this occurs, one failure mode is when another unwind op needs to\ninteract with that range, which can happen with a vector of binds. For\nexample, if we need to re-insert something in place of the original va.\nIn this case the va is still the shrunken version, so when removing it\nand then doing a re-insert it can overlap with the ends, which were\nnever removed, triggering a warning like above, plus leaving the vm in a\nbad state.\n\nWith that, we need two things here:\n\n 1) Stop nuking the prev/next tracking for the skip cases. Instead\n relying on checking for skip prev/next, where needed. That way on the\n unwind path, we now correctly remove both ends.\n\n 2) Undo the unmap va shrinkage, on the unwind path. With the two ends\n now removed the unmap va should expand back to the original size again,\n before re-insertion.\n\nv2:\n - Update the explanation in the commit message, based on an actual IGT of\n triggering this issue, rather than conjecture.\n - Also undo the unmap shrinkage, for the skip case. With the two ends\n now removed, the original unmap va range should expand back to the\n original range.\nv3:\n - Track the old start/range separately. vma_size/start() uses the va\n info directly.\n\n(cherry picked from commit aec6969f75afbf4e01fd5fb5850ed3e9c27043ac)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe: siempre mantener un registro de prev/next de reasignación\n\nDurante una carga de trabajo 3D, el usuario informa que se encuentra con:\n\n[ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe], CPU#7: vkd3d_queue/9925\n[ 413.361944] CPU: 7 UID: 1000 PID: 9925 Comm: vkd3d_queue Kdump: loaded Not tainted 7.0.0-070000rc3-generic #202603090038 PREEMPT(lazy)\n[ 413.361949] RIP: 0010:vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe]\n[ 413.362074] RSP: 0018:ffffd4c25c3df930 EFLAGS: 00010282\n[ 413.362077] RAX: 0000000000000000 RBX: ffff8f3ee817ed10 RCX: 0000000000000000\n[ 413.362078] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 413.362079] RBP: ffffd4c25c3df980 R08: 0000000000000000 R09: 0000000000000000\n[ 413.362081] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8f41fbf99380\n[ 413.362082] R13: ffff8f3ee817e968 R14: 00000000ffffffef R15: ffff8f43d00bd380\n[ 413.362083] FS: 00000001040ff6c0(0000) GS:ffff8f4696d89000(0000) knlGS:00000000330b0000\n[ 413.362085] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033\n[ 413.362086] CR2: 00007ddfc4747000 CR3: 00000002e6262005 CR4: 0000000000f72ef0\n[ 413.362088] PKRU: 55555554\n[ 413.362089] Call Trace:\n[ 413.362092] [TASK]\n[ 413.362096] xe_vm_bind_ioctl+0xa9a/0xc60 [xe]\n\nLo que parece sugerir que el vma que estamos reinsertando para el desenrollado de operaciones es inválido o se superpone con algo ya insertado en la vm. No debería ser inválido ya que esto es una reinserción, por lo que debe haber funcionado antes. Dejando al culpable probable como algo ya colocado donde queremos insertar el vma.\n\nA partir de eso, para el caso en el que hacemos algo como un rebind en medio de un vma, y uno o ambos extremos mapeados ya son compatibles, omitimos hacer el rebind de esos vma y establecemos next/prev en NULL. Así como luego ajustamos el rango va de desmapeo original, para evitar desmapear los extremos. Sin embargo, si activamos la ruta de desenrollado, terminamos con tres va, con los dos extremos nunca siendo eliminados y el rango va original en el medio aún siendo del tamaño reducido.\n\nSi esto ocurre, un modo de fallo es cuando otra operación de desenrollado necesita interactuar con ese rango, lo que puede ocurrir con un vector de enlaces. Por ejemplo, si necesitamos reinsertar algo en lugar del va original. En este caso, el va sigue siendo la versión reducida, por lo que al eliminarlo y luego hacer una reinserción puede superponerse con los extremos, que nunca fueron eliminados, lo que activa una advertencia como la anterior, además de dejar la vm en un estado defectuoso.\n\nCon eso, necesitamos dos cosas aquí:\n\n1) Dejar de anular el seguimiento de prev/next para los casos de omisión. En su lugar, confiar en la verificación de skip prev/next, donde sea necesario. De esa manera, en la ruta de desenrollado, ahora eliminamos correctamente ambos extremos.\n\n2) Deshacer la reducción del va de desmapeo, en la ruta de desenrollado. Con los dos extremos ahora eliminados, el va de desmapeo debería expandirse de nuevo al tamaño original, antes de la reinserción.\n\nv2:\n - Actualizar la explicación en el mensaje de commit, basada en una IGT real que activa este problema, en lugar de conjeturas.\n - También deshacer la reducción del desmapeo, para el caso de omisión. Con los dos extremos ahora eliminados, el rango va de desmapeo original debería expandirse de nuevo al rango original.\nv3:\n - Rastrear el inicio/rango antiguo por separado. vma_size/start() utiliza la información del va directamente.\n\n(seleccionado de la confirmación aec6969f75afbf4e01fd5fb5850ed3e9c27043ac)"}],"id":"CVE-2026-31479","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31479","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:03.706925Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:44.993","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5eda8001ebb5269755608d678dd1f3928ab077c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bfe9e314d7574d1c5c851972e7aee342733819d2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ccd41f110c608b3cc347b9be881c3e72cd634b2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6ba1749549e87b83c0c4885d84b543687c3740e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-662"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31480.json b/data/2026/CVE-2026-31480.json index 753427d9cd..d63a30fd73 100644 --- a/data/2026/CVE-2026-31480.json +++ b/data/2026/CVE-2026-31480.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/trace/trace_osnoise.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cf929c21eeed5bd39873fb14bfdfff963fa6f1da","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"},{"lessThan":"7aa095ce7d224308cb6979956f0de8607df93d4f","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"},{"lessThan":"ef41a85a55022e27cdaebf22a6676910b66f65aa","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"},{"lessThan":"03474a01c199de17a8e2d39b51df6beb9c76e831","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"},{"lessThan":"f278b8ebf7eba2a1699cfc7bf30dd3ef898d60d7","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"},{"lessThan":"7a41d4633cd2c15eb5ed31e8f3b16910e50a8c9f","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"},{"lessThan":"1f9885732248d22f788e4992c739a98c88ab8a55","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/trace/trace_osnoise.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6B079407-83B2-4F8B-863E-9DEB27376206","versionEndExcluding":"5.15.203","versionStartIncluding":"5.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:*","matchCriteriaId":"6A05198E-F8FA-4517-8D0E-8C95066AED38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix potential deadlock in cpu hotplug with osnoise\n\nThe following sequence may leads deadlock in cpu hotplug:\n\n task1 task2 task3\n ----- ----- -----\n\n mutex_lock(&interface_lock)\n\n [CPU GOING OFFLINE]\n\n cpus_write_lock();\n osnoise_cpu_die();\n kthread_stop(task3);\n wait_for_completion();\n\n osnoise_sleep();\n mutex_lock(&interface_lock);\n\n cpus_read_lock();\n\n [DEAD LOCK]\n\nFix by swap the order of cpus_read_lock() and mutex_lock(&interface_lock)."}],"id":"CVE-2026-31480","lastModified":"2026-11-05T22:18:33.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31480","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:34.600654Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:45.170","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03474a01c199de17a8e2d39b51df6beb9c76e831"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1f9885732248d22f788e4992c739a98c88ab8a55"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7a41d4633cd2c15eb5ed31e8f3b16910e50a8c9f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7aa095ce7d224308cb6979956f0de8607df93d4f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cf929c21eeed5bd39873fb14bfdfff963fa6f1da"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef41a85a55022e27cdaebf22a6676910b66f65aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f278b8ebf7eba2a1699cfc7bf30dd3ef898d60d7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/trace/trace_osnoise.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cf929c21eeed5bd39873fb14bfdfff963fa6f1da","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"},{"lessThan":"7aa095ce7d224308cb6979956f0de8607df93d4f","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"},{"lessThan":"ef41a85a55022e27cdaebf22a6676910b66f65aa","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"},{"lessThan":"03474a01c199de17a8e2d39b51df6beb9c76e831","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"},{"lessThan":"f278b8ebf7eba2a1699cfc7bf30dd3ef898d60d7","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"},{"lessThan":"7a41d4633cd2c15eb5ed31e8f3b16910e50a8c9f","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"},{"lessThan":"1f9885732248d22f788e4992c739a98c88ab8a55","status":"affected","version":"bce29ac9ce0bb0b0b146b687ab978378c21e9078","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/trace/trace_osnoise.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6B079407-83B2-4F8B-863E-9DEB27376206","versionEndExcluding":"5.15.203","versionStartIncluding":"5.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:*","matchCriteriaId":"6A05198E-F8FA-4517-8D0E-8C95066AED38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix potential deadlock in cpu hotplug with osnoise\n\nThe following sequence may leads deadlock in cpu hotplug:\n\n task1 task2 task3\n ----- ----- -----\n\n mutex_lock(&interface_lock)\n\n [CPU GOING OFFLINE]\n\n cpus_write_lock();\n osnoise_cpu_die();\n kthread_stop(task3);\n wait_for_completion();\n\n osnoise_sleep();\n mutex_lock(&interface_lock);\n\n cpus_read_lock();\n\n [DEAD LOCK]\n\nFix by swap the order of cpus_read_lock() and mutex_lock(&interface_lock)."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntracing: Soluciona un interbloqueo potencial en el hotplug de CPU con osnoise\n\nLa siguiente secuencia puede llevar a un interbloqueo en el hotplug de CPU:\n\n tarea1 tarea2 tarea3\n - - - - - - - - - - - - - - -\n\n mutex_lock(ref:interface_lock)\n\n [CPU PASANDO A ESTADO DESCONECTADO]\n\n cpus_write_lock();\n osnoise_cpu_die();\n kthread_stop(task3);\n wait_for_completion();\n\n osnoise_sleep();\n mutex_lock(ref:interface_lock);\n\n cpus_read_lock();\n\n [INTERBLOQUEO]\n\nSolucionado intercambiando el orden de cpus_read_lock() y mutex_lock(ref:interface_lock)."}],"id":"CVE-2026-31480","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31480","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:34.600654Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:45.170","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03474a01c199de17a8e2d39b51df6beb9c76e831"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1f9885732248d22f788e4992c739a98c88ab8a55"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7a41d4633cd2c15eb5ed31e8f3b16910e50a8c9f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7aa095ce7d224308cb6979956f0de8607df93d4f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cf929c21eeed5bd39873fb14bfdfff963fa6f1da"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef41a85a55022e27cdaebf22a6676910b66f65aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f278b8ebf7eba2a1699cfc7bf30dd3ef898d60d7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31481.json b/data/2026/CVE-2026-31481.json index e419d22e23..b33fddb777 100644 --- a/data/2026/CVE-2026-31481.json +++ b/data/2026/CVE-2026-31481.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/trace/trace_events_trigger.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"771624b7884a83bb9f922ae64ee41a5f8b7576c9","status":"affected","version":"61d445af0a7c70018111919e47beaaee15653f2f","versionType":"git"},{"lessThan":"250ab25391edeeab8462b68be42e4904506c409c","status":"affected","version":"61d445af0a7c70018111919e47beaaee15653f2f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/trace/trace_events_trigger.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5054C854-C253-4020-BD2E-2BDA121E424C","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Drain deferred trigger frees if kthread creation fails\n\nBoot-time trigger registration can fail before the trigger-data cleanup\nkthread exists. Deferring those frees until late init is fine, but the\npost-boot fallback must still drain the deferred list if kthread\ncreation never succeeds.\n\nOtherwise, boot-deferred nodes can accumulate on\ntrigger_data_free_list, later frees fall back to synchronously freeing\nonly the current object, and the older queued entries are leaked\nforever.\n\nTo trigger this, add the following to the kernel command line:\n\n trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon\n\nThe second traceon trigger will fail and be freed. This triggers a NULL\npointer dereference and crashes the kernel.\n\nKeep the deferred boot-time behavior, but when kthread creation fails,\ndrain the whole queued list synchronously. Do the same in the late-init\ndrain path so queued entries are not stranded there either."}],"id":"CVE-2026-31481","lastModified":"2026-06-17T10:33:49.520","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:45.340","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/250ab25391edeeab8462b68be42e4904506c409c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/771624b7884a83bb9f922ae64ee41a5f8b7576c9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/trace/trace_events_trigger.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"771624b7884a83bb9f922ae64ee41a5f8b7576c9","status":"affected","version":"61d445af0a7c70018111919e47beaaee15653f2f","versionType":"git"},{"lessThan":"250ab25391edeeab8462b68be42e4904506c409c","status":"affected","version":"61d445af0a7c70018111919e47beaaee15653f2f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/trace/trace_events_trigger.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5054C854-C253-4020-BD2E-2BDA121E424C","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Drain deferred trigger frees if kthread creation fails\n\nBoot-time trigger registration can fail before the trigger-data cleanup\nkthread exists. Deferring those frees until late init is fine, but the\npost-boot fallback must still drain the deferred list if kthread\ncreation never succeeds.\n\nOtherwise, boot-deferred nodes can accumulate on\ntrigger_data_free_list, later frees fall back to synchronously freeing\nonly the current object, and the older queued entries are leaked\nforever.\n\nTo trigger this, add the following to the kernel command line:\n\n trace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon\n\nThe second traceon trigger will fail and be freed. This triggers a NULL\npointer dereference and crashes the kernel.\n\nKeep the deferred boot-time behavior, but when kthread creation fails,\ndrain the whole queued list synchronously. Do the same in the late-init\ndrain path so queued entries are not stranded there either."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrastreo: Drenar liberaciones de disparadores diferidas si la creación de kthread falla\n\nEl registro de disparadores en tiempo de arranque puede fallar antes de que exista el kthread de limpieza de datos del disparador. Diferir esas liberaciones hasta la inicialización tardía está bien, pero la alternativa posterior al arranque aún debe drenar la lista diferida si la creación de kthread nunca tiene éxito.\n\nDe lo contrario, los nodos diferidos en el arranque pueden acumularse en trigger_data_free_list, las liberaciones posteriores recurren a liberar sincrónicamente solo el objeto actual, y las entradas en cola más antiguas se filtran para siempre.\n\nPara activar esto, añada lo siguiente a la línea de comandos del kernel:\n\ntrace_event=sched_switch trace_trigger=sched_switch.traceon,sched_switch.traceon\n\nEl segundo disparador traceon fallará y será liberado. Esto activa una desreferencia de puntero NULL y bloquea el kernel.\n\nMantenga el comportamiento diferido en tiempo de arranque, pero cuando la creación de kthread falla, drene toda la lista en cola sincrónicamente. Haga lo mismo en la ruta de drenaje de inicialización tardía para que las entradas en cola tampoco queden varadas allí."}],"id":"CVE-2026-31481","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:45.340","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/250ab25391edeeab8462b68be42e4904506c409c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/771624b7884a83bb9f922ae64ee41a5f8b7576c9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31482.json b/data/2026/CVE-2026-31482.json index 3b626a9ead..690a601960 100644 --- a/data/2026/CVE-2026-31482.json +++ b/data/2026/CVE-2026-31482.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/s390/kernel/entry.S"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a58d298a83a3a9b7ca99ded9d60a1e77231159ef","status":"affected","version":"f33f2d4c7c80c641f6ca3dfe5e7dfe1f91543780","versionType":"git"},{"lessThan":"95c899cd791803a5bf7b73e5994fbbe1cc1a9c36","status":"affected","version":"f33f2d4c7c80c641f6ca3dfe5e7dfe1f91543780","versionType":"git"},{"lessThan":"7f4e3233faa8470dd0627bc49b2809f2bfebd909","status":"affected","version":"f33f2d4c7c80c641f6ca3dfe5e7dfe1f91543780","versionType":"git"},{"lessThan":"99a8b420f3f0e162eb9c9c9253929d4d23f9bd30","status":"affected","version":"f33f2d4c7c80c641f6ca3dfe5e7dfe1f91543780","versionType":"git"},{"lessThan":"0738d395aab8fae3b5a3ad3fc640630c91693c27","status":"affected","version":"f33f2d4c7c80c641f6ca3dfe5e7dfe1f91543780","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/s390/kernel/entry.S"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"523F816F-7981-495C-95C0-E3588239D4B9","versionEndExcluding":"6.6.131","versionStartIncluding":"6.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*","matchCriteriaId":"DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/entry: Scrub r12 register on kernel entry\n\nBefore commit f33f2d4c7c80 (\"s390/bp: remove TIF_ISOLATE_BP\"),\nall entry handlers loaded r12 with the current task pointer\n(lg %r12,__LC_CURRENT) for use by the BPENTER/BPEXIT macros. That\ncommit removed TIF_ISOLATE_BP, dropping both the branch prediction\nmacros and the r12 load, but did not add r12 to the register clearing\nsequence.\n\nAdd the missing xgr %r12,%r12 to make the register scrub consistent\nacross all entry points."}],"id":"CVE-2026-31482","lastModified":"2026-11-05T22:18:33.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31482","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:38.810147Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:45.457","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0738d395aab8fae3b5a3ad3fc640630c91693c27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7f4e3233faa8470dd0627bc49b2809f2bfebd909"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95c899cd791803a5bf7b73e5994fbbe1cc1a9c36"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/99a8b420f3f0e162eb9c9c9253929d4d23f9bd30"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a58d298a83a3a9b7ca99ded9d60a1e77231159ef"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/s390/kernel/entry.S"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a58d298a83a3a9b7ca99ded9d60a1e77231159ef","status":"affected","version":"f33f2d4c7c80c641f6ca3dfe5e7dfe1f91543780","versionType":"git"},{"lessThan":"95c899cd791803a5bf7b73e5994fbbe1cc1a9c36","status":"affected","version":"f33f2d4c7c80c641f6ca3dfe5e7dfe1f91543780","versionType":"git"},{"lessThan":"7f4e3233faa8470dd0627bc49b2809f2bfebd909","status":"affected","version":"f33f2d4c7c80c641f6ca3dfe5e7dfe1f91543780","versionType":"git"},{"lessThan":"99a8b420f3f0e162eb9c9c9253929d4d23f9bd30","status":"affected","version":"f33f2d4c7c80c641f6ca3dfe5e7dfe1f91543780","versionType":"git"},{"lessThan":"0738d395aab8fae3b5a3ad3fc640630c91693c27","status":"affected","version":"f33f2d4c7c80c641f6ca3dfe5e7dfe1f91543780","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/s390/kernel/entry.S"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"523F816F-7981-495C-95C0-E3588239D4B9","versionEndExcluding":"6.6.131","versionStartIncluding":"6.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*","matchCriteriaId":"DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/entry: Scrub r12 register on kernel entry\n\nBefore commit f33f2d4c7c80 (\"s390/bp: remove TIF_ISOLATE_BP\"),\nall entry handlers loaded r12 with the current task pointer\n(lg %r12,__LC_CURRENT) for use by the BPENTER/BPEXIT macros. That\ncommit removed TIF_ISOLATE_BP, dropping both the branch prediction\nmacros and the r12 load, but did not add r12 to the register clearing\nsequence.\n\nAdd the missing xgr %r12,%r12 to make the register scrub consistent\nacross all entry points."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ns390/entry: Limpiar el registro r12 al entrar al kernel\n\nAntes del commit f33f2d4c7c80 (’s390/bp: remove TIF_ISOLATE_BP’), todos los manejadores de entrada cargaban r12 con el puntero de la tarea actual (lg %r12,__LC_CURRENT) para uso de las macros BPENTER/BPEXIT. Ese commit eliminó TIF_ISOLATE_BP, descartando tanto las macros de predicción de ramas como la carga de r12, pero no añadió r12 a la secuencia de limpieza de registros.\n\nAñadir el xgr %r12,%r12 faltante para hacer que la limpieza del registro sea consistente en todos los puntos de entrada."}],"id":"CVE-2026-31482","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31482","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:38.810147Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:45.457","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0738d395aab8fae3b5a3ad3fc640630c91693c27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7f4e3233faa8470dd0627bc49b2809f2bfebd909"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95c899cd791803a5bf7b73e5994fbbe1cc1a9c36"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/99a8b420f3f0e162eb9c9c9253929d4d23f9bd30"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a58d298a83a3a9b7ca99ded9d60a1e77231159ef"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31483.json b/data/2026/CVE-2026-31483.json index c4997f2cb3..c67c96c5d5 100644 --- a/data/2026/CVE-2026-31483.json +++ b/data/2026/CVE-2026-31483.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/s390/kernel/syscall.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3c3b97064764899c39a0abbd35a6caa031e70333","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"},{"lessThan":"1cb9c7bc9025c637564fabc7fcc3c9343949e310","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"},{"lessThan":"7a5260fbc6e79a1595328ec5c6aa3f937504a1f0","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"},{"lessThan":"f8c444b918d639e1f9a621ee20fe481c1d10dfc4","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"},{"lessThan":"87776f02449e3bded95b2ccbd6b012e9ae64e6f3","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"},{"lessThan":"4d05dd18d867d58c6952a3bc260d244899da7256","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"},{"lessThan":"48b8814e25d073dd84daf990a879a820bad2bcbd","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/s390/kernel/syscall.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AA3D6441-4F2E-41AB-A26D-388B03A5932F","versionEndExcluding":"5.15.203","versionStartIncluding":"5.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:*","matchCriteriaId":"75EB504D-4A83-4C67-9C8D-FD9C6C8EB4CD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/syscalls: Add spectre boundary for syscall dispatch table\n\nThe s390 syscall number is directly controlled by userspace, but does\nnot have an array_index_nospec() boundary to prevent access past the\nsyscall function pointer tables."}],"id":"CVE-2026-31483","lastModified":"2026-11-05T22:18:33.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31483","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:44.578683Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:45.627","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1cb9c7bc9025c637564fabc7fcc3c9343949e310"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c3b97064764899c39a0abbd35a6caa031e70333"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48b8814e25d073dd84daf990a879a820bad2bcbd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4d05dd18d867d58c6952a3bc260d244899da7256"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7a5260fbc6e79a1595328ec5c6aa3f937504a1f0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/87776f02449e3bded95b2ccbd6b012e9ae64e6f3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f8c444b918d639e1f9a621ee20fe481c1d10dfc4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/s390/kernel/syscall.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3c3b97064764899c39a0abbd35a6caa031e70333","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"},{"lessThan":"1cb9c7bc9025c637564fabc7fcc3c9343949e310","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"},{"lessThan":"7a5260fbc6e79a1595328ec5c6aa3f937504a1f0","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"},{"lessThan":"f8c444b918d639e1f9a621ee20fe481c1d10dfc4","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"},{"lessThan":"87776f02449e3bded95b2ccbd6b012e9ae64e6f3","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"},{"lessThan":"4d05dd18d867d58c6952a3bc260d244899da7256","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"},{"lessThan":"48b8814e25d073dd84daf990a879a820bad2bcbd","status":"affected","version":"56e62a73702836017564eaacd5212e4d0fa1c01d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/s390/kernel/syscall.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AA3D6441-4F2E-41AB-A26D-388B03A5932F","versionEndExcluding":"5.15.203","versionStartIncluding":"5.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:*","matchCriteriaId":"75EB504D-4A83-4C67-9C8D-FD9C6C8EB4CD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/syscalls: Add spectre boundary for syscall dispatch table\n\nThe s390 syscall number is directly controlled by userspace, but does\nnot have an array_index_nospec() boundary to prevent access past the\nsyscall function pointer tables."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ns390/syscalls: Añadir límite Spectre para la tabla de despacho de llamadas al sistema\n\nEl número de llamada al sistema s390 es directamente controlado por el espacio de usuario, pero no tiene un límite array_index_nospec() para evitar el acceso más allá de las tablas de punteros de función de llamadas al sistema."}],"id":"CVE-2026-31483","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31483","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:44.578683Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:45.627","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1cb9c7bc9025c637564fabc7fcc3c9343949e310"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c3b97064764899c39a0abbd35a6caa031e70333"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48b8814e25d073dd84daf990a879a820bad2bcbd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4d05dd18d867d58c6952a3bc260d244899da7256"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7a5260fbc6e79a1595328ec5c6aa3f937504a1f0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/87776f02449e3bded95b2ccbd6b012e9ae64e6f3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f8c444b918d639e1f9a621ee20fe481c1d10dfc4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31484.json b/data/2026/CVE-2026-31484.json index 1620d1ba75..2824e6df70 100644 --- a/data/2026/CVE-2026-31484.json +++ b/data/2026/CVE-2026-31484.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["io_uring/fdinfo.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ba21ab247a5be5382da7464b95afbe5f0e9aa503","status":"affected","version":"1cba30bf9fdd6c982708f3587f609a30c370d889","versionType":"git"},{"lessThan":"5170efd9c344c68a8075dcb8ed38d3f8a60e7ed4","status":"affected","version":"1cba30bf9fdd6c982708f3587f609a30c370d889","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["io_uring/fdinfo.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5054C854-C253-4020-BD2E-2BDA121E424C","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/fdinfo: fix OOB read in SQE_MIXED wrap check\n\n__io_uring_show_fdinfo() iterates over pending SQEs and, for 128-byte\nSQEs on an IORING_SETUP_SQE_MIXED ring, needs to detect when the second\nhalf of the SQE would be past the end of the sq_sqes array. The current\ncheck tests (++sq_head & sq_mask) == 0, but sq_head is only incremented\nwhen a 128-byte SQE is encountered, not on every iteration. The actual\narray index is sq_idx = (i + sq_head) & sq_mask, which can be sq_mask\n(the last slot) while the wrap check passes.\n\nFix by checking sq_idx directly. Keep the sq_head increment so the loop\nstill skips the second half of the 128-byte SQE on the next iteration."}],"id":"CVE-2026-31484","lastModified":"2026-06-17T10:33:49.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:45.800","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5170efd9c344c68a8075dcb8ed38d3f8a60e7ed4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba21ab247a5be5382da7464b95afbe5f0e9aa503"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["io_uring/fdinfo.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ba21ab247a5be5382da7464b95afbe5f0e9aa503","status":"affected","version":"1cba30bf9fdd6c982708f3587f609a30c370d889","versionType":"git"},{"lessThan":"5170efd9c344c68a8075dcb8ed38d3f8a60e7ed4","status":"affected","version":"1cba30bf9fdd6c982708f3587f609a30c370d889","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["io_uring/fdinfo.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5054C854-C253-4020-BD2E-2BDA121E424C","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/fdinfo: fix OOB read in SQE_MIXED wrap check\n\n__io_uring_show_fdinfo() iterates over pending SQEs and, for 128-byte\nSQEs on an IORING_SETUP_SQE_MIXED ring, needs to detect when the second\nhalf of the SQE would be past the end of the sq_sqes array. The current\ncheck tests (++sq_head & sq_mask) == 0, but sq_head is only incremented\nwhen a 128-byte SQE is encountered, not on every iteration. The actual\narray index is sq_idx = (i + sq_head) & sq_mask, which can be sq_mask\n(the last slot) while the wrap check passes.\n\nFix by checking sq_idx directly. Keep the sq_head increment so the loop\nstill skips the second half of the 128-byte SQE on the next iteration."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nio_uring/fdinfo: corrección de lectura fuera de límites en la verificación de envoltura SQE_MIXED\n\n__io_uring_show_fdinfo() itera sobre los SQE pendientes y, para los SQE de 128 bytes en un anillo IORING_SETUP_SQE_MIXED, necesita detectar cuándo la segunda mitad del SQE estaría más allá del final del array sq_sqes. La verificación actual prueba (++sq_head & sq_mask) == 0, pero sq_head solo se incrementa cuando se encuentra un SQE de 128 bytes, no en cada iteración. El índice real del array es sq_idx = (i + sq_head) & sq_mask, que puede ser sq_mask (la última ranura) mientras la verificación de envoltura pasa.\n\nSolución al verificar sq_idx directamente. Mantener el incremento de sq_head para que el bucle aún omita la segunda mitad del SQE de 128 bytes en la siguiente iteración."}],"id":"CVE-2026-31484","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:45.800","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5170efd9c344c68a8075dcb8ed38d3f8a60e7ed4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba21ab247a5be5382da7464b95afbe5f0e9aa503"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31485.json b/data/2026/CVE-2026-31485.json index 13ee33904d..dc74ec4206 100644 --- a/data/2026/CVE-2026-31485.json +++ b/data/2026/CVE-2026-31485.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/spi/spi-fsl-lpspi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fbe6f40caeebb0b1ea9dfedc259124c1d3cda7a6","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"ca4483f36ac1b62e69f8b182c5b8f059e0abecfb","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"e3fd54f8b0317fbccc103961ddd660f2a32dcf0b","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"adb25339b66112393fd6892ceff926765feb5b86","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"d5d01f24bc6fbde40b4e567ef9160194b61267bc","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"e89e2b97253c124d37bf88e96e5e8ce5c3aeeec3","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"15650dfbaeeb14bcaaf053b93cf631db8d465300","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"b341c1176f2e001b3adf0b47154fc31589f7410e","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/spi/spi-fsl-lpspi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C0D3F33A-9B37-46EB-A8C3-97B2F00C65EB","versionEndExcluding":"5.10.253","versionStartIncluding":"4.10.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.10:-:*:*:*:*:*:*","matchCriteriaId":"C201E405-86F2-4F96-984A-00A865219C86","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-fsl-lpspi: fix teardown order issue (UAF)\n\nThere is a teardown order issue in the driver. The SPI controller is\nregistered using devm_spi_register_controller(), which delays\nunregistration of the SPI controller until after the fsl_lpspi_remove()\nfunction returns.\n\nAs the fsl_lpspi_remove() function synchronously tears down the DMA\nchannels, a running SPI transfer triggers the following NULL pointer\ndereference due to use after free:\n\n| fsl_lpspi 42550000.spi: I/O Error in DMA RX\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[...]\n| Call trace:\n| fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]\n| fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]\n| spi_transfer_one_message+0x49c/0x7c8\n| __spi_pump_transfer_message+0x120/0x420\n| __spi_sync+0x2c4/0x520\n| spi_sync+0x34/0x60\n| spidev_message+0x20c/0x378 [spidev]\n| spidev_ioctl+0x398/0x750 [spidev]\n[...]\n\nSwitch from devm_spi_register_controller() to spi_register_controller() in\nfsl_lpspi_probe() and add the corresponding spi_unregister_controller() in\nfsl_lpspi_remove()."}],"id":"CVE-2026-31485","lastModified":"2026-11-10T13:18:56.283","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31485","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:50.422620Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:45.923","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/15650dfbaeeb14bcaaf053b93cf631db8d465300"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/adb25339b66112393fd6892ceff926765feb5b86"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b341c1176f2e001b3adf0b47154fc31589f7410e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca4483f36ac1b62e69f8b182c5b8f059e0abecfb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5d01f24bc6fbde40b4e567ef9160194b61267bc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e3fd54f8b0317fbccc103961ddd660f2a32dcf0b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e89e2b97253c124d37bf88e96e5e8ce5c3aeeec3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbe6f40caeebb0b1ea9dfedc259124c1d3cda7a6"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/spi/spi-fsl-lpspi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fbe6f40caeebb0b1ea9dfedc259124c1d3cda7a6","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"ca4483f36ac1b62e69f8b182c5b8f059e0abecfb","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"e3fd54f8b0317fbccc103961ddd660f2a32dcf0b","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"adb25339b66112393fd6892ceff926765feb5b86","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"d5d01f24bc6fbde40b4e567ef9160194b61267bc","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"e89e2b97253c124d37bf88e96e5e8ce5c3aeeec3","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"15650dfbaeeb14bcaaf053b93cf631db8d465300","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"},{"lessThan":"b341c1176f2e001b3adf0b47154fc31589f7410e","status":"affected","version":"5314987de5e5f5e38436ef4a69328bc472bbd63e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/spi/spi-fsl-lpspi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C0D3F33A-9B37-46EB-A8C3-97B2F00C65EB","versionEndExcluding":"5.10.253","versionStartIncluding":"4.10.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.10:-:*:*:*:*:*:*","matchCriteriaId":"C201E405-86F2-4F96-984A-00A865219C86","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-fsl-lpspi: fix teardown order issue (UAF)\n\nThere is a teardown order issue in the driver. The SPI controller is\nregistered using devm_spi_register_controller(), which delays\nunregistration of the SPI controller until after the fsl_lpspi_remove()\nfunction returns.\n\nAs the fsl_lpspi_remove() function synchronously tears down the DMA\nchannels, a running SPI transfer triggers the following NULL pointer\ndereference due to use after free:\n\n| fsl_lpspi 42550000.spi: I/O Error in DMA RX\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[...]\n| Call trace:\n| fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]\n| fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]\n| spi_transfer_one_message+0x49c/0x7c8\n| __spi_pump_transfer_message+0x120/0x420\n| __spi_sync+0x2c4/0x520\n| spi_sync+0x34/0x60\n| spidev_message+0x20c/0x378 [spidev]\n| spidev_ioctl+0x398/0x750 [spidev]\n[...]\n\nSwitch from devm_spi_register_controller() to spi_register_controller() in\nfsl_lpspi_probe() and add the corresponding spi_unregister_controller() in\nfsl_lpspi_remove()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nspi: spi-fsl-lpspi: corregir problema de orden de desmantelamiento (UAF)\n\nExiste un problema de orden de desmantelamiento en el controlador. El controlador SPI se registra usando devm_spi_register_controller(), lo que retrasa la anulación del registro del controlador SPI hasta después de que la función fsl_lpspi_remove() retorne.\n\nComo la función fsl_lpspi_remove() desmantela sincrónicamente los canales DMA, una transferencia SPI en ejecución activa la siguiente desreferencia de puntero NULL debido al uso después de la liberación:\n\n| fsl_lpspi 42550000.spi: Error de E/S en DMA RX\n| No se puede manejar la desreferencia de puntero NULL del kernel en la dirección virtual 0000000000000000\n[...]\n| Traza de llamada:\n| fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]\n| fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]\n| spi_transfer_one_message+0x49c/0x7c8\n| __spi_pump_transfer_message+0x120/0x420\n| __spi_sync+0x2c4/0x520\n| spi_sync+0x34/0x60\n| spidev_message+0x20c/0x378 [spidev]\n| spidev_ioctl+0x398/0x750 [spidev]\n[...]\n\nCambiar de devm_spi_register_controller() a spi_register_controller() en fsl_lpspi_probe() y añadir el correspondiente spi_unregister_controller() en fsl_lpspi_remove()."}],"id":"CVE-2026-31485","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31485","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:50.422620Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:45.923","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/15650dfbaeeb14bcaaf053b93cf631db8d465300"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/adb25339b66112393fd6892ceff926765feb5b86"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b341c1176f2e001b3adf0b47154fc31589f7410e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca4483f36ac1b62e69f8b182c5b8f059e0abecfb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5d01f24bc6fbde40b4e567ef9160194b61267bc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e3fd54f8b0317fbccc103961ddd660f2a32dcf0b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e89e2b97253c124d37bf88e96e5e8ce5c3aeeec3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbe6f40caeebb0b1ea9dfedc259124c1d3cda7a6"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31486.json b/data/2026/CVE-2026-31486.json index f020a6a8a7..f8c7c8677b 100644 --- a/data/2026/CVE-2026-31486.json +++ b/data/2026/CVE-2026-31486.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hwmon/pmbus/pmbus_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f0c9ea9c3a208e79c812e10e2bcef87b46564f01","status":"affected","version":"ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7","versionType":"git"},{"lessThan":"b26849cffaa7c43355b82e9bef3725e786973a1a","status":"affected","version":"ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7","versionType":"git"},{"lessThan":"acf04e2863132f6d9222f71f3a76fb9782cbe061","status":"affected","version":"ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7","versionType":"git"},{"lessThan":"4e9d723d9f198b86f6882a84c501ba1f39e8d055","status":"affected","version":"ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7","versionType":"git"},{"lessThan":"2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07","status":"affected","version":"ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7","versionType":"git"},{"lessThan":"754bd2b4a084b90b5e7b630e1f423061a9b9b761","status":"affected","version":"ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hwmon/pmbus/pmbus_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.19"},{"lessThan":"3.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.92","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"689AD2FA-326D-4E6F-8192-689D60EEA86F","versionEndExcluding":"6.18.21","versionStartIncluding":"3.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.19:-:*:*:*:*:*:*","matchCriteriaId":"8C54596F-5461-44C4-91FB-7453BE905748","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/core) Protect regulator operations with mutex\n\nThe regulator operations pmbus_regulator_get_voltage(),\npmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage()\naccess PMBus registers and shared data but were not protected by\nthe update_lock mutex. This could lead to race conditions.\n\nHowever, adding mutex protection directly to these functions causes\na deadlock because pmbus_regulator_notify() (which calls\nregulator_notifier_call_chain()) is often called with the mutex\nalready held (e.g., from pmbus_fault_handler()). If a regulator\ncallback then calls one of the now-protected voltage functions,\nit will attempt to acquire the same mutex.\n\nRework pmbus_regulator_notify() to utilize a worker function to\nsend notifications outside of the mutex protection. Events are\nstored as atomics in a per-page bitmask and processed by the worker.\n\nInitialize the worker and its associated data during regulator\nregistration, and ensure it is cancelled on device removal using\ndevm_add_action_or_reset().\n\nWhile at it, remove the unnecessary include of linux/of.h."}],"id":"CVE-2026-31486","lastModified":"2026-10-30T13:18:40.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31486","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:08.417028Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:46.160","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e9d723d9f198b86f6882a84c501ba1f39e8d055"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/754bd2b4a084b90b5e7b630e1f423061a9b9b761"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/acf04e2863132f6d9222f71f3a76fb9782cbe061"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b26849cffaa7c43355b82e9bef3725e786973a1a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f0c9ea9c3a208e79c812e10e2bcef87b46564f01"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hwmon/pmbus/pmbus_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f0c9ea9c3a208e79c812e10e2bcef87b46564f01","status":"affected","version":"ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7","versionType":"git"},{"lessThan":"b26849cffaa7c43355b82e9bef3725e786973a1a","status":"affected","version":"ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7","versionType":"git"},{"lessThan":"acf04e2863132f6d9222f71f3a76fb9782cbe061","status":"affected","version":"ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7","versionType":"git"},{"lessThan":"4e9d723d9f198b86f6882a84c501ba1f39e8d055","status":"affected","version":"ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7","versionType":"git"},{"lessThan":"2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07","status":"affected","version":"ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7","versionType":"git"},{"lessThan":"754bd2b4a084b90b5e7b630e1f423061a9b9b761","status":"affected","version":"ddbb4db4ced1ba784fcd3500179a7291b6c5d7b7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hwmon/pmbus/pmbus_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.19"},{"lessThan":"3.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.92","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"689AD2FA-326D-4E6F-8192-689D60EEA86F","versionEndExcluding":"6.18.21","versionStartIncluding":"3.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.19:-:*:*:*:*:*:*","matchCriteriaId":"8C54596F-5461-44C4-91FB-7453BE905748","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/core) Protect regulator operations with mutex\n\nThe regulator operations pmbus_regulator_get_voltage(),\npmbus_regulator_set_voltage(), and pmbus_regulator_list_voltage()\naccess PMBus registers and shared data but were not protected by\nthe update_lock mutex. This could lead to race conditions.\n\nHowever, adding mutex protection directly to these functions causes\na deadlock because pmbus_regulator_notify() (which calls\nregulator_notifier_call_chain()) is often called with the mutex\nalready held (e.g., from pmbus_fault_handler()). If a regulator\ncallback then calls one of the now-protected voltage functions,\nit will attempt to acquire the same mutex.\n\nRework pmbus_regulator_notify() to utilize a worker function to\nsend notifications outside of the mutex protection. Events are\nstored as atomics in a per-page bitmask and processed by the worker.\n\nInitialize the worker and its associated data during regulator\nregistration, and ensure it is cancelled on device removal using\ndevm_add_action_or_reset().\n\nWhile at it, remove the unnecessary include of linux/of.h."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nhwmon: (pmbus/core) Proteger las operaciones del regulador con un mutex\n\nLas operaciones del regulador pmbus_regulator_get_voltage(), pmbus_regulator_set_voltage(), y pmbus_regulator_list_voltage() acceden a los registros PMBus y a datos compartidos, pero no estaban protegidas por el mutex update_lock. Esto podría llevar a condiciones de carrera.\n\nSin embargo, añadir protección de mutex directamente a estas funciones causa un interbloqueo porque pmbus_regulator_notify() (que llama a regulator_notifier_call_chain()) a menudo se llama con el mutex ya retenido (por ejemplo, desde pmbus_fault_handler()). Si una devolución de llamada del regulador llama entonces a una de las funciones de voltaje ahora protegidas, intentará adquirir el mismo mutex.\n\nReestructurar pmbus_regulator_notify() para utilizar una función de trabajador para enviar notificaciones fuera de la protección del mutex. Los eventos se almacenan como atómicos en una máscara de bits por página y son procesados por el trabajador.\n\nInicializar el trabajador y sus datos asociados durante el registro del regulador, y asegurar que se cancele al retirar el dispositivo utilizando devm_add_action_or_reset().\n\nDe paso, eliminar la inclusión innecesaria de linux/of.h."}],"id":"CVE-2026-31486","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31486","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:08.417028Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:46.160","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c77ae315f3ce9d2c8e1609be74c9358c1fe4e07"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e9d723d9f198b86f6882a84c501ba1f39e8d055"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/754bd2b4a084b90b5e7b630e1f423061a9b9b761"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/acf04e2863132f6d9222f71f3a76fb9782cbe061"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b26849cffaa7c43355b82e9bef3725e786973a1a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f0c9ea9c3a208e79c812e10e2bcef87b46564f01"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31487.json b/data/2026/CVE-2026-31487.json index 0f4edec636..0da41935a9 100644 --- a/data/2026/CVE-2026-31487.json +++ b/data/2026/CVE-2026-31487.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/spi/spi.c","include/linux/spi/spi.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6e8eb467bed6aa1a563dba8f366c9fd76ba0004e","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"},{"lessThan":"eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"},{"lessThan":"c73a58661a760373d08a6883af4f0bb5cc991a67","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"},{"lessThan":"e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"},{"lessThan":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/spi/spi.c","include/linux/spi/spi.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B3C61F04-9870-47B4-9862-7EFC3B5600C8","versionEndExcluding":"6.12.80","versionStartIncluding":"4.20.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.20:-:*:*:*:*:*:*","matchCriteriaId":"1072305B-94A8-4D68-9419-B786885AA310","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]\n\nAlso note that we do not enable the driver_override feature of struct\nbus_type, as SPI - in contrast to most other buses - passes \"\" to\nsysfs_emit() when the driver_override pointer is NULL. Thus, printing\n\"\\n\" instead of \"(null)\\n\"."}],"id":"CVE-2026-31487","lastModified":"2026-11-05T22:18:34.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31487","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:57.394570Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:46.307","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6e8eb467bed6aa1a563dba8f366c9fd76ba0004e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c73a58661a760373d08a6883af4f0bb5cc991a67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc34d77dd48708d810c12bfd6f5bf03304f6c824"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/spi/spi.c","include/linux/spi/spi.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6e8eb467bed6aa1a563dba8f366c9fd76ba0004e","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"},{"lessThan":"eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"},{"lessThan":"c73a58661a760373d08a6883af4f0bb5cc991a67","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"},{"lessThan":"e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"},{"lessThan":"cc34d77dd48708d810c12bfd6f5bf03304f6c824","status":"affected","version":"5039563e7c25eccd7fec1de6706011009d1c5665","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/spi/spi.c","include/linux/spi/spi.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.20"},{"lessThan":"4.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B3C61F04-9870-47B4-9862-7EFC3B5600C8","versionEndExcluding":"6.12.80","versionStartIncluding":"4.20.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.20:-:*:*:*:*:*:*","matchCriteriaId":"1072305B-94A8-4D68-9419-B786885AA310","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]\n\nAlso note that we do not enable the driver_override feature of struct\nbus_type, as SPI - in contrast to most other buses - passes \"\" to\nsysfs_emit() when the driver_override pointer is NULL. Thus, printing\n\"\\n\" instead of \"(null)\\n\"."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nspi: usar la infraestructura genérica de driver_override\n\nCuando un controlador es sondeado a través de __driver_attach(), la función de devolución de llamada match() del bus es llamada sin el bloqueo del dispositivo activo, accediendo así al campo driver_override sin un bloqueo, lo que puede causar un UAF.\n\nEsto se soluciona usando la infraestructura driver_override del driver-core, gestionando internamente el bloqueo adecuado.\n\nTenga en cuenta que llamar a match() desde __driver_attach() sin el bloqueo del dispositivo activo es intencional. [1]\n\nTambién tenga en cuenta que no habilitamos la característica driver_override de la estructura bus_type, ya que SPI - a diferencia de la mayoría de otros buses - pasa ’’ a sysfs_emit() cuando el puntero driver_override es NULL. Así, imprimiendo ’\\n’ en lugar de ’(null)\\n’."}],"id":"CVE-2026-31487","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31487","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:34:57.394570Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:46.307","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6e8eb467bed6aa1a563dba8f366c9fd76ba0004e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c73a58661a760373d08a6883af4f0bb5cc991a67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc34d77dd48708d810c12bfd6f5bf03304f6c824"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0ae367a2de06c49aa1de6ec9b1ab6860bbb2cf0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eedf220442d13b6d97294e5b0ac8a2c38ee1a1a0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31488.json b/data/2026/CVE-2026-31488.json index 5c982f6c3f..6492ae8e32 100644 --- a/data/2026/CVE-2026-31488.json +++ b/data/2026/CVE-2026-31488.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c","drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h","drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"da1d0ed31e9802fd99384f43cc63678a5a11cb41","status":"affected","version":"17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b","versionType":"git"},{"lessThan":"21159d8b335a6b9f44cbb506733013a902ae2da4","status":"affected","version":"17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b","versionType":"git"},{"lessThan":"10862e344b4d6434642a48c87d765813fc0b0ba7","status":"affected","version":"17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b","versionType":"git"},{"lessThan":"8a5edc97fd9c6415ff2eff872748439a97e3c3d8","status":"affected","version":"17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b","versionType":"git"},{"lessThan":"111208b5b7ebcdadb3f922cc52d8425f0fa91b33","status":"affected","version":"17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b","versionType":"git"},{"lessThan":"aed3d041ab061ec8a64f50a3edda0f4db7280025","status":"affected","version":"17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c","drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h","drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.46.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.98.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.136.1.rt7.477.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.136.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_tus:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.156.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.156.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.19.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.183.1.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.183.1.rt14.468.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-427.139.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.129.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67222101-CC02-4250-A6E8-A98BDD29DB6F","versionEndExcluding":"6.12.80","versionStartIncluding":"5.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:*","matchCriteriaId":"0384FA0A-DE99-48D7-84E3-46ED0C3B5E03","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Do not skip unrelated mode changes in DSC validation\n\nStarting with commit 17ce8a6907f7 (\"drm/amd/display: Add dsc pre-validation in\natomic check\"), amdgpu resets the CRTC state mode_changed flag to false when\nrecomputing the DSC configuration results in no timing change for a particular\nstream.\n\nHowever, this is incorrect in scenarios where a change in MST/DSC configuration\nhappens in the same KMS commit as another (unrelated) mode change. For example,\nthe integrated panel of a laptop may be configured differently (e.g., HDR\nenabled/disabled) depending on whether external screens are attached. In this\ncase, plugging in external DP-MST screens may result in the mode_changed flag\nbeing dropped incorrectly for the integrated panel if its DSC configuration\ndid not change during precomputation in pre_validate_dsc().\n\nAt this point, however, dm_update_crtc_state() has already created new streams\nfor CRTCs with DSC-independent mode changes. In turn,\namdgpu_dm_commit_streams() will never release the old stream, resulting in a\nmemory leak. amdgpu_dm_atomic_commit_tail() will never acquire a reference to\nthe new stream either, which manifests as a use-after-free when the stream gets\ndisabled later on:\n\nBUG: KASAN: use-after-free in dc_stream_release+0x25/0x90 [amdgpu]\nWrite of size 4 at addr ffff88813d836524 by task kworker/9:9/29977\n\nWorkqueue: events drm_mode_rmfb_work_fn\nCall Trace:\n \n dump_stack_lvl+0x6e/0xa0\n print_address_description.constprop.0+0x88/0x320\n ? dc_stream_release+0x25/0x90 [amdgpu]\n print_report+0xfc/0x1ff\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x225/0x4e0\n ? dc_stream_release+0x25/0x90 [amdgpu]\n kasan_report+0xe1/0x180\n ? dc_stream_release+0x25/0x90 [amdgpu]\n kasan_check_range+0x125/0x200\n dc_stream_release+0x25/0x90 [amdgpu]\n dc_state_destruct+0x14d/0x5c0 [amdgpu]\n dc_state_release.part.0+0x4e/0x130 [amdgpu]\n dm_atomic_destroy_state+0x3f/0x70 [amdgpu]\n drm_atomic_state_default_clear+0x8ee/0xf30\n ? drm_mode_object_put.part.0+0xb1/0x130\n __drm_atomic_state_free+0x15c/0x2d0\n atomic_remove_fb+0x67e/0x980\n\nSince there is no reliable way of figuring out whether a CRTC has unrelated\nmode changes pending at the time of DSC validation, remember the value of the\nmode_changed flag from before the point where a CRTC was marked as potentially\naffected by a change in DSC configuration. Reset the mode_changed flag to this\nearlier value instead in pre_validate_dsc().\n\n(cherry picked from commit cc7c7121ae082b7b82891baa7280f1ff2608f22b)"}],"id":"CVE-2026-31488","lastModified":"2026-10-19T19:17:56.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31488","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:11.804167Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:46.453","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10862e344b4d6434642a48c87d765813fc0b0ba7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/111208b5b7ebcdadb3f922cc52d8425f0fa91b33"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/21159d8b335a6b9f44cbb506733013a902ae2da4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a5edc97fd9c6415ff2eff872748439a97e3c3d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aed3d041ab061ec8a64f50a3edda0f4db7280025"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/da1d0ed31e9802fd99384f43cc63678a5a11cb41"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27353"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27354"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:30848"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:43231"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:44385"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:47632"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:47739"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:47869"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:53330"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:55445"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31488"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460619"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31488.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-1288"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c","drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h","drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"da1d0ed31e9802fd99384f43cc63678a5a11cb41","status":"affected","version":"17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b","versionType":"git"},{"lessThan":"21159d8b335a6b9f44cbb506733013a902ae2da4","status":"affected","version":"17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b","versionType":"git"},{"lessThan":"10862e344b4d6434642a48c87d765813fc0b0ba7","status":"affected","version":"17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b","versionType":"git"},{"lessThan":"8a5edc97fd9c6415ff2eff872748439a97e3c3d8","status":"affected","version":"17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b","versionType":"git"},{"lessThan":"111208b5b7ebcdadb3f922cc52d8425f0fa91b33","status":"affected","version":"17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b","versionType":"git"},{"lessThan":"aed3d041ab061ec8a64f50a3edda0f4db7280025","status":"affected","version":"17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c","drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h","drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.46.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.98.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.136.1.rt7.477.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.136.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_tus:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.156.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_e4s:8.8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-477.156.1.el8_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.19.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.183.1.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-284.183.1.rt14.468.el9_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-427.139.1.el9_4","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.129.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67222101-CC02-4250-A6E8-A98BDD29DB6F","versionEndExcluding":"6.12.80","versionStartIncluding":"5.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:*","matchCriteriaId":"0384FA0A-DE99-48D7-84E3-46ED0C3B5E03","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Do not skip unrelated mode changes in DSC validation\n\nStarting with commit 17ce8a6907f7 (\"drm/amd/display: Add dsc pre-validation in\natomic check\"), amdgpu resets the CRTC state mode_changed flag to false when\nrecomputing the DSC configuration results in no timing change for a particular\nstream.\n\nHowever, this is incorrect in scenarios where a change in MST/DSC configuration\nhappens in the same KMS commit as another (unrelated) mode change. For example,\nthe integrated panel of a laptop may be configured differently (e.g., HDR\nenabled/disabled) depending on whether external screens are attached. In this\ncase, plugging in external DP-MST screens may result in the mode_changed flag\nbeing dropped incorrectly for the integrated panel if its DSC configuration\ndid not change during precomputation in pre_validate_dsc().\n\nAt this point, however, dm_update_crtc_state() has already created new streams\nfor CRTCs with DSC-independent mode changes. In turn,\namdgpu_dm_commit_streams() will never release the old stream, resulting in a\nmemory leak. amdgpu_dm_atomic_commit_tail() will never acquire a reference to\nthe new stream either, which manifests as a use-after-free when the stream gets\ndisabled later on:\n\nBUG: KASAN: use-after-free in dc_stream_release+0x25/0x90 [amdgpu]\nWrite of size 4 at addr ffff88813d836524 by task kworker/9:9/29977\n\nWorkqueue: events drm_mode_rmfb_work_fn\nCall Trace:\n \n dump_stack_lvl+0x6e/0xa0\n print_address_description.constprop.0+0x88/0x320\n ? dc_stream_release+0x25/0x90 [amdgpu]\n print_report+0xfc/0x1ff\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x225/0x4e0\n ? dc_stream_release+0x25/0x90 [amdgpu]\n kasan_report+0xe1/0x180\n ? dc_stream_release+0x25/0x90 [amdgpu]\n kasan_check_range+0x125/0x200\n dc_stream_release+0x25/0x90 [amdgpu]\n dc_state_destruct+0x14d/0x5c0 [amdgpu]\n dc_state_release.part.0+0x4e/0x130 [amdgpu]\n dm_atomic_destroy_state+0x3f/0x70 [amdgpu]\n drm_atomic_state_default_clear+0x8ee/0xf30\n ? drm_mode_object_put.part.0+0xb1/0x130\n __drm_atomic_state_free+0x15c/0x2d0\n atomic_remove_fb+0x67e/0x980\n\nSince there is no reliable way of figuring out whether a CRTC has unrelated\nmode changes pending at the time of DSC validation, remember the value of the\nmode_changed flag from before the point where a CRTC was marked as potentially\naffected by a change in DSC configuration. Reset the mode_changed flag to this\nearlier value instead in pre_validate_dsc().\n\n(cherry picked from commit cc7c7121ae082b7b82891baa7280f1ff2608f22b)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amd/display: No omitir cambios de modo no relacionados en la validación de DSC\n\nA partir del commit 17ce8a6907f7 (’drm/amd/display: Añadir pre-validación de dsc en la comprobación atómica’), amdgpu restablece el indicador mode_changed del estado del CRTC a falso cuando la recomputación de la configuración de DSC no resulta en ningún cambio de temporización para un flujo particular.\n\nSin embargo, esto es incorrecto en escenarios donde un cambio en la configuración de MST/DSC ocurre en el mismo commit de KMS que otro cambio de modo (no relacionado). Por ejemplo, el panel integrado de un portátil puede configurarse de manera diferente (por ejemplo, HDR habilitado/deshabilitado) dependiendo de si hay pantallas externas conectadas. En este caso, la conexión de pantallas DP-MST externas puede resultar en que el indicador mode_changed se descarte incorrectamente para el panel integrado si su configuración de DSC no cambió durante la precomputación en pre_validate_dsc().\n\nEn este punto, sin embargo, dm_update_crtc_state() ya ha creado nuevos flujos para CRTCs con cambios de modo independientes de DSC. A su vez, amdgpu_dm_commit_streams() nunca liberará el flujo antiguo, lo que resulta en una fuga de memoria. amdgpu_dm_atomic_commit_tail() tampoco adquirirá una referencia al nuevo flujo, lo que se manifiesta como un uso después de liberación cuando el flujo se deshabilita más tarde:\n\nERROR: KASAN: uso después de liberación en dc_stream_release+0x25/0x90 [amdgpu]\nEscritura de tamaño 4 en la dirección ffff88813d836524 por la tarea kworker/9:9/29977\n\nCola de trabajo: eventos drm_mode_rmfb_work_fn\nTraza de llamada:\n [TAREA]\n dump_stack_lvl+0x6e/0xa0\n print_address_description.constprop.0+0x88/0x320\n ? dc_stream_release+0x25/0x90 [amdgpu]\n print_report+0xfc/0x1ff\n ? srso_alias_return_thunk+0x5/0x fbef5\n ? __virt_addr_valid+0x225/0x4e0\n ? dc_stream_release+0x25/0x90 [amdgpu]\n kasan_report+0xe1/0x180\n ? dc_stream_release+0x25/0x90 [amdgpu]\n kasan_check_range+0x125/0x200\n dc_stream_release+0x25/0x90 [amdgpu]\n dc_state_destruct+0x14d/0x5c0 [amdgpu]\n dc_state_release.part.0+0x4e/0x130 [amdgpu]\n dm_atomic_destroy_state+0x3f/0x70 [amdgpu]\n drm_atomic_state_default_clear+0x8ee/0xf30\n ? drm_mode_object_put.part.0+0xb1/0x130\n __drm_atomic_state_free+0x15c/0x2d0\n atomic_remove_fb+0x67e/0x980\n\nDado que no hay una forma fiable de determinar si un CRTC tiene cambios de modo no relacionados pendientes en el momento de la validación de DSC, recordar el valor del indicador mode_changed desde antes del punto en que un CRTC fue marcado como potencialmente afectado por un cambio en la configuración de DSC. Restablecer el indicador mode_changed a este valor anterior en su lugar en pre_validate_dsc().\n\n(seleccionado de commit cc7c7121ae082b7b82891baa7280f1ff2608f22b)"}],"id":"CVE-2026-31488","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31488","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:11.804167Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:46.453","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10862e344b4d6434642a48c87d765813fc0b0ba7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/111208b5b7ebcdadb3f922cc52d8425f0fa91b33"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/21159d8b335a6b9f44cbb506733013a902ae2da4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a5edc97fd9c6415ff2eff872748439a97e3c3d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aed3d041ab061ec8a64f50a3edda0f4db7280025"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/da1d0ed31e9802fd99384f43cc63678a5a11cb41"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27353"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27354"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:30848"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:43231"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:44385"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:47632"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:47739"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:47869"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:53330"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:55445"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31488"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460619"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31488.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-1288"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31489.json b/data/2026/CVE-2026-31489.json index d0d77df94c..1e7aa94405 100644 --- a/data/2026/CVE-2026-31489.json +++ b/data/2026/CVE-2026-31489.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/spi/spi-meson-spicc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"01f5f7976c24d6e9beef6b5a410af3b9b1d4d476","status":"affected","version":"05565b469358a9a03034f7f712d83590a9f125a4","versionType":"git"},{"lessThan":"d61bcec3aec6f0244a9b963e0c76c00f771d49b6","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"lessThan":"7434c64ddae88a02e7fb478bc256cc100d48d3e3","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"lessThan":"0d645c6d13fa0597935d3d16b09a7ba5d24ed284","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"lessThan":"40ad0334c17b23d8b66b1082ad1478a6202e90e2","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"lessThan":"da06a104f0486355073ff0d1bcb1fcbebb7080d6","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"lessThan":"9b812ceb75a6260c17c91db4b9e74ead8cfa06f5","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"lessThan":"63542bb402b7013171c9f621c28b609eda4dbf1f","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"status":"affected","version":"ff056817560d72363b463ddac27822dc8c121280","versionType":"git"},{"status":"affected","version":"683b47d0ebb10ba0d272604b09686e023d10d40c","versionType":"git"},{"status":"affected","version":"a5bf7ef13ebf6adf62a69ab3542d4fc0564c082e","versionType":"git"},{"status":"affected","version":"f2ca988aba4eaad1319e80eb1316a4ba5dbd6897","versionType":"git"},{"lessThan":"5.10.259","status":"affected","version":"5.10.58","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.244","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.203","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.140","versionType":"semver"},{"lessThan":"5.14","status":"affected","version":"5.13.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/spi/spi-meson-spicc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0BB634A6-F36F-476C-94DA-84A3ABF7A170","versionEndExcluding":"4.15","versionStartIncluding":"4.14.244","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"701FECB5-CEA6-4D3E-868E-F70A777945E0","versionEndExcluding":"4.20","versionStartIncluding":"4.19.203","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"75CD851C-0372-41B3-9A47-AC6DD48C6AB3","versionEndExcluding":"5.5","versionStartIncluding":"5.4.140","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A4D3DC93-FB8F-4C90-807D-BD2092747B75","versionEndExcluding":"5.11","versionStartIncluding":"5.10.58","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C09DC193-F9A8-4983-B677-7CE60D711D40","versionEndExcluding":"5.14","versionStartIncluding":"5.13.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1077EA71-D36D-44EB-AEF6-7978036231E8","versionEndExcluding":"6.12.80","versionStartIncluding":"5.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:*","matchCriteriaId":"6A05198E-F8FA-4517-8D0E-8C95066AED38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: meson-spicc: Fix double-put in remove path\n\nmeson_spicc_probe() registers the controller with\ndevm_spi_register_controller(), so teardown already drops the\ncontroller reference via devm cleanup.\n\nCalling spi_controller_put() again in meson_spicc_remove()\ncauses a double-put."}],"id":"CVE-2026-31489","lastModified":"2026-06-19T13:16:26.467","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:46.603","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/01f5f7976c24d6e9beef6b5a410af3b9b1d4d476"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0d645c6d13fa0597935d3d16b09a7ba5d24ed284"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40ad0334c17b23d8b66b1082ad1478a6202e90e2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63542bb402b7013171c9f621c28b609eda4dbf1f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7434c64ddae88a02e7fb478bc256cc100d48d3e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b812ceb75a6260c17c91db4b9e74ead8cfa06f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d61bcec3aec6f0244a9b963e0c76c00f771d49b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/da06a104f0486355073ff0d1bcb1fcbebb7080d6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/spi/spi-meson-spicc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"01f5f7976c24d6e9beef6b5a410af3b9b1d4d476","status":"affected","version":"05565b469358a9a03034f7f712d83590a9f125a4","versionType":"git"},{"lessThan":"d61bcec3aec6f0244a9b963e0c76c00f771d49b6","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"lessThan":"7434c64ddae88a02e7fb478bc256cc100d48d3e3","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"lessThan":"0d645c6d13fa0597935d3d16b09a7ba5d24ed284","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"lessThan":"40ad0334c17b23d8b66b1082ad1478a6202e90e2","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"lessThan":"da06a104f0486355073ff0d1bcb1fcbebb7080d6","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"lessThan":"9b812ceb75a6260c17c91db4b9e74ead8cfa06f5","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"lessThan":"63542bb402b7013171c9f621c28b609eda4dbf1f","status":"affected","version":"8311ee2164c5cd1b63a601ea366f540eae89f10e","versionType":"git"},{"status":"affected","version":"ff056817560d72363b463ddac27822dc8c121280","versionType":"git"},{"status":"affected","version":"683b47d0ebb10ba0d272604b09686e023d10d40c","versionType":"git"},{"status":"affected","version":"a5bf7ef13ebf6adf62a69ab3542d4fc0564c082e","versionType":"git"},{"status":"affected","version":"f2ca988aba4eaad1319e80eb1316a4ba5dbd6897","versionType":"git"},{"lessThan":"5.10.259","status":"affected","version":"5.10.58","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.244","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.203","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.140","versionType":"semver"},{"lessThan":"5.14","status":"affected","version":"5.13.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/spi/spi-meson-spicc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.140","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0BB634A6-F36F-476C-94DA-84A3ABF7A170","versionEndExcluding":"4.15","versionStartIncluding":"4.14.244","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"701FECB5-CEA6-4D3E-868E-F70A777945E0","versionEndExcluding":"4.20","versionStartIncluding":"4.19.203","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"75CD851C-0372-41B3-9A47-AC6DD48C6AB3","versionEndExcluding":"5.5","versionStartIncluding":"5.4.140","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A4D3DC93-FB8F-4C90-807D-BD2092747B75","versionEndExcluding":"5.11","versionStartIncluding":"5.10.58","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C09DC193-F9A8-4983-B677-7CE60D711D40","versionEndExcluding":"5.14","versionStartIncluding":"5.13.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1077EA71-D36D-44EB-AEF6-7978036231E8","versionEndExcluding":"6.12.80","versionStartIncluding":"5.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:*","matchCriteriaId":"6A05198E-F8FA-4517-8D0E-8C95066AED38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: meson-spicc: Fix double-put in remove path\n\nmeson_spicc_probe() registers the controller with\ndevm_spi_register_controller(), so teardown already drops the\ncontroller reference via devm cleanup.\n\nCalling spi_controller_put() again in meson_spicc_remove()\ncauses a double-put."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nspi: meson-spicc: Corrección de double-put en la ruta de eliminación\n\nmeson_spicc_probe() registra el controlador con devm_spi_register_controller(), por lo que el desmontaje ya libera la referencia del controlador a través de la limpieza de devm.\n\nLlamar a spi_controller_put() de nuevo en meson_spicc_remove() causa un double-put."}],"id":"CVE-2026-31489","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:46.603","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/01f5f7976c24d6e9beef6b5a410af3b9b1d4d476"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0d645c6d13fa0597935d3d16b09a7ba5d24ed284"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40ad0334c17b23d8b66b1082ad1478a6202e90e2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63542bb402b7013171c9f621c28b609eda4dbf1f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7434c64ddae88a02e7fb478bc256cc100d48d3e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b812ceb75a6260c17c91db4b9e74ead8cfa06f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d61bcec3aec6f0244a9b963e0c76c00f771d49b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/da06a104f0486355073ff0d1bcb1fcbebb7080d6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31490.json b/data/2026/CVE-2026-31490.json index 5950bc5fd1..c4019757ba 100644 --- a/data/2026/CVE-2026-31490.json +++ b/data/2026/CVE-2026-31490.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_sriov_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e28552b4ddea5cb4725380dd08237831af835124","status":"affected","version":"1ed30397c0b92b97381dbd11362fdbbf93e046d2","versionType":"git"},{"lessThan":"87997b6c6516e049cbaf2fc6810b213d587a06b1","status":"affected","version":"1ed30397c0b92b97381dbd11362fdbbf93e046d2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_sriov_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5054C854-C253-4020-BD2E-2BDA121E424C","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Fix use-after-free in migration restore\n\nWhen an error is returned from xe_sriov_pf_migration_restore_produce(),\nthe data pointer is not set to NULL, which can trigger use-after-free\nin subsequent .write() calls.\nSet the pointer to NULL upon error to fix the problem.\n\n(cherry picked from commit 4f53d8c6d23527d734fe3531d08e15cb170a0819)"}],"id":"CVE-2026-31490","lastModified":"2026-06-17T10:33:50.543","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:46.763","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/87997b6c6516e049cbaf2fc6810b213d587a06b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e28552b4ddea5cb4725380dd08237831af835124"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_sriov_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e28552b4ddea5cb4725380dd08237831af835124","status":"affected","version":"1ed30397c0b92b97381dbd11362fdbbf93e046d2","versionType":"git"},{"lessThan":"87997b6c6516e049cbaf2fc6810b213d587a06b1","status":"affected","version":"1ed30397c0b92b97381dbd11362fdbbf93e046d2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_sriov_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5054C854-C253-4020-BD2E-2BDA121E424C","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pf: Fix use-after-free in migration restore\n\nWhen an error is returned from xe_sriov_pf_migration_restore_produce(),\nthe data pointer is not set to NULL, which can trigger use-after-free\nin subsequent .write() calls.\nSet the pointer to NULL upon error to fix the problem.\n\n(cherry picked from commit 4f53d8c6d23527d734fe3531d08e15cb170a0819)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe/pf: Corrección de uso después de liberación en la restauración de migración\n\nCuando se devuelve un error desde xe_sriov_pf_migration_restore_produce(), el puntero de datos no se establece en NULL, lo que puede desencadenar un uso después de liberación en llamadas .write() posteriores.\nEstablecer el puntero en NULL ante un error para solucionar el problema.\n\n(cherry picked from commit 4f53d8c6d23527d734fe3531d08e15cb170a0819)"}],"id":"CVE-2026-31490","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:46.763","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/87997b6c6516e049cbaf2fc6810b213d587a06b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e28552b4ddea5cb4725380dd08237831af835124"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31491.json b/data/2026/CVE-2026-31491.json index 014a3b479b..e2af8e7cc2 100644 --- a/data/2026/CVE-2026-31491.json +++ b/data/2026/CVE-2026-31491.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/uk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3f08351de5ca4f2f724b86ad252fbc21289467e1","status":"affected","version":"563e1feb5f6ed579acb55850f1bbb831aecf645a","versionType":"git"},{"lessThan":"cbd852f5700eb3f64392452faf693ac45cae8281","status":"affected","version":"563e1feb5f6ed579acb55850f1bbb831aecf645a","versionType":"git"},{"lessThan":"e37afcb56ae070477741fe2d6e61fc0c542cce2d","status":"affected","version":"563e1feb5f6ed579acb55850f1bbb831aecf645a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/uk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2E98868-4027-46EE-AD08-92C9D7283181","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*","matchCriteriaId":"DCE57113-2223-4308-A0F2-5E6ECFBB3C23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Harden depth calculation functions\n\nAn issue was exposed where OS can pass in U32_MAX for SQ/RQ/SRQ size.\nThis can cause integer overflow and truncation of SQ/RQ/SRQ depth\nreturning a success when it should have failed.\n\nHarden the functions to do all depth calculations and boundary\nchecking in u64 sizes."}],"id":"CVE-2026-31491","lastModified":"2026-11-05T22:18:34.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31491","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:07.008894Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:46.880","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3f08351de5ca4f2f724b86ad252fbc21289467e1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cbd852f5700eb3f64392452faf693ac45cae8281"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e37afcb56ae070477741fe2d6e61fc0c542cce2d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/uk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3f08351de5ca4f2f724b86ad252fbc21289467e1","status":"affected","version":"563e1feb5f6ed579acb55850f1bbb831aecf645a","versionType":"git"},{"lessThan":"cbd852f5700eb3f64392452faf693ac45cae8281","status":"affected","version":"563e1feb5f6ed579acb55850f1bbb831aecf645a","versionType":"git"},{"lessThan":"e37afcb56ae070477741fe2d6e61fc0c542cce2d","status":"affected","version":"563e1feb5f6ed579acb55850f1bbb831aecf645a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/uk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2E98868-4027-46EE-AD08-92C9D7283181","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*","matchCriteriaId":"DCE57113-2223-4308-A0F2-5E6ECFBB3C23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Harden depth calculation functions\n\nAn issue was exposed where OS can pass in U32_MAX for SQ/RQ/SRQ size.\nThis can cause integer overflow and truncation of SQ/RQ/SRQ depth\nreturning a success when it should have failed.\n\nHarden the functions to do all depth calculations and boundary\nchecking in u64 sizes."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRDMA/irdma: Reforzar las funciones de cálculo de profundidad\n\nSe expuso un problema donde el SO puede pasar U32_MAX para el tamaño de SQ/RQ/SRQ. Esto puede causar un desbordamiento de entero y truncamiento de la profundidad de SQ/RQ/SRQ, devolviendo un éxito cuando debería haber fallado.\n\nReforzar las funciones para realizar todos los cálculos de profundidad y la comprobación de límites en tamaños u64."}],"id":"CVE-2026-31491","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31491","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:07.008894Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:46.880","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3f08351de5ca4f2f724b86ad252fbc21289467e1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cbd852f5700eb3f64392452faf693ac45cae8281"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e37afcb56ae070477741fe2d6e61fc0c542cce2d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31492.json b/data/2026/CVE-2026-31492.json index 01372a4143..9a1bbb0d16 100644 --- a/data/2026/CVE-2026-31492.json +++ b/data/2026/CVE-2026-31492.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ac1da7bd224d406b6f1b84414f0f652ab43b6bd8","status":"affected","version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","versionType":"git"},{"lessThan":"af310407f79d5816fc0ab3638e1588b6193316dd","status":"affected","version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","versionType":"git"},{"lessThan":"cd1534c8f4984432382c240f6784408497f5bb0a","status":"affected","version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","versionType":"git"},{"lessThan":"3cb88c12461b71c7d9c604aa2e6a9a477ecfa147","status":"affected","version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","versionType":"git"},{"lessThan":"f72996834f7bdefc2b95e3eec30447ee195df44e","status":"affected","version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","versionType":"git"},{"lessThan":"11a95521fb93c91e2d4ef9d53dc80ef0a755549b","status":"affected","version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"70E8C815-4965-47D0-8917-D4B88DB19CAA","versionEndExcluding":"6.1.168","versionStartIncluding":"5.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:*","matchCriteriaId":"6A05198E-F8FA-4517-8D0E-8C95066AED38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Initialize free_qp completion before using it\n\nIn irdma_create_qp, if ib_copy_to_udata fails, it will call\nirdma_destroy_qp to clean up which will attempt to wait on\nthe free_qp completion, which is not initialized yet. Fix this\nby initializing the completion before the ib_copy_to_udata call."}],"id":"CVE-2026-31492","lastModified":"2026-11-05T22:18:34.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31492","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:11.846841Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:47.010","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/11a95521fb93c91e2d4ef9d53dc80ef0a755549b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3cb88c12461b71c7d9c604aa2e6a9a477ecfa147"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac1da7bd224d406b6f1b84414f0f652ab43b6bd8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/af310407f79d5816fc0ab3638e1588b6193316dd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cd1534c8f4984432382c240f6784408497f5bb0a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f72996834f7bdefc2b95e3eec30447ee195df44e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ac1da7bd224d406b6f1b84414f0f652ab43b6bd8","status":"affected","version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","versionType":"git"},{"lessThan":"af310407f79d5816fc0ab3638e1588b6193316dd","status":"affected","version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","versionType":"git"},{"lessThan":"cd1534c8f4984432382c240f6784408497f5bb0a","status":"affected","version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","versionType":"git"},{"lessThan":"3cb88c12461b71c7d9c604aa2e6a9a477ecfa147","status":"affected","version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","versionType":"git"},{"lessThan":"f72996834f7bdefc2b95e3eec30447ee195df44e","status":"affected","version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","versionType":"git"},{"lessThan":"11a95521fb93c91e2d4ef9d53dc80ef0a755549b","status":"affected","version":"b48c24c2d710cf34810c555dcef883a3d35a9c08","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"70E8C815-4965-47D0-8917-D4B88DB19CAA","versionEndExcluding":"6.1.168","versionStartIncluding":"5.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:*","matchCriteriaId":"6A05198E-F8FA-4517-8D0E-8C95066AED38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Initialize free_qp completion before using it\n\nIn irdma_create_qp, if ib_copy_to_udata fails, it will call\nirdma_destroy_qp to clean up which will attempt to wait on\nthe free_qp completion, which is not initialized yet. Fix this\nby initializing the completion before the ib_copy_to_udata call."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRDMA/irdma: Inicializar la finalización de free_qp antes de usarla\n\nEn irdma_create_qp, si ib_copy_to_udata falla, llamará a irdma_destroy_qp para limpiar, lo que intentará esperar la finalización de free_qp, la cual aún no está inicializada. Solucione esto inicializando la finalización antes de la llamada a ib_copy_to_udata."}],"id":"CVE-2026-31492","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31492","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:11.846841Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:47.010","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/11a95521fb93c91e2d4ef9d53dc80ef0a755549b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3cb88c12461b71c7d9c604aa2e6a9a477ecfa147"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac1da7bd224d406b6f1b84414f0f652ab43b6bd8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/af310407f79d5816fc0ab3638e1588b6193316dd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cd1534c8f4984432382c240f6784408497f5bb0a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f72996834f7bdefc2b95e3eec30447ee195df44e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31493.json b/data/2026/CVE-2026-31493.json index fccac1d476..44581e4e79 100644 --- a/data/2026/CVE-2026-31493.json +++ b/data/2026/CVE-2026-31493.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/hw/efa/efa_com.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8c24b5179af260a5f36571c992d29aab1f448544","status":"affected","version":"68fb9f3e312a36e49fd05ec2d6b668daf2c4931a","versionType":"git"},{"lessThan":"7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5","status":"affected","version":"68fb9f3e312a36e49fd05ec2d6b668daf2c4931a","versionType":"git"},{"lessThan":"0dd98aea1c0c45987fa2dd92f988b0eb1a72c125","status":"affected","version":"68fb9f3e312a36e49fd05ec2d6b668daf2c4931a","versionType":"git"},{"lessThan":"1cf95fe5dc5471efea947b4c6f8913da6bc7976e","status":"affected","version":"68fb9f3e312a36e49fd05ec2d6b668daf2c4931a","versionType":"git"},{"lessThan":"ef3b06742c8a201d0e83edc9a33a89a4fe3009f8","status":"affected","version":"68fb9f3e312a36e49fd05ec2d6b668daf2c4931a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/hw/efa/efa_com.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"00EAFFC2-EF24-43DB-A137-7A3557D33C50","versionEndExcluding":"6.18.21","versionStartIncluding":"5.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:*","matchCriteriaId":"75EB504D-4A83-4C67-9C8D-FD9C6C8EB4CD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix use of completion ctx after free\n\nOn admin queue completion handling, if the admin command completed with\nerror we print data from the completion context. The issue is that we\nalready freed the completion context in polling/interrupts handler which\nmeans we print data from context in an unknown state (it might be\nalready used again).\nChange the admin submission flow so alloc/dealloc of the context will be\nsymmetric and dealloc will be called after any potential use of the\ncontext."}],"id":"CVE-2026-31493","lastModified":"2026-11-05T22:18:34.817","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31493","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:16.910245Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:47.170","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0dd98aea1c0c45987fa2dd92f988b0eb1a72c125"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1cf95fe5dc5471efea947b4c6f8913da6bc7976e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8c24b5179af260a5f36571c992d29aab1f448544"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/hw/efa/efa_com.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8c24b5179af260a5f36571c992d29aab1f448544","status":"affected","version":"68fb9f3e312a36e49fd05ec2d6b668daf2c4931a","versionType":"git"},{"lessThan":"7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5","status":"affected","version":"68fb9f3e312a36e49fd05ec2d6b668daf2c4931a","versionType":"git"},{"lessThan":"0dd98aea1c0c45987fa2dd92f988b0eb1a72c125","status":"affected","version":"68fb9f3e312a36e49fd05ec2d6b668daf2c4931a","versionType":"git"},{"lessThan":"1cf95fe5dc5471efea947b4c6f8913da6bc7976e","status":"affected","version":"68fb9f3e312a36e49fd05ec2d6b668daf2c4931a","versionType":"git"},{"lessThan":"ef3b06742c8a201d0e83edc9a33a89a4fe3009f8","status":"affected","version":"68fb9f3e312a36e49fd05ec2d6b668daf2c4931a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/hw/efa/efa_com.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"00EAFFC2-EF24-43DB-A137-7A3557D33C50","versionEndExcluding":"6.18.21","versionStartIncluding":"5.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:*","matchCriteriaId":"75EB504D-4A83-4C67-9C8D-FD9C6C8EB4CD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix use of completion ctx after free\n\nOn admin queue completion handling, if the admin command completed with\nerror we print data from the completion context. The issue is that we\nalready freed the completion context in polling/interrupts handler which\nmeans we print data from context in an unknown state (it might be\nalready used again).\nChange the admin submission flow so alloc/dealloc of the context will be\nsymmetric and dealloc will be called after any potential use of the\ncontext."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRDMA/efa: Corregir el uso del contexto de finalización después de la liberación\n\nEn el manejo de la finalización de la cola de administración, si el comando de administración finalizó con error, imprimimos datos del contexto de finalización. El problema es que ya liberamos el contexto de finalización en el gestor de sondeo/interrupciones, lo que significa que imprimimos datos del contexto en un estado desconocido (podría estar ya siendo usado de nuevo).\nCambiar el flujo de envío de administración para que la asignación/desasignación del contexto sea simétrica y la desasignación se llame después de cualquier uso potencial del contexto."}],"id":"CVE-2026-31493","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31493","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:16.910245Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:47.170","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0dd98aea1c0c45987fa2dd92f988b0eb1a72c125"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1cf95fe5dc5471efea947b4c6f8913da6bc7976e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7ba09d85f177e9f5f64b881f33dbcb57b2cf23d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8c24b5179af260a5f36571c992d29aab1f448544"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef3b06742c8a201d0e83edc9a33a89a4fe3009f8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31494.json b/data/2026/CVE-2026-31494.json index f33248e617..27bbcc6ba6 100644 --- a/data/2026/CVE-2026-31494.json +++ b/data/2026/CVE-2026-31494.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9738be665544281aa624842812c2fbfed6f88226","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"240c5302eed83e34e98db18f6795ee5f40814024","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"9596759a84e1dbf2670518d85e969208960041f9","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"95246341945163ad9a250a87ca5bd1c1252777ae","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"9d74d10e4e26672e139a8bcf8bf95957bf2d160f","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"7ff87da099210856cbfe2f2f7f52ddfa57af4f0c","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"e182fe273cdf5a8931592228196ef514ffac392b","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96C0EA12-83B8-4804-94AB-EF34257BCBDF","versionEndExcluding":"5.10.253","versionStartIncluding":"4.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.16:-:*:*:*:*:*:*","matchCriteriaId":"F60469AF-0A23-41D3-BC6A-C0D9A45A2CBC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: use the current queue number for stats\n\nThere's a potential mismatch between the memory reserved for statistics\nand the amount of memory written.\n\ngem_get_sset_count() correctly computes the number of stats based on the\nactive queues, whereas gem_get_ethtool_stats() indiscriminately copies\ndata using the maximum number of queues, and in the case the number of\nactive queues is less than MACB_MAX_QUEUES, this results in a OOB write\nas observed in the KASAN splat.\n\n==================================================================\nBUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78\n [macb]\nWrite of size 760 at addr ffff80008080b000 by task ethtool/1027\n\nCPU: [...]\nTainted: [E]=UNSIGNED_MODULE\nHardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025\nCall trace:\n show_stack+0x20/0x38 (C)\n dump_stack_lvl+0x80/0xf8\n print_report+0x384/0x5e0\n kasan_report+0xa0/0xf0\n kasan_check_range+0xe8/0x190\n __asan_memcpy+0x54/0x98\n gem_get_ethtool_stats+0x54/0x78 [macb\n 926c13f3af83b0c6fe64badb21ec87d5e93fcf65]\n dev_ethtool+0x1220/0x38c0\n dev_ioctl+0x4ac/0xca8\n sock_do_ioctl+0x170/0x1d8\n sock_ioctl+0x484/0x5d8\n __arm64_sys_ioctl+0x12c/0x1b8\n invoke_syscall+0xd4/0x258\n el0_svc_common.constprop.0+0xb4/0x240\n do_el0_svc+0x48/0x68\n el0_svc+0x40/0xf8\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1b0/0x1b8\n\nThe buggy address belongs to a 1-page vmalloc region starting at\n 0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff00000a333000 pfn:0xa333\nflags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff)\nraw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000\nraw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n>ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n==================================================================\n\nFix it by making sure the copied size only considers the active number of\nqueues."}],"id":"CVE-2026-31494","lastModified":"2026-11-10T13:18:56.490","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:47.293","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/240c5302eed83e34e98db18f6795ee5f40814024"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ff87da099210856cbfe2f2f7f52ddfa57af4f0c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95246341945163ad9a250a87ca5bd1c1252777ae"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9596759a84e1dbf2670518d85e969208960041f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9738be665544281aa624842812c2fbfed6f88226"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d74d10e4e26672e139a8bcf8bf95957bf2d160f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e182fe273cdf5a8931592228196ef514ffac392b"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9738be665544281aa624842812c2fbfed6f88226","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"240c5302eed83e34e98db18f6795ee5f40814024","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"9596759a84e1dbf2670518d85e969208960041f9","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"95246341945163ad9a250a87ca5bd1c1252777ae","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"9d74d10e4e26672e139a8bcf8bf95957bf2d160f","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"7ff87da099210856cbfe2f2f7f52ddfa57af4f0c","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"e182fe273cdf5a8931592228196ef514ffac392b","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"},{"lessThan":"72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5","status":"affected","version":"512286bbd4b7d5b15d26ba8078c8bfd1fc1129bd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96C0EA12-83B8-4804-94AB-EF34257BCBDF","versionEndExcluding":"5.10.253","versionStartIncluding":"4.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.16:-:*:*:*:*:*:*","matchCriteriaId":"F60469AF-0A23-41D3-BC6A-C0D9A45A2CBC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: use the current queue number for stats\n\nThere's a potential mismatch between the memory reserved for statistics\nand the amount of memory written.\n\ngem_get_sset_count() correctly computes the number of stats based on the\nactive queues, whereas gem_get_ethtool_stats() indiscriminately copies\ndata using the maximum number of queues, and in the case the number of\nactive queues is less than MACB_MAX_QUEUES, this results in a OOB write\nas observed in the KASAN splat.\n\n==================================================================\nBUG: KASAN: vmalloc-out-of-bounds in gem_get_ethtool_stats+0x54/0x78\n [macb]\nWrite of size 760 at addr ffff80008080b000 by task ethtool/1027\n\nCPU: [...]\nTainted: [E]=UNSIGNED_MODULE\nHardware name: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025\nCall trace:\n show_stack+0x20/0x38 (C)\n dump_stack_lvl+0x80/0xf8\n print_report+0x384/0x5e0\n kasan_report+0xa0/0xf0\n kasan_check_range+0xe8/0x190\n __asan_memcpy+0x54/0x98\n gem_get_ethtool_stats+0x54/0x78 [macb\n 926c13f3af83b0c6fe64badb21ec87d5e93fcf65]\n dev_ethtool+0x1220/0x38c0\n dev_ioctl+0x4ac/0xca8\n sock_do_ioctl+0x170/0x1d8\n sock_ioctl+0x484/0x5d8\n __arm64_sys_ioctl+0x12c/0x1b8\n invoke_syscall+0xd4/0x258\n el0_svc_common.constprop.0+0xb4/0x240\n do_el0_svc+0x48/0x68\n el0_svc+0x40/0xf8\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1b0/0x1b8\n\nThe buggy address belongs to a 1-page vmalloc region starting at\n 0xffff80008080b000 allocated at dev_ethtool+0x11f0/0x38c0\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff00000a333000 pfn:0xa333\nflags: 0x7fffc000000000(node=0|zone=0|lastcpupid=0x1ffff)\nraw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000\nraw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n>ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n==================================================================\n\nFix it by making sure the copied size only considers the active number of\nqueues."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: macb: usar el número de cola actual para las estadísticas\n\nExiste un desajuste potencial entre la memoria reservada para estadísticas y la cantidad de memoria escrita.\n\ngem_get_sset_count() calcula correctamente el número de estadísticas basándose en las colas activas, mientras que gem_get_ethtool_stats() copia datos indiscriminadamente usando el número máximo de colas, y en el caso de que el número de colas activas sea menor que MACB_MAX_QUEUES, esto resulta en una escritura OOB como se observó en el splat de KASAN.\n\n==================================================================\nERROR: KASAN: vmalloc-fuera-de-límites en gem_get_ethtool_stats+0x54/0x78 [macb]\nEscritura de tamaño 760 en la dirección ffff80008080b000 por la tarea ethtool/1027\n\nCPU: [...]\nTainted: [E]=UNSIGNED_MODULE\nNombre del hardware: raspberrypi rpi/rpi, BIOS 2025.10 10/01/2025\nRastro de llamada:\n show_stack+0x20/0x38 (C)\n dump_stack_lvl+0x80/0xf8\n print_report+0x384/0x5e0\n kasan_report+0xa0/0xf0\n kasan_check_range+0xe8/0x190\n __asan_memcpy+0x54/0x98\n gem_get_ethtool_stats+0x54/0x78 [macb\n 926c13f3af83b0c6fe64badb21ec87d5e93fcf65]\n dev_ethtool+0x 1220/0x 38c0\n dev_ioctl+0x4ac/0xca8\n sock_do_ioctl+0x170/0x1d8\n sock_ioctl+0x484/0x5d8\n __arm64_sys_ioctl+0x12c/0x1b8\n invoke_syscall+0xd4/0x258\n el0_svc_common.constprop.0+0xb4/0x240\n do_el0_svc+0x48/0x68\n el0_svc+0x40/0xf8\n el0t_64_sync_handler+0xa0/0xe8\n el0t_64_sync+0x1b0/0x1b8\n\nLa dirección errónea pertenece a una región vmalloc de 1 página que comienza en\n 0x ffff80008080b000 asignada en dev_ethtool+0x 11f0/0x 38c0\nLa dirección errónea pertenece a la página física:\npage: refcount:1 mapcount:0 mapping:0000000000000000\n index:0x ffff00000a333000 pfn:0x a333\nflags: 0x 7fffc000000000(node=0|zone=0|lastcpupid=0x 1ffff)\nraw: 007fffc000000000 0000000000000000 dead000000000122 0000000000000000\nraw: ffff00000a333000 0000000000000000 00000001ffffffff 0000000000000000\npágina volcada porque: kasan: acceso incorrecto detectado\n\nEstado de la memoria alrededor de la dirección errónea:\n ffff80008080b080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff80008080b100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n>ffff80008080b180: 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffff80008080b200: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffff80008080b280: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n==================================================================\n\nSolucionarlo asegurándose de que el tamaño copiado solo considere el número activo de colas."}],"id":"CVE-2026-31494","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:47.293","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/240c5302eed83e34e98db18f6795ee5f40814024"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/72d96e4e24bbefdcfbc68bdb9341a05d8f5cb6e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ff87da099210856cbfe2f2f7f52ddfa57af4f0c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95246341945163ad9a250a87ca5bd1c1252777ae"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9596759a84e1dbf2670518d85e969208960041f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9738be665544281aa624842812c2fbfed6f88226"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d74d10e4e26672e139a8bcf8bf95957bf2d160f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e182fe273cdf5a8931592228196ef514ffac392b"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31495.json b/data/2026/CVE-2026-31495.json index fe2a9720de..ffb5da5268 100644 --- a/data/2026/CVE-2026-31495.json +++ b/data/2026/CVE-2026-31495.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/uapi/linux/netfilter/nf_conntrack_common.h","net/netfilter/nf_conntrack_netlink.c","net/netfilter/nf_conntrack_proto_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"435b576cd2faa75154777868f8cbb73bf71644d3","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"2ef71307c86a9f866d6e28f1a0c06e2e9d794474","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"4f7d25f3f0786402ba48ff7d13b6241d77d975f5","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"fcec5ce2d73a41668b24e3f18c803541602a59f6","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"675c913b940488a84effdeeac5a1cfb657b59804","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"c6cb41eaae875501eaaa487b8db6539feb092292","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"45c33e79ae705b7af97e3117672b6cd258dd0b1b","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"8f15b5071b4548b0aafc03b366eb45c9c6566704","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/uapi/linux/netfilter/nf_conntrack_common.h","net/netfilter/nf_conntrack_netlink.c","net/netfilter/nf_conntrack_proto_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E7333FD1-B48C-4F9D-BF44-8273A10F72A2","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.22.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:-:*:*:*:*:*:*","matchCriteriaId":"7F7D6C66-3384-4ACC-9D08-C5A26B4FD004","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: use netlink policy range checks\n\nReplace manual range and mask validations with netlink policy\nannotations in ctnetlink code paths, so that the netlink core rejects\ninvalid values early and can generate extack errors.\n\n- CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at\n policy level, removing the manual >= TCP_CONNTRACK_MAX check.\n- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE\n (14). The normal TCP option parsing path already clamps to this value,\n but the ctnetlink path accepted 0-255, causing undefined behavior when\n used as a u32 shift count.\n- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with\n CTA_FILTER_F_ALL, removing the manual mask checks.\n- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding\n a new mask define grouping all valid expect flags.\n\nExtracted from a broader nf-next patch by Florian Westphal, scoped to\nctnetlink for the fixes tree."}],"id":"CVE-2026-31495","lastModified":"2026-11-10T13:18:56.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31495","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:22.554497Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:47.500","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ef71307c86a9f866d6e28f1a0c06e2e9d794474"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/435b576cd2faa75154777868f8cbb73bf71644d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45c33e79ae705b7af97e3117672b6cd258dd0b1b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f7d25f3f0786402ba48ff7d13b6241d77d975f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/675c913b940488a84effdeeac5a1cfb657b59804"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f15b5071b4548b0aafc03b366eb45c9c6566704"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c6cb41eaae875501eaaa487b8db6539feb092292"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fcec5ce2d73a41668b24e3f18c803541602a59f6"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/uapi/linux/netfilter/nf_conntrack_common.h","net/netfilter/nf_conntrack_netlink.c","net/netfilter/nf_conntrack_proto_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"435b576cd2faa75154777868f8cbb73bf71644d3","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"2ef71307c86a9f866d6e28f1a0c06e2e9d794474","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"4f7d25f3f0786402ba48ff7d13b6241d77d975f5","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"fcec5ce2d73a41668b24e3f18c803541602a59f6","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"675c913b940488a84effdeeac5a1cfb657b59804","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"c6cb41eaae875501eaaa487b8db6539feb092292","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"45c33e79ae705b7af97e3117672b6cd258dd0b1b","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"},{"lessThan":"8f15b5071b4548b0aafc03b366eb45c9c6566704","status":"affected","version":"c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/uapi/linux/netfilter/nf_conntrack_common.h","net/netfilter/nf_conntrack_netlink.c","net/netfilter/nf_conntrack_proto_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E7333FD1-B48C-4F9D-BF44-8273A10F72A2","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.22.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:-:*:*:*:*:*:*","matchCriteriaId":"7F7D6C66-3384-4ACC-9D08-C5A26B4FD004","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: use netlink policy range checks\n\nReplace manual range and mask validations with netlink policy\nannotations in ctnetlink code paths, so that the netlink core rejects\ninvalid values early and can generate extack errors.\n\n- CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at\n policy level, removing the manual >= TCP_CONNTRACK_MAX check.\n- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE\n (14). The normal TCP option parsing path already clamps to this value,\n but the ctnetlink path accepted 0-255, causing undefined behavior when\n used as a u32 shift count.\n- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with\n CTA_FILTER_F_ALL, removing the manual mask checks.\n- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding\n a new mask define grouping all valid expect flags.\n\nExtracted from a broader nf-next patch by Florian Westphal, scoped to\nctnetlink for the fixes tree."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: ctnetlink: utilizar comprobaciones de rango de política de netlink\n\nReemplazar las validaciones manuales de rango y máscara con anotaciones de política de netlink en las rutas de código de ctnetlink, para que el núcleo de netlink rechace los valores no válidos tempranamente y pueda generar errores extack.\n\n- CTA_PROTOINFO_TCP_STATE: rechazar valores > TCP_CONNTRACK_SYN_SENT2 a nivel de política, eliminando la comprobación manual >= TCP_CONNTRACK_MAX.\n- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: rechazar valores > TCP_MAX_WSCALE (14). La ruta normal de análisis de opciones TCP ya se ajusta a este valor, pero la ruta de ctnetlink aceptaba 0-255, causando un comportamiento indefinido cuando se usaba como un contador de desplazamiento u32.\n- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: usar NLA_POLICY_MASK con CTA_FILTER_F_ALL, eliminando las comprobaciones manuales de máscara.\n- CTA_EXPECT_FLAGS: usar NLA_POLICY_MASK con NF_CT_EXPECT_MASK, añadiendo una nueva definición de máscara que agrupa todas las banderas de expectación válidas.\n\nExtraído de un parche nf-next más amplio por Florian Westphal, delimitado a ctnetlink para el árbol de correcciones."}],"id":"CVE-2026-31495","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31495","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:22.554497Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:47.500","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ef71307c86a9f866d6e28f1a0c06e2e9d794474"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/435b576cd2faa75154777868f8cbb73bf71644d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45c33e79ae705b7af97e3117672b6cd258dd0b1b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f7d25f3f0786402ba48ff7d13b6241d77d975f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/675c913b940488a84effdeeac5a1cfb657b59804"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f15b5071b4548b0aafc03b366eb45c9c6566704"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c6cb41eaae875501eaaa487b8db6539feb092292"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fcec5ce2d73a41668b24e3f18c803541602a59f6"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31496.json b/data/2026/CVE-2026-31496.json index b62121aae7..c87a43858d 100644 --- a/data/2026/CVE-2026-31496.json +++ b/data/2026/CVE-2026-31496.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nf_conntrack_expect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2028405ea6987b4448784e439413202cfe19f43f","status":"affected","version":"9b03f38d0487f3908696242286d934c9b38f9d2a","versionType":"git"},{"lessThan":"168145c87444619e3e649322bbe7719ecd00d411","status":"affected","version":"9b03f38d0487f3908696242286d934c9b38f9d2a","versionType":"git"},{"lessThan":"dcfcd95b3ae7683e8ae55c92284b3430ce614bc7","status":"affected","version":"9b03f38d0487f3908696242286d934c9b38f9d2a","versionType":"git"},{"lessThan":"9ca8c7452493d915f9bbf2f39331e6c583d07a23","status":"affected","version":"9b03f38d0487f3908696242286d934c9b38f9d2a","versionType":"git"},{"lessThan":"3265ad619987cb551edaf797ed056d80ac450225","status":"affected","version":"9b03f38d0487f3908696242286d934c9b38f9d2a","versionType":"git"},{"lessThan":"3db5647984de03d9cae0dcddb509b058351f0ee4","status":"affected","version":"9b03f38d0487f3908696242286d934c9b38f9d2a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nf_conntrack_expect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.28"},{"lessThan":"2.6.28","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"46B94C77-721A-426C-93DF-A9C494E34051","versionEndExcluding":"6.1.168","versionStartIncluding":"2.6.28.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.28:-:*:*:*:*:*:*","matchCriteriaId":"E49D2BB3-E71B-45D6-967F-8DEBCF7CEDB0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: skip expectations in other netns via proc\n\nSkip expectations that do not reside in this netns.\n\nSimilar to e77e6ff502ea (\"netfilter: conntrack: do not dump other netns's\nconntrack entries via proc\")."}],"id":"CVE-2026-31496","lastModified":"2026-11-10T13:18:56.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31496","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:29.741416Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:47.693","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/168145c87444619e3e649322bbe7719ecd00d411"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2028405ea6987b4448784e439413202cfe19f43f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3265ad619987cb551edaf797ed056d80ac450225"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3db5647984de03d9cae0dcddb509b058351f0ee4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ca8c7452493d915f9bbf2f39331e6c583d07a23"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dcfcd95b3ae7683e8ae55c92284b3430ce614bc7"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nf_conntrack_expect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2028405ea6987b4448784e439413202cfe19f43f","status":"affected","version":"9b03f38d0487f3908696242286d934c9b38f9d2a","versionType":"git"},{"lessThan":"168145c87444619e3e649322bbe7719ecd00d411","status":"affected","version":"9b03f38d0487f3908696242286d934c9b38f9d2a","versionType":"git"},{"lessThan":"dcfcd95b3ae7683e8ae55c92284b3430ce614bc7","status":"affected","version":"9b03f38d0487f3908696242286d934c9b38f9d2a","versionType":"git"},{"lessThan":"9ca8c7452493d915f9bbf2f39331e6c583d07a23","status":"affected","version":"9b03f38d0487f3908696242286d934c9b38f9d2a","versionType":"git"},{"lessThan":"3265ad619987cb551edaf797ed056d80ac450225","status":"affected","version":"9b03f38d0487f3908696242286d934c9b38f9d2a","versionType":"git"},{"lessThan":"3db5647984de03d9cae0dcddb509b058351f0ee4","status":"affected","version":"9b03f38d0487f3908696242286d934c9b38f9d2a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nf_conntrack_expect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.28"},{"lessThan":"2.6.28","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"46B94C77-721A-426C-93DF-A9C494E34051","versionEndExcluding":"6.1.168","versionStartIncluding":"2.6.28.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.28:-:*:*:*:*:*:*","matchCriteriaId":"E49D2BB3-E71B-45D6-967F-8DEBCF7CEDB0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: skip expectations in other netns via proc\n\nSkip expectations that do not reside in this netns.\n\nSimilar to e77e6ff502ea (\"netfilter: conntrack: do not dump other netns's\nconntrack entries via proc\")."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: nf_conntrack_expect: omitir expectativas en otros netns vía proc\n\nOmitir expectativas que no residen en este netns.\n\nSimilar a e77e6ff502ea (’netfilter: conntrack: no volcar entradas de conntrack de otros netns vía proc’)."}],"id":"CVE-2026-31496","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31496","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:29.741416Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:47.693","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/168145c87444619e3e649322bbe7719ecd00d411"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2028405ea6987b4448784e439413202cfe19f43f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3265ad619987cb551edaf797ed056d80ac450225"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3db5647984de03d9cae0dcddb509b058351f0ee4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ca8c7452493d915f9bbf2f39331e6c583d07a23"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dcfcd95b3ae7683e8ae55c92284b3430ce614bc7"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31497.json b/data/2026/CVE-2026-31497.json index ddb2ad53c9..31932c68f2 100644 --- a/data/2026/CVE-2026-31497.json +++ b/data/2026/CVE-2026-31497.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/bluetooth/btusb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"312c4450fe23014665c163f480edd5ad2e27bbb8","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"9dd13a8641de79bc1bc93da55cdd35259a002683","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"476c9262b430c38c6a701a3b8176a3f48689085b","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"6fba3c3d48c927e55611a0f5ea34da88138ed0ff","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"834cf890d2c3d29cbfa1ee2376c40469c28ec297","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"1019028eb124564cf7bca58a16f1df8a1ca30726","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"21c254202f9d78abe0fcd642a92966deb92bd226","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"129fa608b6ad08b8ab7178eeb2ec272c993aaccc","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/bluetooth/btusb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"322D472B-4DA0-4679-9950-28C0EBB5BBA0","versionEndExcluding":"5.10.253","versionStartIncluding":"5.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:-:*:*:*:*:*:*","matchCriteriaId":"0E2DC66F-4A95-475F-B8B6-191DEC1E7EF6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: clamp SCO altsetting table indices\n\nbtusb_work() maps the number of active SCO links to USB alternate\nsettings through a three-entry lookup table when CVSD traffic uses\ntransparent voice settings. The lookup currently indexes alts[] with\ndata->sco_num - 1 without first constraining sco_num to the number of\navailable table entries.\n\nWhile the table only defines alternate settings for up to three SCO\nlinks, data->sco_num comes from hci_conn_num() and is used directly.\nCap the lookup to the last table entry before indexing it so the\ndriver keeps selecting the highest supported alternate setting without\nreading past alts[]."}],"id":"CVE-2026-31497","lastModified":"2026-11-05T22:18:35.370","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31497","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:36.640404Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:47.857","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1019028eb124564cf7bca58a16f1df8a1ca30726"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/129fa608b6ad08b8ab7178eeb2ec272c993aaccc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21c254202f9d78abe0fcd642a92966deb92bd226"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/312c4450fe23014665c163f480edd5ad2e27bbb8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/476c9262b430c38c6a701a3b8176a3f48689085b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6fba3c3d48c927e55611a0f5ea34da88138ed0ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/834cf890d2c3d29cbfa1ee2376c40469c28ec297"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9dd13a8641de79bc1bc93da55cdd35259a002683"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/bluetooth/btusb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"312c4450fe23014665c163f480edd5ad2e27bbb8","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"9dd13a8641de79bc1bc93da55cdd35259a002683","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"476c9262b430c38c6a701a3b8176a3f48689085b","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"6fba3c3d48c927e55611a0f5ea34da88138ed0ff","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"834cf890d2c3d29cbfa1ee2376c40469c28ec297","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"1019028eb124564cf7bca58a16f1df8a1ca30726","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"21c254202f9d78abe0fcd642a92966deb92bd226","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"},{"lessThan":"129fa608b6ad08b8ab7178eeb2ec272c993aaccc","status":"affected","version":"baac6276c0a9f36f1fe1f00590ef00d2ba5ba626","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/bluetooth/btusb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"322D472B-4DA0-4679-9950-28C0EBB5BBA0","versionEndExcluding":"5.10.253","versionStartIncluding":"5.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:-:*:*:*:*:*:*","matchCriteriaId":"0E2DC66F-4A95-475F-B8B6-191DEC1E7EF6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: clamp SCO altsetting table indices\n\nbtusb_work() maps the number of active SCO links to USB alternate\nsettings through a three-entry lookup table when CVSD traffic uses\ntransparent voice settings. The lookup currently indexes alts[] with\ndata->sco_num - 1 without first constraining sco_num to the number of\navailable table entries.\n\nWhile the table only defines alternate settings for up to three SCO\nlinks, data->sco_num comes from hci_conn_num() and is used directly.\nCap the lookup to the last table entry before indexing it so the\ndriver keeps selecting the highest supported alternate setting without\nreading past alts[]."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: btusb: limitar los índices de la tabla de configuración alternativa de SCO\n\nbtusb_work() asigna el número de enlaces SCO activos a configuraciones alternativas USB a través de una tabla de búsqueda de tres entradas cuando el tráfico CVSD utiliza configuraciones de voz transparentes. La búsqueda actualmente indexa alts[] con data -> sco_num - 1 sin primero restringir sco_num al número de entradas de tabla disponibles.\n\nAunque la tabla solo define configuraciones alternativas para hasta tres enlaces SCO, data -> sco_num proviene de hci_conn_num() y se utiliza directamente. Limitar la búsqueda a la última entrada de la tabla antes de indexarla para que el controlador siga seleccionando la configuración alternativa más alta soportada sin leer más allá de alts[]."}],"id":"CVE-2026-31497","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31497","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:36.640404Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:47.857","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1019028eb124564cf7bca58a16f1df8a1ca30726"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/129fa608b6ad08b8ab7178eeb2ec272c993aaccc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21c254202f9d78abe0fcd642a92966deb92bd226"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/312c4450fe23014665c163f480edd5ad2e27bbb8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/476c9262b430c38c6a701a3b8176a3f48689085b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6fba3c3d48c927e55611a0f5ea34da88138ed0ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/834cf890d2c3d29cbfa1ee2376c40469c28ec297"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9dd13a8641de79bc1bc93da55cdd35259a002683"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31498.json b/data/2026/CVE-2026-31498.json index 035bb18339..efeff33131 100644 --- a/data/2026/CVE-2026-31498.json +++ b/data/2026/CVE-2026-31498.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9760b83cfd24b38caee663f429011a0dd6064fa9","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"de37e2655b7abc3f59254c6b72256840f39fc6d5","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"e7aab23b7df89a3d754a5f0a7d2237548b328bd0","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"52667c859fe33f70c2e711cb81bbd505d5eb8e75","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"9a21a631ee034b1573dce14b572a24943dbfd7ae","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"900e4db5385ec2cacd372345a80ab9c8e105b3a3","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"042e2cd4bb11e5313b19b87593616524949e4c52","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"25f420a0d4cfd61d3d23ec4b9c56d9f443d91377","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"status":"affected","version":"4ad03ff6f680681c5f78254e37c4c856fa953629","versionType":"git"},{"status":"affected","version":"b7d0ca715c1008acd2fc018f02a56fed88f78b75","versionType":"git"},{"status":"affected","version":"799263eb37a4f7f6d39334046929c3bc92452a7f","versionType":"git"},{"status":"affected","version":"8828622fb9b4201eeb0870587052e3d834cfaf61","versionType":"git"},{"status":"affected","version":"b432ea85ab8472763870dd0f2c186130dd36d68c","versionType":"git"},{"lessThan":"4.5","status":"affected","version":"4.4.238","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.238","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.200","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.149","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.69","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"06D736F2-3AF9-405C-A2D4-D7A433966CD1","versionEndExcluding":"4.5","versionStartIncluding":"4.4.238","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C239C4E4-A9BE-4BA4-B0ED-58C96D32A965","versionEndExcluding":"4.10","versionStartIncluding":"4.9.238","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E4C219D0-2F4C-4842-85C7-5EE4D0099F82","versionEndExcluding":"4.15","versionStartIncluding":"4.14.200","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"22D98FED-AEF1-4722-8A24-E84AEFBAE267","versionEndExcluding":"4.20","versionStartIncluding":"4.19.149","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20BCB29D-C30A-4880-8FC2-2468E283C95D","versionEndExcluding":"5.5","versionStartIncluding":"5.4.69","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"44827F4D-4242-412D-B59A-6D9F5FC547B1","versionEndExcluding":"5.10.253","versionStartIncluding":"5.7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:-:*:*:*:*:*:*","matchCriteriaId":"3D23CE42-BDB2-4216-8495-230ABE98FCDD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop\n\nl2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED\nstate to support L2CAP reconfiguration (e.g. MTU changes). However,\nsince both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from\nthe initial configuration, the reconfiguration path falls through to\nl2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and\nretrans_list without freeing the previous allocations and sets\nchan->sdu to NULL without freeing the existing skb. This leaks all\npreviously allocated ERTM resources.\n\nAdditionally, l2cap_parse_conf_req() does not validate the minimum\nvalue of remote_mps derived from the RFC max_pdu_size option. A zero\nvalue propagates to l2cap_segment_sdu() where pdu_len becomes zero,\ncausing the while loop to never terminate since len is never\ndecremented, exhausting all available memory.\n\nFix the double-init by skipping l2cap_ertm_init() and\nl2cap_chan_ready() when the channel is already in BT_CONNECTED state,\nwhile still allowing the reconfiguration parameters to be updated\nthrough l2cap_parse_conf_req(). Also add a pdu_len zero check in\nl2cap_segment_sdu() as a safeguard."}],"id":"CVE-2026-31498","lastModified":"2026-11-05T22:18:35.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31498","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:45.390526Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:48.067","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/042e2cd4bb11e5313b19b87593616524949e4c52"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25f420a0d4cfd61d3d23ec4b9c56d9f443d91377"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/52667c859fe33f70c2e711cb81bbd505d5eb8e75"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/900e4db5385ec2cacd372345a80ab9c8e105b3a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9760b83cfd24b38caee663f429011a0dd6064fa9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a21a631ee034b1573dce14b572a24943dbfd7ae"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de37e2655b7abc3f59254c6b72256840f39fc6d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e7aab23b7df89a3d754a5f0a7d2237548b328bd0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9760b83cfd24b38caee663f429011a0dd6064fa9","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"de37e2655b7abc3f59254c6b72256840f39fc6d5","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"e7aab23b7df89a3d754a5f0a7d2237548b328bd0","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"52667c859fe33f70c2e711cb81bbd505d5eb8e75","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"9a21a631ee034b1573dce14b572a24943dbfd7ae","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"900e4db5385ec2cacd372345a80ab9c8e105b3a3","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"042e2cd4bb11e5313b19b87593616524949e4c52","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"lessThan":"25f420a0d4cfd61d3d23ec4b9c56d9f443d91377","status":"affected","version":"96298f640104e4cd9a913a6e50b0b981829b94ff","versionType":"git"},{"status":"affected","version":"4ad03ff6f680681c5f78254e37c4c856fa953629","versionType":"git"},{"status":"affected","version":"b7d0ca715c1008acd2fc018f02a56fed88f78b75","versionType":"git"},{"status":"affected","version":"799263eb37a4f7f6d39334046929c3bc92452a7f","versionType":"git"},{"status":"affected","version":"8828622fb9b4201eeb0870587052e3d834cfaf61","versionType":"git"},{"status":"affected","version":"b432ea85ab8472763870dd0f2c186130dd36d68c","versionType":"git"},{"lessThan":"4.5","status":"affected","version":"4.4.238","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.238","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.200","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.149","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.69","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"06D736F2-3AF9-405C-A2D4-D7A433966CD1","versionEndExcluding":"4.5","versionStartIncluding":"4.4.238","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C239C4E4-A9BE-4BA4-B0ED-58C96D32A965","versionEndExcluding":"4.10","versionStartIncluding":"4.9.238","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E4C219D0-2F4C-4842-85C7-5EE4D0099F82","versionEndExcluding":"4.15","versionStartIncluding":"4.14.200","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"22D98FED-AEF1-4722-8A24-E84AEFBAE267","versionEndExcluding":"4.20","versionStartIncluding":"4.19.149","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20BCB29D-C30A-4880-8FC2-2468E283C95D","versionEndExcluding":"5.5","versionStartIncluding":"5.4.69","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"44827F4D-4242-412D-B59A-6D9F5FC547B1","versionEndExcluding":"5.10.253","versionStartIncluding":"5.7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:-:*:*:*:*:*:*","matchCriteriaId":"3D23CE42-BDB2-4216-8495-230ABE98FCDD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop\n\nl2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED\nstate to support L2CAP reconfiguration (e.g. MTU changes). However,\nsince both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from\nthe initial configuration, the reconfiguration path falls through to\nl2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and\nretrans_list without freeing the previous allocations and sets\nchan->sdu to NULL without freeing the existing skb. This leaks all\npreviously allocated ERTM resources.\n\nAdditionally, l2cap_parse_conf_req() does not validate the minimum\nvalue of remote_mps derived from the RFC max_pdu_size option. A zero\nvalue propagates to l2cap_segment_sdu() where pdu_len becomes zero,\ncausing the while loop to never terminate since len is never\ndecremented, exhausting all available memory.\n\nFix the double-init by skipping l2cap_ertm_init() and\nl2cap_chan_ready() when the channel is already in BT_CONNECTED state,\nwhile still allowing the reconfiguration parameters to be updated\nthrough l2cap_parse_conf_req(). Also add a pdu_len zero check in\nl2cap_segment_sdu() as a safeguard."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: L2CAP: Corrección de la reinicialización de ERTM y bucle infinito con pdu_len cero\n\nl2cap_config_req() procesa CONFIG_REQ para canales en estado BT_CONNECTED para soportar la reconfiguración de L2CAP (p. ej., cambios de MTU). Sin embargo, dado que tanto CONF_INPUT_DONE como CONF_OUTPUT_DONE ya están establecidos desde la configuración inicial, la ruta de reconfiguración pasa a l2cap_ertm_init(), que reinicializa tx_q, srej_q, srej_list y retrans_list sin liberar las asignaciones anteriores y establece chan -> sdu a NULL sin liberar el skb existente. Esto fuga todos los recursos ERTM previamente asignados.\n\nAdemás, l2cap_parse_conf_req() no valida el valor mínimo de remote_mps derivado de la opción max_pdu_size de RFC. Un valor cero se propaga a l2cap_segment_sdu() donde pdu_len se vuelve cero, haciendo que el bucle ’while’ nunca termine ya que ’len’ nunca se decrementa, agotando toda la memoria disponible.\n\nSe corrige la doble inicialización omitiendo l2cap_ertm_init() y l2cap_chan_ready() cuando el canal ya está en estado BT_CONNECTED, mientras se sigue permitiendo que los parámetros de reconfiguración se actualicen a través de l2cap_parse_conf_req(). También se añade una comprobación de pdu_len cero en l2cap_segment_sdu() como salvaguarda."}],"id":"CVE-2026-31498","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31498","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:45.390526Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:48.067","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/042e2cd4bb11e5313b19b87593616524949e4c52"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25f420a0d4cfd61d3d23ec4b9c56d9f443d91377"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/52667c859fe33f70c2e711cb81bbd505d5eb8e75"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/900e4db5385ec2cacd372345a80ab9c8e105b3a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9760b83cfd24b38caee663f429011a0dd6064fa9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a21a631ee034b1573dce14b572a24943dbfd7ae"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de37e2655b7abc3f59254c6b72256840f39fc6d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e7aab23b7df89a3d754a5f0a7d2237548b328bd0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31499.json b/data/2026/CVE-2026-31499.json index 76ef9e4213..6c2e02480c 100644 --- a/data/2026/CVE-2026-31499.json +++ b/data/2026/CVE-2026-31499.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da","status":"affected","version":"f87271d21dd4ee83857ca11b94e7b4952749bbae","versionType":"git"},{"lessThan":"3f26ecbd9cde621dd94be7ef252c7210b965a5c7","status":"affected","version":"ab4eedb790cae44313759b50fe47da285e2519d5","versionType":"git"},{"lessThan":"d008460de352e534f6721de829b093368564ec66","status":"affected","version":"ab4eedb790cae44313759b50fe47da285e2519d5","versionType":"git"},{"lessThan":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","status":"affected","version":"ab4eedb790cae44313759b50fe47da285e2519d5","versionType":"git"},{"status":"affected","version":"efc30877bd4bc85fefe98d80af60fafc86e5775e","versionType":"git"},{"status":"affected","version":"18ab6b6078fa8191ca30a3065d57bf35d5635761","versionType":"git"},{"lessThan":"6.12.88","status":"affected","version":"6.12.20","versionType":"semver"},{"lessThan":"6.7","status":"affected","version":"6.6.84","versionType":"semver"},{"lessThan":"6.14","status":"affected","version":"6.13.8","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.88","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3B605565-ABCA-49F6-9B41-61FAF3C20FA1","versionEndExcluding":"6.7","versionStartIncluding":"6.6.84","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"893662BF-1CCE-4257-93CB-4C93976B20C6","versionEndExcluding":"6.13","versionStartIncluding":"6.12.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"366CEEDE-ED7E-4CD5-A00F-927D6C249DFD","versionEndExcluding":"6.14","versionStartIncluding":"6.13.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8BA62FCD-8829-4508-AFE2-0C12960267CD","versionEndExcluding":"6.18.21","versionStartIncluding":"6.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*","matchCriteriaId":"7DE421BA-0600-4401-A175-73CAB6A6FB4E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix deadlock in l2cap_conn_del()\n\nl2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer\nand id_addr_timer while holding conn->lock. However, the work functions\nl2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire\nconn->lock, creating a potential AB-BA deadlock if the work is already\nexecuting when l2cap_conn_del() takes the lock.\n\nMove the work cancellations before acquiring conn->lock and use\ndisable_delayed_work_sync() to additionally prevent the works from\nbeing rearmed after cancellation, consistent with the pattern used in\nhci_conn_del()."}],"id":"CVE-2026-31499","lastModified":"2026-11-05T22:18:35.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31499","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:51.710580Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:48.283","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3f26ecbd9cde621dd94be7ef252c7210b965a5c7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d008460de352e534f6721de829b093368564ec66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da","status":"affected","version":"f87271d21dd4ee83857ca11b94e7b4952749bbae","versionType":"git"},{"lessThan":"3f26ecbd9cde621dd94be7ef252c7210b965a5c7","status":"affected","version":"ab4eedb790cae44313759b50fe47da285e2519d5","versionType":"git"},{"lessThan":"d008460de352e534f6721de829b093368564ec66","status":"affected","version":"ab4eedb790cae44313759b50fe47da285e2519d5","versionType":"git"},{"lessThan":"00fdebbbc557a2fc21321ff2eaa22fd70c078608","status":"affected","version":"ab4eedb790cae44313759b50fe47da285e2519d5","versionType":"git"},{"status":"affected","version":"efc30877bd4bc85fefe98d80af60fafc86e5775e","versionType":"git"},{"status":"affected","version":"18ab6b6078fa8191ca30a3065d57bf35d5635761","versionType":"git"},{"lessThan":"6.12.88","status":"affected","version":"6.12.20","versionType":"semver"},{"lessThan":"6.7","status":"affected","version":"6.6.84","versionType":"semver"},{"lessThan":"6.14","status":"affected","version":"6.13.8","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.88","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3B605565-ABCA-49F6-9B41-61FAF3C20FA1","versionEndExcluding":"6.7","versionStartIncluding":"6.6.84","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"893662BF-1CCE-4257-93CB-4C93976B20C6","versionEndExcluding":"6.13","versionStartIncluding":"6.12.20","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"366CEEDE-ED7E-4CD5-A00F-927D6C249DFD","versionEndExcluding":"6.14","versionStartIncluding":"6.13.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8BA62FCD-8829-4508-AFE2-0C12960267CD","versionEndExcluding":"6.18.21","versionStartIncluding":"6.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*","matchCriteriaId":"7DE421BA-0600-4401-A175-73CAB6A6FB4E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix deadlock in l2cap_conn_del()\n\nl2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer\nand id_addr_timer while holding conn->lock. However, the work functions\nl2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire\nconn->lock, creating a potential AB-BA deadlock if the work is already\nexecuting when l2cap_conn_del() takes the lock.\n\nMove the work cancellations before acquiring conn->lock and use\ndisable_delayed_work_sync() to additionally prevent the works from\nbeing rearmed after cancellation, consistent with the pattern used in\nhci_conn_del()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: L2CAP: Corrección de interbloqueo en l2cap_conn_del()\n\nl2cap_conn_del() llama a cancel_delayed_work_sync() para info_timer y id_addr_timer mientras mantiene conn -> lock. Sin embargo, las funciones de trabajo l2cap_info_timeout() y l2cap_conn_update_id_addr() ambas adquieren conn -> lock, creando un potencial interbloqueo AB-BA si el trabajo ya se está ejecutando cuando l2cap_conn_del() toma el bloqueo.\n\nMover las cancelaciones de trabajo antes de adquirir conn -> lock y usar disable_delayed_work_sync() para evitar adicionalmente que los trabajos sean rearmados después de la cancelación, consistente con el patrón usado en hci_conn_del()."}],"id":"CVE-2026-31499","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31499","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:51.710580Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:48.283","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3f26ecbd9cde621dd94be7ef252c7210b965a5c7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d008460de352e534f6721de829b093368564ec66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31500.json b/data/2026/CVE-2026-31500.json index aeb89fa789..4a4675c887 100644 --- a/data/2026/CVE-2026-31500.json +++ b/data/2026/CVE-2026-31500.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/bluetooth/btintel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7e041d0aad1d4d43d921ace052e04f4e2cacaed3","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"5f84e845648dfa86e42de5487f1a774b42f0444d","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"66696648af477dc87859e5e4b607112f5f29d010","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"f7d84737663ad4a120d2d8ef1561a4df91282c2e","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"94d8e6fe5d0818e9300e514e095a200bd5ff93ae","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/bluetooth/btintel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.3"},{"lessThan":"4.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"13A272C2-FFCB-4269-8944-00DFA555EB6F","versionEndExcluding":"6.6.131","versionStartIncluding":"4.3.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.3:-:*:*:*:*:*:*","matchCriteriaId":"5419A247-F671-44D6-9848-35264FDCD816","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock\n\nbtintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET\nand Intel exception-info retrieval) without holding\nhci_req_sync_lock(). This lets it race against\nhci_dev_do_close() -> btintel_shutdown_combined(), which also runs\n__hci_cmd_sync() under the same lock. When both paths manipulate\nhdev->req_status/req_rsp concurrently, the close path may free the\nresponse skb first, and the still-running hw_error path hits a\nslab-use-after-free in kfree_skb().\n\nWrap the whole recovery sequence in hci_req_sync_lock/unlock so it\nis serialized with every other synchronous HCI command issuer.\n\nBelow is the data race report and the kasan report:\n\n BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined\n\n read of hdev->req_rsp at net/bluetooth/hci_sync.c:199\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254\n hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030\n\n write/free by task ioctl/22580:\n btintel_shutdown_combined+0xd0/0x360\n drivers/bluetooth/btintel.c:3648\n hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246\n hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526\n\n BUG: KASAN: slab-use-after-free in\n sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202\n Read of size 4 at addr ffff888144a738dc\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260"}],"id":"CVE-2026-31500","lastModified":"2026-11-05T22:18:35.893","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:57.538533Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:48.427","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93ae"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2e"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/bluetooth/btintel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7e041d0aad1d4d43d921ace052e04f4e2cacaed3","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"5f84e845648dfa86e42de5487f1a774b42f0444d","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"66696648af477dc87859e5e4b607112f5f29d010","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"f7d84737663ad4a120d2d8ef1561a4df91282c2e","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"},{"lessThan":"94d8e6fe5d0818e9300e514e095a200bd5ff93ae","status":"affected","version":"973bb97e5aee56edddaae3d5c96877101ad509c0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/bluetooth/btintel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.3"},{"lessThan":"4.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"13A272C2-FFCB-4269-8944-00DFA555EB6F","versionEndExcluding":"6.6.131","versionStartIncluding":"4.3.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.3:-:*:*:*:*:*:*","matchCriteriaId":"5419A247-F671-44D6-9848-35264FDCD816","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock\n\nbtintel_hw_error() issues two __hci_cmd_sync() calls (HCI_OP_RESET\nand Intel exception-info retrieval) without holding\nhci_req_sync_lock(). This lets it race against\nhci_dev_do_close() -> btintel_shutdown_combined(), which also runs\n__hci_cmd_sync() under the same lock. When both paths manipulate\nhdev->req_status/req_rsp concurrently, the close path may free the\nresponse skb first, and the still-running hw_error path hits a\nslab-use-after-free in kfree_skb().\n\nWrap the whole recovery sequence in hci_req_sync_lock/unlock so it\nis serialized with every other synchronous HCI command issuer.\n\nBelow is the data race report and the kasan report:\n\n BUG: data-race in __hci_cmd_sync_sk / btintel_shutdown_combined\n\n read of hdev->req_rsp at net/bluetooth/hci_sync.c:199\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254\n hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030\n\n write/free by task ioctl/22580:\n btintel_shutdown_combined+0xd0/0x360\n drivers/bluetooth/btintel.c:3648\n hci_dev_close_sync+0x9ae/0x2c10 net/bluetooth/hci_sync.c:5246\n hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526\n\n BUG: KASAN: slab-use-after-free in\n sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202\n Read of size 4 at addr ffff888144a738dc\n by task kworker/u17:1/83:\n __hci_cmd_sync_sk+0x12f2/0x1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: btintel: serializar btintel_hw_error() con hci_req_sync_lock\n\nbtintel_hw_error() emite dos llamadas a __hci_cmd_sync() (HCI_OP_RESET y recuperación de información de excepción de Intel) sin mantener hci_req_sync_lock(). Esto permite que compita contra hci_dev_do_close() -> btintel_shutdown_combined(), que también ejecuta __hci_cmd_sync() bajo el mismo bloqueo. Cuando ambas rutas manipulan hdev -> req_status/req_rsp concurrentemente, la ruta de cierre puede liberar el skb de respuesta primero, y la ruta hw_error aún en ejecución encuentra un uso después de liberación de slab en kfree_skb().\n\nEncapsular toda la secuencia de recuperación en hci_req_sync_lock/unlock para que se serialice con cualquier otro emisor de comandos HCI síncronos.\n\nA continuación se presenta el informe de condición de carrera y el informe kasan:\n\n ERROR: condición de carrera en __hci_cmd_sync_sk / btintel_shutdown_combined\n\n lectura de hdev -> req_rsp en net/bluetooth/hci_sync.c:199\n por la tarea kworker/u17:1/83:\n __hci_cmd_sync_sk+0x 12f2/0x 1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x114/0x670 drivers/bluetooth/btintel.c:254\n hci_error_reset+0x348/0xa30 net/bluetooth/hci_core.c:1030\n\n escritura/liberación por la tarea ioctl/22580:\n btintel_shutdown_combined+0xd0/0x360\n drivers/bluetooth/btintel.c:3648\n hci_dev_close_sync+0x9ae/0x 2c10 net/bluetooth/hci_sync.c:5246\n hci_dev_do_close+0x232/0x460 net/bluetooth/hci_core.c:526\n\n ERROR: KASAN: uso después de liberación de slab en\n sk_skb_reason_drop+0x43/0x380 net/core/skbuff.c:1202\n Lectura de tamaño 4 en la dirección ffff888144a738dc\n por la tarea kworker/u17:1/83:\n __hci_cmd_sync_sk+0x 12f2/0x 1c30 net/bluetooth/hci_sync.c:200\n __hci_cmd_sync+0x55/0x80 net/bluetooth/hci_sync.c:223\n btintel_hw_error+0x186/0x670 drivers/bluetooth/btintel.c:260"}],"id":"CVE-2026-31500","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:35:57.538533Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:48.427","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5f84e845648dfa86e42de5487f1a774b42f0444d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66696648af477dc87859e5e4b607112f5f29d010"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7e041d0aad1d4d43d921ace052e04f4e2cacaed3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/94d8e6fe5d0818e9300e514e095a200bd5ff93ae"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e10a4cb72468686ffbe8bb2b0520e37f6be1a0c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7d84737663ad4a120d2d8ef1561a4df91282c2e"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31501.json b/data/2026/CVE-2026-31501.json index 2e9106fdb7..efe903b725 100644 --- a/data/2026/CVE-2026-31501.json +++ b/data/2026/CVE-2026-31501.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/ti/icssg/icssg_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c516c2e06fe580b8d38de60cd407072a5de81506","status":"affected","version":"46eeb90f03e03d5e8f7f9f1f0eb0792104fc5f86","versionType":"git"},{"lessThan":"d5827316debcb677679bb014885d7be92c410e11","status":"affected","version":"46eeb90f03e03d5e8f7f9f1f0eb0792104fc5f86","versionType":"git"},{"lessThan":"eb8c426c9803beb171f89d15fea17505eb517714","status":"affected","version":"46eeb90f03e03d5e8f7f9f1f0eb0792104fc5f86","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/ti/icssg/icssg_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"042B87CE-9A59-4732-B045-5A732EC6BE59","versionEndExcluding":"6.19.11","versionStartIncluding":"6.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*","matchCriteriaId":"A1ECC65A-EE37-4479-8E99-4BB68A22A31F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path\n\ncppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor.\nIn both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is\nfreed via k3_cppi_desc_pool_free() before the psdata pointer is used\nby emac_rx_timestamp(), which dereferences psdata[0] and psdata[1].\nThis constitutes a use-after-free on every received packet that goes\nthrough the timestamp path.\n\nDefer the descriptor free until after all accesses through the psdata\npointer are complete. For emac_rx_packet(), move the free into the\nrequeue label so both early-exit and success paths free the descriptor\nafter all accesses are done. For emac_rx_packet_zc(), move the free to\nthe end of the loop body after emac_dispatch_skb_zc() (which calls\nemac_rx_timestamp()) has returned."}],"id":"CVE-2026-31501","lastModified":"2026-10-15T11:17:28.990","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:48.597","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c516c2e06fe580b8d38de60cd407072a5de81506"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5827316debcb677679bb014885d7be92c410e11"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb8c426c9803beb171f89d15fea17505eb517714"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/ti/icssg/icssg_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c516c2e06fe580b8d38de60cd407072a5de81506","status":"affected","version":"46eeb90f03e03d5e8f7f9f1f0eb0792104fc5f86","versionType":"git"},{"lessThan":"d5827316debcb677679bb014885d7be92c410e11","status":"affected","version":"46eeb90f03e03d5e8f7f9f1f0eb0792104fc5f86","versionType":"git"},{"lessThan":"eb8c426c9803beb171f89d15fea17505eb517714","status":"affected","version":"46eeb90f03e03d5e8f7f9f1f0eb0792104fc5f86","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/ti/icssg/icssg_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.57","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"042B87CE-9A59-4732-B045-5A732EC6BE59","versionEndExcluding":"6.19.11","versionStartIncluding":"6.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*","matchCriteriaId":"A1ECC65A-EE37-4479-8E99-4BB68A22A31F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path\n\ncppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor.\nIn both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is\nfreed via k3_cppi_desc_pool_free() before the psdata pointer is used\nby emac_rx_timestamp(), which dereferences psdata[0] and psdata[1].\nThis constitutes a use-after-free on every received packet that goes\nthrough the timestamp path.\n\nDefer the descriptor free until after all accesses through the psdata\npointer are complete. For emac_rx_packet(), move the free into the\nrequeue label so both early-exit and success paths free the descriptor\nafter all accesses are done. For emac_rx_packet_zc(), move the free to\nthe end of the loop body after emac_dispatch_skb_zc() (which calls\nemac_rx_timestamp()) has returned."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: ti: icssg-prueth: corregir uso después de liberación del descriptor CPPI en la ruta RX\n\ncppi5_hdesc_get_psdata() devuelve un puntero al descriptor CPPI.\nTanto en emac_rx_packet() como en emac_rx_packet_zc(), el descriptor es\nliberado a través de k3_cppi_desc_pool_free() antes de que el puntero psdata sea utilizado\npor emac_rx_timestamp(), que desreferencia psdata[0] y psdata[1].\nEsto constituye un uso después de liberación en cada paquete recibido que pasa\npor la ruta de marca de tiempo.\n\nRetrasar la liberación del descriptor hasta después de que todos los accesos a través del puntero psdata\nestén completos. Para emac_rx_packet(), mover la liberación a la\netiqueta requeue para que tanto las rutas de salida temprana como las de éxito liberen el descriptor\ndespués de que todos los accesos se hayan realizado. Para emac_rx_packet_zc(), mover la liberación al\nfinal del cuerpo del bucle después de que emac_dispatch_skb_zc() (que llama a\nemac_rx_timestamp()) haya regresado."}],"id":"CVE-2026-31501","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-22T14:16:48.597","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c516c2e06fe580b8d38de60cd407072a5de81506"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5827316debcb677679bb014885d7be92c410e11"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb8c426c9803beb171f89d15fea17505eb517714"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31502.json b/data/2026/CVE-2026-31502.json index 9f781327e6..0c7f731a23 100644 --- a/data/2026/CVE-2026-31502.json +++ b/data/2026/CVE-2026-31502.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/team/team_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c6e255b0ce30cdea37e34d6d87e2212eb8c7f7a4","status":"affected","version":"1d76efe1577b4323609b1bcbfafa8b731eda071a","versionType":"git"},{"lessThan":"420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53","status":"affected","version":"1d76efe1577b4323609b1bcbfafa8b731eda071a","versionType":"git"},{"lessThan":"6d3161fa3eee64d46b766fb0db33ec7f300ef52d","status":"affected","version":"1d76efe1577b4323609b1bcbfafa8b731eda071a","versionType":"git"},{"lessThan":"0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0","status":"affected","version":"1d76efe1577b4323609b1bcbfafa8b731eda071a","versionType":"git"},{"lessThan":"20491d384d973a63fbdaf7a71e38d69b0659ea55","status":"affected","version":"1d76efe1577b4323609b1bcbfafa8b731eda071a","versionType":"git"},{"lessThan":"425000dbf17373a4ab8be9428f5dc055ef870a56","status":"affected","version":"1d76efe1577b4323609b1bcbfafa8b731eda071a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/team/team_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.7"},{"lessThan":"3.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D205AD2D-8373-44D8-BB6D-74C87BD8E73A","versionEndExcluding":"6.12.80","versionStartIncluding":"3.7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.7:-:*:*:*:*:*:*","matchCriteriaId":"F482CC77-4452-423A-8A57-523E1AEA1087","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix header_ops type confusion with non-Ethernet ports\n\nSimilar to commit 950803f72547 (\"bonding: fix type confusion in\nbond_setup_by_slave()\") team has the same class of header_ops type\nconfusion.\n\nFor non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops\ndirectly. When the team device later calls dev_hard_header() or\ndev_parse_header(), these callbacks can run with the team net_device\ninstead of the real lower device, so netdev_priv(dev) is interpreted as\nthe wrong private type and can crash.\n\nThe syzbot report shows a crash in bond_header_create(), but the root\ncause is in team: the topology is gre -> bond -> team, and team calls\nthe inherited header_ops with its own net_device instead of the lower\ndevice, so bond_header_create() receives a team device and interprets\nnetdev_priv() as bonding private data, causing a type confusion crash.\n\nFix this by introducing team header_ops wrappers for create/parse,\nselecting a team port under RCU, and calling the lower device callbacks\nwith port->dev, so each callback always sees the correct net_device\ncontext.\n\nAlso pass the selected lower device to the lower parse callback, so\nrecursion is bounded in stacked non-Ethernet topologies and parse\ncallbacks always run with the correct device context."}],"id":"CVE-2026-31502","lastModified":"2026-10-30T13:18:40.267","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31502","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:14.938095Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:48.713","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/20491d384d973a63fbdaf7a71e38d69b0659ea55"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6d3161fa3eee64d46b766fb0db33ec7f300ef52d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c6e255b0ce30cdea37e34d6d87e2212eb8c7f7a4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-843"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/team/team_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c6e255b0ce30cdea37e34d6d87e2212eb8c7f7a4","status":"affected","version":"1d76efe1577b4323609b1bcbfafa8b731eda071a","versionType":"git"},{"lessThan":"420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53","status":"affected","version":"1d76efe1577b4323609b1bcbfafa8b731eda071a","versionType":"git"},{"lessThan":"6d3161fa3eee64d46b766fb0db33ec7f300ef52d","status":"affected","version":"1d76efe1577b4323609b1bcbfafa8b731eda071a","versionType":"git"},{"lessThan":"0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0","status":"affected","version":"1d76efe1577b4323609b1bcbfafa8b731eda071a","versionType":"git"},{"lessThan":"20491d384d973a63fbdaf7a71e38d69b0659ea55","status":"affected","version":"1d76efe1577b4323609b1bcbfafa8b731eda071a","versionType":"git"},{"lessThan":"425000dbf17373a4ab8be9428f5dc055ef870a56","status":"affected","version":"1d76efe1577b4323609b1bcbfafa8b731eda071a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/team/team_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.7"},{"lessThan":"3.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D205AD2D-8373-44D8-BB6D-74C87BD8E73A","versionEndExcluding":"6.12.80","versionStartIncluding":"3.7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.7:-:*:*:*:*:*:*","matchCriteriaId":"F482CC77-4452-423A-8A57-523E1AEA1087","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix header_ops type confusion with non-Ethernet ports\n\nSimilar to commit 950803f72547 (\"bonding: fix type confusion in\nbond_setup_by_slave()\") team has the same class of header_ops type\nconfusion.\n\nFor non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops\ndirectly. When the team device later calls dev_hard_header() or\ndev_parse_header(), these callbacks can run with the team net_device\ninstead of the real lower device, so netdev_priv(dev) is interpreted as\nthe wrong private type and can crash.\n\nThe syzbot report shows a crash in bond_header_create(), but the root\ncause is in team: the topology is gre -> bond -> team, and team calls\nthe inherited header_ops with its own net_device instead of the lower\ndevice, so bond_header_create() receives a team device and interprets\nnetdev_priv() as bonding private data, causing a type confusion crash.\n\nFix this by introducing team header_ops wrappers for create/parse,\nselecting a team port under RCU, and calling the lower device callbacks\nwith port->dev, so each callback always sees the correct net_device\ncontext.\n\nAlso pass the selected lower device to the lower parse callback, so\nrecursion is bounded in stacked non-Ethernet topologies and parse\ncallbacks always run with the correct device context."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nteam: corrige la confusión de tipo de header_ops con puertos que no son Ethernet\n\nSimilar al commit 950803f72547 (’bonding: corrige la confusión de tipo en bond_setup_by_slave()’), team tiene la misma clase de confusión de tipo de header_ops.\n\nPara puertos que no son Ethernet, team_setup_by_port() copia port_dev -> header_ops directamente. Cuando el dispositivo team llama más tarde a dev_hard_header() o dev_parse_header(), estas devoluciones de llamada pueden ejecutarse con el net_device del team en lugar del dispositivo inferior real, por lo que netdev_priv(dev) se interpreta como el tipo privado incorrecto y puede causar un fallo.\n\nEl informe de syzbot muestra un fallo en bond_header_create(), pero la causa raíz está en team: la topología es gre -> bond -> team, y team llama a los header_ops heredados con su propio net_device en lugar del dispositivo inferior, por lo que bond_header_create() recibe un dispositivo team e interpreta netdev_priv() como datos privados de bonding, causando un fallo por confusión de tipo.\n\nSoluciona esto introduciendo envoltorios de header_ops de team para create/parse, seleccionando un puerto de team bajo RCU, y llamando a las devoluciones de llamada del dispositivo inferior con port -> dev, para que cada devolución de llamada siempre vea el contexto net_device correcto.\n\nTambién pasa el dispositivo inferior seleccionado a la devolución de llamada de análisis inferior, para que la recursión esté limitada en topologías apiladas que no son Ethernet y las devoluciones de llamada de análisis siempre se ejecuten con el contexto de dispositivo correcto."}],"id":"CVE-2026-31502","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31502","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:14.938095Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:48.713","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/20491d384d973a63fbdaf7a71e38d69b0659ea55"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6d3161fa3eee64d46b766fb0db33ec7f300ef52d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c6e255b0ce30cdea37e34d6d87e2212eb8c7f7a4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-843"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-843"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31503.json b/data/2026/CVE-2026-31503.json index ee0aed87d9..d25bf76cd9 100644 --- a/data/2026/CVE-2026-31503.json +++ b/data/2026/CVE-2026-31503.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/inet_hashtables.h","net/ipv4/inet_connection_sock.c","net/ipv4/udp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d6ace0dbcbb7fd285738bb87b42b71b01858c952","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"2297e38114316b26ae02f2d205c49b5511c5ed55","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"f1bed05a832ae79be5f7a105da56810eaa59a5f1","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"0a360f7f73a06ac88f18917055fbcc79694252d7","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"e537dd15d0d4ad989d56a1021290f0c674dd8b28","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/inet_hashtables.h","net/ipv4/inet_connection_sock.c","net/ipv4/udp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.33"},{"lessThan":"2.6.33","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8311CDFC-9254-42F8-B327-8390CCD33713","versionEndExcluding":"6.1.168","versionStartIncluding":"2.6.33.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.33:-:*:*:*:*:*:*","matchCriteriaId":"EF818826-D9F2-42F9-9638-9609513561A3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Fix wildcard bind conflict check when using hash2\n\nWhen binding a udp_sock to a local address and port, UDP uses\ntwo hashes (udptable->hash and udptable->hash2) for collision\ndetection. The current code switches to \"hash2\" when\nhslot->count > 10.\n\n\"hash2\" is keyed by local address and local port.\n\"hash\" is keyed by local port only.\n\nThe issue can be shown in the following bind sequence (pseudo code):\n\nbind(fd1, \"[fd00::1]:8888\")\nbind(fd2, \"[fd00::2]:8888\")\nbind(fd3, \"[fd00::3]:8888\")\nbind(fd4, \"[fd00::4]:8888\")\nbind(fd5, \"[fd00::5]:8888\")\nbind(fd6, \"[fd00::6]:8888\")\nbind(fd7, \"[fd00::7]:8888\")\nbind(fd8, \"[fd00::8]:8888\")\nbind(fd9, \"[fd00::9]:8888\")\nbind(fd10, \"[fd00::10]:8888\")\n\n/* Correctly return -EADDRINUSE because \"hash\" is used\n * instead of \"hash2\". udp_lib_lport_inuse() detects the\n * conflict.\n */\nbind(fail_fd, \"[::]:8888\")\n\n/* After one more socket is bound to \"[fd00::11]:8888\",\n * hslot->count exceeds 10 and \"hash2\" is used instead.\n */\nbind(fd11, \"[fd00::11]:8888\")\nbind(fail_fd, \"[::]:8888\") /* succeeds unexpectedly */\n\nThe same issue applies to the IPv4 wildcard address \"0.0.0.0\"\nand the IPv4-mapped wildcard address \"::ffff:0.0.0.0\". For\nexample, if there are existing sockets bound to\n\"192.168.1.[1-11]:8888\", then binding \"0.0.0.0:8888\" or\n\"[::ffff:0.0.0.0]:8888\" can also miss the conflict when\nhslot->count > 10.\n\nTCP inet_csk_get_port() already has the correct check in\ninet_use_bhash2_on_bind(). Rename it to\ninet_use_hash2_on_bind() and move it to inet_hashtables.h\nso udp.c can reuse it in this fix."}],"id":"CVE-2026-31503","lastModified":"2026-11-10T13:18:57.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:36:04.666647Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:48.863","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a360f7f73a06ac88f18917055fbcc79694252d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2297e38114316b26ae02f2d205c49b5511c5ed55"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d6ace0dbcbb7fd285738bb87b42b71b01858c952"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e537dd15d0d4ad989d56a1021290f0c674dd8b28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1bed05a832ae79be5f7a105da56810eaa59a5f1"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/inet_hashtables.h","net/ipv4/inet_connection_sock.c","net/ipv4/udp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d6ace0dbcbb7fd285738bb87b42b71b01858c952","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"2297e38114316b26ae02f2d205c49b5511c5ed55","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"f1bed05a832ae79be5f7a105da56810eaa59a5f1","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"0a360f7f73a06ac88f18917055fbcc79694252d7","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"},{"lessThan":"e537dd15d0d4ad989d56a1021290f0c674dd8b28","status":"affected","version":"30fff9231fad757c061285e347b33c5149c2c2e4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/inet_hashtables.h","net/ipv4/inet_connection_sock.c","net/ipv4/udp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.33"},{"lessThan":"2.6.33","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8311CDFC-9254-42F8-B327-8390CCD33713","versionEndExcluding":"6.1.168","versionStartIncluding":"2.6.33.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.33:-:*:*:*:*:*:*","matchCriteriaId":"EF818826-D9F2-42F9-9638-9609513561A3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Fix wildcard bind conflict check when using hash2\n\nWhen binding a udp_sock to a local address and port, UDP uses\ntwo hashes (udptable->hash and udptable->hash2) for collision\ndetection. The current code switches to \"hash2\" when\nhslot->count > 10.\n\n\"hash2\" is keyed by local address and local port.\n\"hash\" is keyed by local port only.\n\nThe issue can be shown in the following bind sequence (pseudo code):\n\nbind(fd1, \"[fd00::1]:8888\")\nbind(fd2, \"[fd00::2]:8888\")\nbind(fd3, \"[fd00::3]:8888\")\nbind(fd4, \"[fd00::4]:8888\")\nbind(fd5, \"[fd00::5]:8888\")\nbind(fd6, \"[fd00::6]:8888\")\nbind(fd7, \"[fd00::7]:8888\")\nbind(fd8, \"[fd00::8]:8888\")\nbind(fd9, \"[fd00::9]:8888\")\nbind(fd10, \"[fd00::10]:8888\")\n\n/* Correctly return -EADDRINUSE because \"hash\" is used\n * instead of \"hash2\". udp_lib_lport_inuse() detects the\n * conflict.\n */\nbind(fail_fd, \"[::]:8888\")\n\n/* After one more socket is bound to \"[fd00::11]:8888\",\n * hslot->count exceeds 10 and \"hash2\" is used instead.\n */\nbind(fd11, \"[fd00::11]:8888\")\nbind(fail_fd, \"[::]:8888\") /* succeeds unexpectedly */\n\nThe same issue applies to the IPv4 wildcard address \"0.0.0.0\"\nand the IPv4-mapped wildcard address \"::ffff:0.0.0.0\". For\nexample, if there are existing sockets bound to\n\"192.168.1.[1-11]:8888\", then binding \"0.0.0.0:8888\" or\n\"[::ffff:0.0.0.0]:8888\" can also miss the conflict when\nhslot->count > 10.\n\nTCP inet_csk_get_port() already has the correct check in\ninet_use_bhash2_on_bind(). Rename it to\ninet_use_hash2_on_bind() and move it to inet_hashtables.h\nso udp.c can reuse it in this fix."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: udp: Corrección de la verificación de conflicto de enlace comodín al usar hash2 Al enlazar un udp_sock a una dirección local y puerto, UDP usa dos hashes (udptable -> hash y udptable -> hash2) para la detección de colisiones. El código actual cambia a ’hash2’ cuando hslot -> count mayor que 10. ’hash2’ se indexa por dirección local y puerto local.\n’hash’ se indexa solo por puerto local. El problema se puede mostrar en la siguiente secuencia de enlace (pseudocódigo): bind(fd1, ’[fd00::1]:8888’)\nbind(fd2, ’[fd00::2]:8888’)\nbind(fd3, ’[fd00::3]:8888’)\nbind(fd4, ’[fd00::4]:8888’)\nbind(fd5, ’[fd00::5]:8888’)\nbind(fd6, ’[fd00::6]:8888’)\nbind(fd7, ’[fd00::7]:8888’)\nbind(fd8, ’[fd00::8]:8888’)\nbind(fd9, ’[fd00::9]:8888’)\nbind(fd10, ’[fd00::10]:8888’) /* Devuelve correctamente -EADDRINUSE porque se usa ’hash’ * en lugar de ’hash2’. udp_lib_lport_inuse() detecta el * conflicto. */\nbind(fail_fd, ’[::]:8888’) /* Después de que un socket más se enlaza a ’[fd00::11]:8888’, * hslot -> count excede 10 y se usa ’hash2’ en su lugar. */\nbind(fd11, ’[fd00::11]:8888’)\nbind(fail_fd, ’[::]:8888’) /* tiene éxito inesperadamente */ El mismo problema se aplica a la dirección comodín IPv4 ’0.0.0.0’ y a la dirección comodín mapeada a IPv4 ’::ffff:0.0.0.0’. Por ejemplo, si hay sockets existentes enlazados a ’192.168.1.[1-11]:8888’, entonces enlazar ’0.0.0.0:8888’ o ’[::ffff:0.0.0.0]:8888’ también puede pasar por alto el conflicto cuando hslot -> count mayor que 10. TCP inet_csk_get_port() ya tiene la verificación correcta en inet_use_bhash2_on_bind(). Renombrarlo a inet_use_hash2_on_bind() y moverlo a inet_hashtables.h para que udp.c pueda reutilizarlo en esta corrección."}],"id":"CVE-2026-31503","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:36:04.666647Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:48.863","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a360f7f73a06ac88f18917055fbcc79694252d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2297e38114316b26ae02f2d205c49b5511c5ed55"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d6ace0dbcbb7fd285738bb87b42b71b01858c952"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e537dd15d0d4ad989d56a1021290f0c674dd8b28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1bed05a832ae79be5f7a105da56810eaa59a5f1"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31504.json b/data/2026/CVE-2026-31504.json index 9da6bf7e9d..2d7e85e4b9 100644 --- a/data/2026/CVE-2026-31504.json +++ b/data/2026/CVE-2026-31504.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ee642b1962caa9aa231c01abbd58bc453ae6b66e","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"42cfd7898eeed290c9fb73f732af1f7d6b0a703e","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"1b4c03f8892d955385c202009af7485364731bb9","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"654386baef228c2992dbf604c819e4c7c35fc71b","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"75fe6db23705a1d55160081f7b37db9665b1880b","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"ceccbfc6de720ad633519a226715989cfb065af1","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"42156f93d123436f2a27c468f18c966b7e5db796","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.1"},{"lessThan":"3.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4333338A-C6E8-4E3E-B55E-4B83879A9E8E","versionEndExcluding":"5.10.253","versionStartIncluding":"3.1.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.1:-:*:*:*:*:*:*","matchCriteriaId":"98093688-6D93-4911-8D48-AC4A4619BCED","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group's `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po->num` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f->arr[]` and increments `f->num_members`,\nbut does NOT increment `f->sk_ref`.\n\nThe fix sets `po->num` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617."}],"id":"CVE-2026-31504","lastModified":"2026-11-10T13:18:57.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:18.282904Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:49.040","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1b4c03f8892d955385c202009af7485364731bb9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/42156f93d123436f2a27c468f18c966b7e5db796"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/42cfd7898eeed290c9fb73f732af1f7d6b0a703e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/654386baef228c2992dbf604c819e4c7c35fc71b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75fe6db23705a1d55160081f7b37db9665b1880b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ceccbfc6de720ad633519a226715989cfb065af1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee642b1962caa9aa231c01abbd58bc453ae6b66e"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ee642b1962caa9aa231c01abbd58bc453ae6b66e","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"42cfd7898eeed290c9fb73f732af1f7d6b0a703e","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"1b4c03f8892d955385c202009af7485364731bb9","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"654386baef228c2992dbf604c819e4c7c35fc71b","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"75fe6db23705a1d55160081f7b37db9665b1880b","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"ceccbfc6de720ad633519a226715989cfb065af1","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"},{"lessThan":"42156f93d123436f2a27c468f18c966b7e5db796","status":"affected","version":"ce06b03e60fc19c680d1bf873e779bf11c2fc518","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/packet/af_packet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.1"},{"lessThan":"3.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4333338A-C6E8-4E3E-B55E-4B83879A9E8E","versionEndExcluding":"5.10.253","versionStartIncluding":"3.1.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.1:-:*:*:*:*:*:*","matchCriteriaId":"98093688-6D93-4911-8D48-AC4A4619BCED","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix fanout UAF in packet_release() via NETDEV_UP race\n\n`packet_release()` has a race window where `NETDEV_UP` can re-register a\nsocket into a fanout group's `arr[]` array. The re-registration is not\ncleaned up by `fanout_release()`, leaving a dangling pointer in the fanout\narray.\n`packet_release()` does NOT zero `po->num` in its `bind_lock` section.\nAfter releasing `bind_lock`, `po->num` is still non-zero and `po->ifindex`\nstill matches the bound device. A concurrent `packet_notifier(NETDEV_UP)`\nthat already found the socket in `sklist` can re-register the hook.\nFor fanout sockets, this re-registration calls `__fanout_link(sk, po)`\nwhich adds the socket back into `f->arr[]` and increments `f->num_members`,\nbut does NOT increment `f->sk_ref`.\n\nThe fix sets `po->num` to zero in `packet_release` while `bind_lock` is\nheld to prevent NETDEV_UP from linking, preventing the race window.\n\nThis bug was found following an additional audit with Claude Code based\non CVE-2025-38617."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: corrige UAF de fanout en packet_release() a través de una condición de carrera de NETDEV_UP\n\n’packet_release()’ tiene una ventana de carrera donde ’NETDEV_UP’ puede volver a registrar un socket en el array ’arr[]’ de un grupo de fanout. El nuevo registro no es limpiado por ’fanout_release()’, dejando un puntero colgante en el array de fanout.\n’packet_release()’ NO pone a cero ’po -> num’ en su sección ’bind_lock’. Después de liberar ’bind_lock’, ’po -> num’ sigue siendo distinto de cero y ’po -> ifindex’ sigue coincidiendo con el dispositivo enlazado. Un ’packet_notifier(NETDEV_UP)’ concurrente que ya encontró el socket en ’sklist’ puede volver a registrar el hook.\nPara sockets de fanout, este nuevo registro llama a ’__fanout_link(sk, po)’ que añade el socket de nuevo a ’f -> arr[]’ e incrementa ’f -> num_members’, pero NO incrementa ’f -> sk_ref’.\n\nLa corrección pone ’po -> num’ a cero en ’packet_release’ mientras ’bind_lock’ está retenido para evitar que NETDEV_UP enlace, previniendo la ventana de carrera.\n\nEste error fue encontrado tras una auditoría adicional con Claude Code basado en CVE-2025-38617."}],"id":"CVE-2026-31504","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:18.282904Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:49.040","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1b4c03f8892d955385c202009af7485364731bb9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/42156f93d123436f2a27c468f18c966b7e5db796"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/42cfd7898eeed290c9fb73f732af1f7d6b0a703e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/654386baef228c2992dbf604c819e4c7c35fc71b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75fe6db23705a1d55160081f7b37db9665b1880b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ceccbfc6de720ad633519a226715989cfb065af1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d0c7cdc15fdf8c4f91aca1928e52295d175b6ec6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee642b1962caa9aa231c01abbd58bc453ae6b66e"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31505.json b/data/2026/CVE-2026-31505.json index d3d64bd350..25458389b4 100644 --- a/data/2026/CVE-2026-31505.json +++ b/data/2026/CVE-2026-31505.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/intel/iavf/iavf_ethtool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"20a31b84b3e3af21bbb2628fdad185b1f274a5f5","status":"affected","version":"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d","versionType":"git"},{"lessThan":"d5dcca707f56c46582486d783c1eca2323189111","status":"affected","version":"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d","versionType":"git"},{"lessThan":"1f931dee5b726df1940348ec31614d64bac03aa6","status":"affected","version":"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d","versionType":"git"},{"lessThan":"bb85741d2dc2be207353a412f51b83697fcbefcf","status":"affected","version":"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d","versionType":"git"},{"lessThan":"fdf902bf86a80bf15792a1d20a67a5302498d7f1","status":"affected","version":"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d","versionType":"git"},{"lessThan":"fecacfc95f195b99c71c579a472120d0b4ed65fa","status":"affected","version":"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/intel/iavf/iavf_ethtool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"803A2BAF-5A16-46AC-B6F6-5128B48C13FF","versionEndExcluding":"6.12.80","versionStartIncluding":"5.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*","matchCriteriaId":"A59F7FD3-F505-48BD-8875-F07A33F42F6C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we should use num_tx_queues instead.\n\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\niavf_get_sset_count() and iavf_get_stat_strings() use\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\n\"ethtool -L\" and \"ethtool -S\" simultaneously [1].\n\nFor example when we change channels from 1 to 8, Thread 3 could be\nscheduled before Thread 2, and out-of-bounds writes could be triggered\nin Thread 3:\n\nThread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n-> num_active_queues = 8\niavf_schedule_finish_config()\n iavf_get_sset_count()\n real_num_tx_queues: 1\n -> buffer for 1 queue\n iavf_get_ethtool_stats()\n num_active_queues: 8\n -> out-of-bounds!\n iavf_finish_config()\n -> real_num_tx_queues = 8\n\nUse immutable num_tx_queues in all related functions to avoid the issue.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n \n dump_stack_lvl+0x6f/0xb0\n print_report+0x170/0x4f3\n kasan_report+0xe1/0x180\n iavf_add_one_ethtool_stat+0x200/0x270\n iavf_get_ethtool_stats+0x14c/0x2e0\n __dev_ethtool+0x3d0c/0x5830\n dev_ethtool+0x12d/0x270\n dev_ioctl+0x53c/0xe30\n sock_do_ioctl+0x1a9/0x270\n sock_ioctl+0x3d4/0x5e0\n __x64_sys_ioctl+0x137/0x1c0\n do_syscall_64+0xf3/0x690\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f7da0e6e36d\n ...\n \n\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff88813a013de0 pfn:0x13a013\n flags: 0x200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8"}],"id":"CVE-2026-31505","lastModified":"2026-10-30T13:18:40.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31505","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:20.590718Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:49.233","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/20a31b84b3e3af21bbb2628fdad185b1f274a5f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d5dcca707f56c46582486d783c1eca2323189111"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/intel/iavf/iavf_ethtool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"20a31b84b3e3af21bbb2628fdad185b1f274a5f5","status":"affected","version":"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d","versionType":"git"},{"lessThan":"d5dcca707f56c46582486d783c1eca2323189111","status":"affected","version":"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d","versionType":"git"},{"lessThan":"1f931dee5b726df1940348ec31614d64bac03aa6","status":"affected","version":"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d","versionType":"git"},{"lessThan":"bb85741d2dc2be207353a412f51b83697fcbefcf","status":"affected","version":"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d","versionType":"git"},{"lessThan":"fdf902bf86a80bf15792a1d20a67a5302498d7f1","status":"affected","version":"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d","versionType":"git"},{"lessThan":"fecacfc95f195b99c71c579a472120d0b4ed65fa","status":"affected","version":"64430f70ba6fcd5872ac190f4ae3ddee3f48f00d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/intel/iavf/iavf_ethtool.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"803A2BAF-5A16-46AC-B6F6-5128B48C13FF","versionEndExcluding":"6.12.80","versionStartIncluding":"5.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:*","matchCriteriaId":"A59F7FD3-F505-48BD-8875-F07A33F42F6C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we should use num_tx_queues instead.\n\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\niavf_get_sset_count() and iavf_get_stat_strings() use\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\n\"ethtool -L\" and \"ethtool -S\" simultaneously [1].\n\nFor example when we change channels from 1 to 8, Thread 3 could be\nscheduled before Thread 2, and out-of-bounds writes could be triggered\nin Thread 3:\n\nThread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n-> num_active_queues = 8\niavf_schedule_finish_config()\n iavf_get_sset_count()\n real_num_tx_queues: 1\n -> buffer for 1 queue\n iavf_get_ethtool_stats()\n num_active_queues: 8\n -> out-of-bounds!\n iavf_finish_config()\n -> real_num_tx_queues = 8\n\nUse immutable num_tx_queues in all related functions to avoid the issue.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n \n dump_stack_lvl+0x6f/0xb0\n print_report+0x170/0x4f3\n kasan_report+0xe1/0x180\n iavf_add_one_ethtool_stat+0x200/0x270\n iavf_get_ethtool_stats+0x14c/0x2e0\n __dev_ethtool+0x3d0c/0x5830\n dev_ethtool+0x12d/0x270\n dev_ioctl+0x53c/0xe30\n sock_do_ioctl+0x1a9/0x270\n sock_ioctl+0x3d4/0x5e0\n __x64_sys_ioctl+0x137/0x1c0\n do_syscall_64+0xf3/0x690\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f7da0e6e36d\n ...\n \n\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff88813a013de0 pfn:0x13a013\n flags: 0x200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niavf: corrección de escrituras fuera de límites en iavf_get_ethtool_stats()\n\niavf utiliza incorrectamente real_num_tx_queues para ETH_SS_STATS. Dado que el valor podría cambiar en tiempo de ejecución, deberíamos usar num_tx_queues en su lugar.\n\nAdemás, iavf_get_ethtool_stats() utiliza num_active_queues mientras que iavf_get_sset_count() y iavf_get_stat_strings() utilizan real_num_tx_queues, lo que desencadena escrituras fuera de límites cuando ejecutamos ’ethtool -L’ y ’ethtool -S’ simultáneamente [1].\n\nPor ejemplo, cuando cambiamos los canales de 1 a 8, el Hilo 3 podría ser programado antes que el Hilo 2, y se podrían desencadenar escrituras fuera de límites en el Hilo 3:\n\nHilo 1 (ethtool -L) Hilo 2 (trabajo) Hilo 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n -> num_active_queues = 8\niavf_schedule_finish_config()\n iavf_get_sset_count()\n real_num_tx_queues: 1\n -> búfer para 1 cola\n iavf_get_ethtool_stats()\n num_active_queues: 8\n -> ¡fuera de límites!\n iavf_finish_config()\n -> real_num_tx_queues = 8\n\nUsar num_tx_queues inmutable en todas las funciones relacionadas para evitar el problema.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds en iavf_add_one_ethtool_stat+0x200/0x270\n Escritura de tamaño 8 en la dirección ffffc900031c9080 por la tarea ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Traza de Llamadas:\n [TAREA]\n dump_stack_lvl+0x6f/0xb0\n print_report+0x170/0x4f3\n kasan_report+0xe1/0x180\n iavf_add_one_ethtool_stat+0x200/0x270\n iavf_get_ethtool_stats+0x14c/0x2e0\n __dev_ethtool+0x 3d0c/0x 5830\n dev_ethtool+0x12d/0x270\n dev_ioctl+0x53c/0xe30\n sock_do_ioctl+0x1a9/0x270\n sock_ioctl+0x3d4/0x5e0\n __x64_sys_ioctl+0x137/0x1c0\n do_syscall_64+0xf3/0x690\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x 7f7da0e6e36d\n ...\n [/TAREA]\n\n La dirección errónea pertenece a una región vmalloc de 1 página que comienza en 0x ffffc900031c9000 asignada en __dev_ethtool+0x 3cc9/0x 5830\n La dirección errónea pertenece a la página física: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0x ffff88813a013de0 pfn:0x 13a013\n flags: 0x 200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n página volcada porque: kasan: acceso incorrecto detectado\n\n Estado de la memoria alrededor de la dirección errónea:\n ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n >ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8"}],"id":"CVE-2026-31505","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31505","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:20.590718Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:49.233","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/20a31b84b3e3af21bbb2628fdad185b1f274a5f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d5dcca707f56c46582486d783c1eca2323189111"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31506.json b/data/2026/CVE-2026-31506.json index 77034d9728..905f8e537c 100644 --- a/data/2026/CVE-2026-31506.json +++ b/data/2026/CVE-2026-31506.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/broadcom/asp2/bcmasp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c5e2de193831ab9610a1ca542507f75d126f09b5","status":"affected","version":"a2f0751206b03374f6d02f89c18a60f1bb238fea","versionType":"git"},{"lessThan":"121a6ad9cd42ba3bfc57deae93e3326515c2afe1","status":"affected","version":"a2f0751206b03374f6d02f89c18a60f1bb238fea","versionType":"git"},{"lessThan":"9e5f5c07cc7d66522f8c9676c28605eba5d4a20e","status":"affected","version":"a2f0751206b03374f6d02f89c18a60f1bb238fea","versionType":"git"},{"lessThan":"8a30509ce6a29bdf18e0802383c524a7b2357ec0","status":"affected","version":"a2f0751206b03374f6d02f89c18a60f1bb238fea","versionType":"git"},{"lessThan":"cbfa5be2bf64511d49b854a0f9fd6d0b5118621f","status":"affected","version":"a2f0751206b03374f6d02f89c18a60f1bb238fea","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/broadcom/asp2/bcmasp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"335C19E6-705A-477D-9011-580DF15CBF75","versionEndExcluding":"6.12.80","versionStartIncluding":"6.6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:*","matchCriteriaId":"E346B162-D566-4E62-ABDE-ECBFB21B8BFD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmasp: fix double free of WoL irq\n\nWe do not need to free wol_irq since it was instantiated with\ndevm_request_irq(). So devres will free for us."}],"id":"CVE-2026-31506","lastModified":"2026-10-21T13:18:38.483","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:49.397","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/121a6ad9cd42ba3bfc57deae93e3326515c2afe1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a30509ce6a29bdf18e0802383c524a7b2357ec0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e5f5c07cc7d66522f8c9676c28605eba5d4a20e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c5e2de193831ab9610a1ca542507f75d126f09b5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cbfa5be2bf64511d49b854a0f9fd6d0b5118621f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/broadcom/asp2/bcmasp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c5e2de193831ab9610a1ca542507f75d126f09b5","status":"affected","version":"a2f0751206b03374f6d02f89c18a60f1bb238fea","versionType":"git"},{"lessThan":"121a6ad9cd42ba3bfc57deae93e3326515c2afe1","status":"affected","version":"a2f0751206b03374f6d02f89c18a60f1bb238fea","versionType":"git"},{"lessThan":"9e5f5c07cc7d66522f8c9676c28605eba5d4a20e","status":"affected","version":"a2f0751206b03374f6d02f89c18a60f1bb238fea","versionType":"git"},{"lessThan":"8a30509ce6a29bdf18e0802383c524a7b2357ec0","status":"affected","version":"a2f0751206b03374f6d02f89c18a60f1bb238fea","versionType":"git"},{"lessThan":"cbfa5be2bf64511d49b854a0f9fd6d0b5118621f","status":"affected","version":"a2f0751206b03374f6d02f89c18a60f1bb238fea","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/broadcom/asp2/bcmasp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"335C19E6-705A-477D-9011-580DF15CBF75","versionEndExcluding":"6.12.80","versionStartIncluding":"6.6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:*","matchCriteriaId":"E346B162-D566-4E62-ABDE-ECBFB21B8BFD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmasp: fix double free of WoL irq\n\nWe do not need to free wol_irq since it was instantiated with\ndevm_request_irq(). So devres will free for us."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: bcmasp: corrige la doble liberación de la IRQ de WoL\n\nNo necesitamos liberar wol_irq ya que fue instanciada con devm_request_irq(). Por lo tanto, devres la liberará por nosotros."}],"id":"CVE-2026-31506","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:49.397","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/121a6ad9cd42ba3bfc57deae93e3326515c2afe1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a30509ce6a29bdf18e0802383c524a7b2357ec0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e5f5c07cc7d66522f8c9676c28605eba5d4a20e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c5e2de193831ab9610a1ca542507f75d126f09b5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cbfa5be2bf64511d49b854a0f9fd6d0b5118621f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31507.json b/data/2026/CVE-2026-31507.json index f280d04062..fac071b91a 100644 --- a/data/2026/CVE-2026-31507.json +++ b/data/2026/CVE-2026-31507.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/smc/smc_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7e8916f46c2f48607f907fd401590093753a6bc5","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"ae5575e660410c8d2c5d38fb28a0f37aea945676","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"98ba5cb274768146e25ffbfde47753652c1c20d3","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"81acbd345d405994875d419d43b319fee0b9ad62","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"7bcb974c771c863e8588cea0012ac204443a7126","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"54c87a730157868543ebdfa0ecb21b4590ed23a5","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"3cc76380fea749280c026f410af56a28aaac388a","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"24dd586bb4cbba1889a50abe74143817a095c1c9","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/smc/smc_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.18"},{"lessThan":"4.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"874956BE-5D82-4514-AA62-A1CCA27A0891","versionEndExcluding":"5.10.253","versionStartIncluding":"4.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.18:-:*:*:*:*:*:*","matchCriteriaId":"6AE7DC47-EAFA-42D5-BCF5-C7039EE3D771","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer\n\nsmc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores\nthe pointer in pipe_buffer.private. The pipe_buf_operations for these\nbuffers used .get = generic_pipe_buf_get, which only increments the page\nreference count when tee(2) duplicates a pipe buffer. The smc_spd_priv\npointer itself was not handled, so after tee() both the original and the\ncloned pipe_buffer share the same smc_spd_priv *.\n\nWhen both pipes are subsequently released, smc_rx_pipe_buf_release() is\ncalled twice against the same object:\n\n 1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct]\n 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]\n\nKASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which\nthen escalates to a NULL-pointer dereference and kernel panic via\nsmc_rx_update_consumer() when it chases the freed priv->smc pointer:\n\n BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0\n Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74\n Call Trace:\n \n dump_stack_lvl+0x53/0x70\n print_report+0xce/0x650\n kasan_report+0xc6/0x100\n smc_rx_pipe_buf_release+0x78/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n\n BUG: kernel NULL pointer dereference, address: 0000000000000020\n RIP: 0010:smc_rx_update_consumer+0x8d/0x350\n Call Trace:\n \n smc_rx_pipe_buf_release+0x121/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n Kernel panic - not syncing: Fatal exception\n\nBeyond the memory-safety problem, duplicating an SMC splice buffer is\nsemantically questionable: smc_rx_update_cons() would advance the\nconsumer cursor twice for the same data, corrupting receive-window\naccounting. A refcount on smc_spd_priv could fix the double-free, but\nthe cursor-accounting issue would still need to be addressed separately.\n\nThe .get callback is invoked by both tee(2) and splice_pipe_to_pipe()\nfor partial transfers; both will now return -EFAULT. Users who need\nto duplicate SMC socket data must use a copy-based read path."}],"id":"CVE-2026-31507","lastModified":"2026-11-10T13:18:57.623","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:23.030558Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:49.523","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/24dd586bb4cbba1889a50abe74143817a095c1c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3cc76380fea749280c026f410af56a28aaac388a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/54c87a730157868543ebdfa0ecb21b4590ed23a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7bcb974c771c863e8588cea0012ac204443a7126"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e8916f46c2f48607f907fd401590093753a6bc5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/81acbd345d405994875d419d43b319fee0b9ad62"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98ba5cb274768146e25ffbfde47753652c1c20d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ae5575e660410c8d2c5d38fb28a0f37aea945676"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/smc/smc_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7e8916f46c2f48607f907fd401590093753a6bc5","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"ae5575e660410c8d2c5d38fb28a0f37aea945676","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"98ba5cb274768146e25ffbfde47753652c1c20d3","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"81acbd345d405994875d419d43b319fee0b9ad62","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"7bcb974c771c863e8588cea0012ac204443a7126","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"54c87a730157868543ebdfa0ecb21b4590ed23a5","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"3cc76380fea749280c026f410af56a28aaac388a","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"},{"lessThan":"24dd586bb4cbba1889a50abe74143817a095c1c9","status":"affected","version":"9014db202cb764b8e14c53e7bacc81f9a1a2ba7f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/smc/smc_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.18"},{"lessThan":"4.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"874956BE-5D82-4514-AA62-A1CCA27A0891","versionEndExcluding":"5.10.253","versionStartIncluding":"4.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.18:-:*:*:*:*:*:*","matchCriteriaId":"6AE7DC47-EAFA-42D5-BCF5-C7039EE3D771","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer\n\nsmc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores\nthe pointer in pipe_buffer.private. The pipe_buf_operations for these\nbuffers used .get = generic_pipe_buf_get, which only increments the page\nreference count when tee(2) duplicates a pipe buffer. The smc_spd_priv\npointer itself was not handled, so after tee() both the original and the\ncloned pipe_buffer share the same smc_spd_priv *.\n\nWhen both pipes are subsequently released, smc_rx_pipe_buf_release() is\ncalled twice against the same object:\n\n 1st call: kfree(priv) sock_put(sk) smc_rx_update_cons() [correct]\n 2nd call: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]\n\nKASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which\nthen escalates to a NULL-pointer dereference and kernel panic via\nsmc_rx_update_consumer() when it chases the freed priv->smc pointer:\n\n BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0\n Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74\n Call Trace:\n \n dump_stack_lvl+0x53/0x70\n print_report+0xce/0x650\n kasan_report+0xc6/0x100\n smc_rx_pipe_buf_release+0x78/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n\n BUG: kernel NULL pointer dereference, address: 0000000000000020\n RIP: 0010:smc_rx_update_consumer+0x8d/0x350\n Call Trace:\n \n smc_rx_pipe_buf_release+0x121/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \n Kernel panic - not syncing: Fatal exception\n\nBeyond the memory-safety problem, duplicating an SMC splice buffer is\nsemantically questionable: smc_rx_update_cons() would advance the\nconsumer cursor twice for the same data, corrupting receive-window\naccounting. A refcount on smc_spd_priv could fix the double-free, but\nthe cursor-accounting issue would still need to be addressed separately.\n\nThe .get callback is invoked by both tee(2) and splice_pipe_to_pipe()\nfor partial transfers; both will now return -EFAULT. Users who need\nto duplicate SMC socket data must use a copy-based read path."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/smc: solucionar la doble liberación de smc_spd_priv cuando tee() duplica el búfer de tubería de empalme\n\nsmc_rx_splice() asigna un smc_spd_priv por pipe_buffer y almacena el puntero en pipe_buffer.private. Las pipe_buf_operations para estos búferes utilizaban .get = generic_pipe_buf_get, que solo incrementa el contador de referencias de página cuando tee(2) duplica un búfer de tubería. El puntero smc_spd_priv en sí no se manejaba, así que después de tee() tanto el pipe_buffer original como el clonado comparten el mismo smc_spd_priv *.\n\nCuando ambas tuberías son liberadas posteriormente, smc_rx_pipe_buf_release() es llamada dos veces contra el mismo objeto:\n\n 1ª llamada: kfree(priv) sock_put(sk) smc_rx_update_cons() [correcto]\n 2ª llamada: kfree(priv) sock_put(sk) smc_rx_update_cons() [UAF]\n\nKASAN informa de un uso después de liberación de slab en smc_rx_pipe_buf_release(), que luego escala a una desreferencia de puntero NULL y un pánico del kernel a través de smc_rx_update_consumer() cuando persigue el puntero priv -> smc liberado:\n\n ERROR: KASAN: uso después de liberación de slab en smc_rx_pipe_buf_release+0x78/0x2a0\n Lectura de tamaño 8 en la dirección ffff888004a45740 por la tarea smc_splice_tee_/74\n Rastro de Llamada:\n [TAREA]\n dump_stack_lvl+0x53/0x70\n print_report+0xce/0x650\n kasan_report+0xc6/0x100\n smc_rx_pipe_buf_release+0x78/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n [/TAREA]\n\n ERROR: desreferencia de puntero NULL del kernel, dirección: 0000000000000020\n RIP: 0010:smc_rx_update_consumer+0x8d/0x350\n Rastro de Llamada:\n [TAREA]\n smc_rx_pipe_buf_release+0x121/0x2a0\n free_pipe_info+0xd4/0x130\n pipe_release+0x142/0x160\n __fput+0x1c6/0x490\n __x64_sys_close+0x4f/0x90\n do_syscall_64+0xa6/0x1a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n [/TAREA]\n Pánico del kernel - no sincronizando: Excepción fatal\n\nMás allá del problema de seguridad de la memoria, duplicar un búfer de empalme SMC es semánticamente cuestionable: smc_rx_update_cons() avanzaría el cursor del consumidor dos veces para los mismos datos, corrompiendo la contabilidad de la ventana de recepción. Un contador de referencias en smc_spd_priv podría solucionar la doble liberación, pero el problema de contabilidad del cursor aún necesitaría ser abordado por separado.\n\nLa devolución de llamada .get es invocada tanto por tee(2) como por splice_pipe_to_pipe() para transferencias parciales; ambos ahora devolverán -EFAULT. Los usuarios que necesiten duplicar datos de socket SMC deben usar una ruta de lectura basada en copia."}],"id":"CVE-2026-31507","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:23.030558Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:49.523","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/24dd586bb4cbba1889a50abe74143817a095c1c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3cc76380fea749280c026f410af56a28aaac388a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/54c87a730157868543ebdfa0ecb21b4590ed23a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7bcb974c771c863e8588cea0012ac204443a7126"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e8916f46c2f48607f907fd401590093753a6bc5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/81acbd345d405994875d419d43b319fee0b9ad62"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98ba5cb274768146e25ffbfde47753652c1c20d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ae5575e660410c8d2c5d38fb28a0f37aea945676"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31508.json b/data/2026/CVE-2026-31508.json index 8b40dd6c1c..b1ce26e401 100644 --- a/data/2026/CVE-2026-31508.json +++ b/data/2026/CVE-2026-31508.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/openvswitch/vport-netdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"df3c95be76103604e752131d9495a24814915ece","status":"affected","version":"b823c3344d5446b720227ba561df10a4f0add515","versionType":"git"},{"lessThan":"33609454be4f582e686a4bf13d4482a5ca0f6c4b","status":"affected","version":"052e5db5be4576e0a8ef1460b210da5f328f4cd1","versionType":"git"},{"lessThan":"5fdeaf591a0942772c2d18ff3563697a49ad01c6","status":"affected","version":"c98263d5ace597c096a7a60aeef790da7b54979e","versionType":"git"},{"lessThan":"4c3e25a7b711a402fcbbbcfbbdf2868ece1ae7c8","status":"affected","version":"0fc642f011cb7a7eff41109e66d3b552e9f4d795","versionType":"git"},{"lessThan":"43579baa17270aa51f93eb09b6e4af6e047b7f6e","status":"affected","version":"5116f61ab11846844585c9082c547c4ccd97ff1a","versionType":"git"},{"lessThan":"95265232b49765a4d00f4d028c100bb7185600f4","status":"affected","version":"f31557fb1b35332cca9994aa196cef284bcf3807","versionType":"git"},{"lessThan":"755a6300afbd743cda4b102f24f343380ec0e0ff","status":"affected","version":"5498227676303e3ffa9a3a46214af96bc3e81314","versionType":"git"},{"lessThan":"7c770dadfda5cbbde6aa3c4363ed513f1d212bf8","status":"affected","version":"5498227676303e3ffa9a3a46214af96bc3e81314","versionType":"git"},{"lessThan":"5.10.253","status":"affected","version":"5.10.248","versionType":"semver"},{"lessThan":"5.15.203","status":"affected","version":"5.15.198","versionType":"semver"},{"lessThan":"6.1.168","status":"affected","version":"6.1.160","versionType":"semver"},{"lessThan":"6.6.131","status":"affected","version":"6.6.120","versionType":"semver"},{"lessThan":"6.12.80","status":"affected","version":"6.12.64","versionType":"semver"},{"lessThan":"6.18.21","status":"affected","version":"6.18.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/openvswitch/vport-netdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67C98AD5-FDF4-4C3D-8586-EF066B293142","versionEndExcluding":"5.10.253","versionStartIncluding":"5.10.248","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"88BCF667-EE57-4C4B-B51C-2DAE21C7E1D1","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.198","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A2FCFC28-0157-47BF-857F-94E9485D82C5","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.160","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5A5BC13A-216B-45C3-A63E-D66C3FECFE85","versionEndExcluding":"6.6.131","versionStartIncluding":"6.6.120","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4EF57E93-A026-4007-A858-468FDFFFE29B","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"55A4CBF7-9C28-493F-9DA4-0F0817C98013","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5054C854-C253-4020-BD2E-2BDA121E424C","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: Avoid releasing netdev before teardown completes\n\nThe patch cited in the Fixes tag below changed the teardown code for\nOVS ports to no longer unconditionally take the RTNL. After this change,\nthe netdev_destroy() callback can proceed immediately to the call_rcu()\ninvocation if the IFF_OVS_DATAPATH flag is already cleared on the\nnetdev.\n\nThe ovs_netdev_detach_dev() function clears the flag before completing\nthe unregistration, and if it gets preempted after clearing the flag (as\ncan happen on an -rt kernel), netdev_destroy() can complete and the\ndevice can be freed before the unregistration completes. This leads to a\nsplat like:\n\n[ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI\n[ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT\n[ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025\n[ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0\n[ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90\n[ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246\n[ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000\n[ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05\n[ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000\n[ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006\n[ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000\n[ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000\n[ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0\n[ 998.393944] PKRU: 55555554\n[ 998.393946] Call Trace:\n[ 998.393949] \n[ 998.393952] ? show_trace_log_lvl+0x1b0/0x2f0\n[ 998.393961] ? show_trace_log_lvl+0x1b0/0x2f0\n[ 998.393975] ? dp_device_event+0x41/0x80 [openvswitch]\n[ 998.394009] ? __die_body.cold+0x8/0x12\n[ 998.394016] ? die_addr+0x3c/0x60\n[ 998.394027] ? exc_general_protection+0x16d/0x390\n[ 998.394042] ? asm_exc_general_protection+0x26/0x30\n[ 998.394058] ? dev_set_promiscuity+0x8d/0xa0\n[ 998.394066] ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch]\n[ 998.394092] dp_device_event+0x41/0x80 [openvswitch]\n[ 998.394102] notifier_call_chain+0x5a/0xd0\n[ 998.394106] unregister_netdevice_many_notify+0x51b/0xa60\n[ 998.394110] rtnl_dellink+0x169/0x3e0\n[ 998.394121] ? rt_mutex_slowlock.constprop.0+0x95/0xd0\n[ 998.394125] rtnetlink_rcv_msg+0x142/0x3f0\n[ 998.394128] ? avc_has_perm_noaudit+0x69/0xf0\n[ 998.394130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10\n[ 998.394132] netlink_rcv_skb+0x50/0x100\n[ 998.394138] netlink_unicast+0x292/0x3f0\n[ 998.394141] netlink_sendmsg+0x21b/0x470\n[ 998.394145] ____sys_sendmsg+0x39d/0x3d0\n[ 998.394149] ___sys_sendmsg+0x9a/0xe0\n[ 998.394156] __sys_sendmsg+0x7a/0xd0\n[ 998.394160] do_syscall_64+0x7f/0x170\n[ 998.394162] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 998.394165] RIP: 0033:0x7fad61bf4724\n[ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89\n[ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e\n[ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724\n[ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003\n[ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f\n[ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2\n---truncated---"}],"id":"CVE-2026-31508","lastModified":"2026-11-10T13:18:57.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31508","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:25.586164Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:49.727","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33609454be4f582e686a4bf13d4482a5ca0f6c4b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/43579baa17270aa51f93eb09b6e4af6e047b7f6e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c3e25a7b711a402fcbbbcfbbdf2868ece1ae7c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5fdeaf591a0942772c2d18ff3563697a49ad01c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/755a6300afbd743cda4b102f24f343380ec0e0ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7c770dadfda5cbbde6aa3c4363ed513f1d212bf8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95265232b49765a4d00f4d028c100bb7185600f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df3c95be76103604e752131d9495a24814915ece"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/openvswitch/vport-netdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"df3c95be76103604e752131d9495a24814915ece","status":"affected","version":"b823c3344d5446b720227ba561df10a4f0add515","versionType":"git"},{"lessThan":"33609454be4f582e686a4bf13d4482a5ca0f6c4b","status":"affected","version":"052e5db5be4576e0a8ef1460b210da5f328f4cd1","versionType":"git"},{"lessThan":"5fdeaf591a0942772c2d18ff3563697a49ad01c6","status":"affected","version":"c98263d5ace597c096a7a60aeef790da7b54979e","versionType":"git"},{"lessThan":"4c3e25a7b711a402fcbbbcfbbdf2868ece1ae7c8","status":"affected","version":"0fc642f011cb7a7eff41109e66d3b552e9f4d795","versionType":"git"},{"lessThan":"43579baa17270aa51f93eb09b6e4af6e047b7f6e","status":"affected","version":"5116f61ab11846844585c9082c547c4ccd97ff1a","versionType":"git"},{"lessThan":"95265232b49765a4d00f4d028c100bb7185600f4","status":"affected","version":"f31557fb1b35332cca9994aa196cef284bcf3807","versionType":"git"},{"lessThan":"755a6300afbd743cda4b102f24f343380ec0e0ff","status":"affected","version":"5498227676303e3ffa9a3a46214af96bc3e81314","versionType":"git"},{"lessThan":"7c770dadfda5cbbde6aa3c4363ed513f1d212bf8","status":"affected","version":"5498227676303e3ffa9a3a46214af96bc3e81314","versionType":"git"},{"lessThan":"5.10.253","status":"affected","version":"5.10.248","versionType":"semver"},{"lessThan":"5.15.203","status":"affected","version":"5.15.198","versionType":"semver"},{"lessThan":"6.1.168","status":"affected","version":"6.1.160","versionType":"semver"},{"lessThan":"6.6.131","status":"affected","version":"6.6.120","versionType":"semver"},{"lessThan":"6.12.80","status":"affected","version":"6.12.64","versionType":"semver"},{"lessThan":"6.18.21","status":"affected","version":"6.18.4","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/openvswitch/vport-netdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67C98AD5-FDF4-4C3D-8586-EF066B293142","versionEndExcluding":"5.10.253","versionStartIncluding":"5.10.248","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"88BCF667-EE57-4C4B-B51C-2DAE21C7E1D1","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.198","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A2FCFC28-0157-47BF-857F-94E9485D82C5","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.160","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5A5BC13A-216B-45C3-A63E-D66C3FECFE85","versionEndExcluding":"6.6.131","versionStartIncluding":"6.6.120","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4EF57E93-A026-4007-A858-468FDFFFE29B","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"55A4CBF7-9C28-493F-9DA4-0F0817C98013","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5054C854-C253-4020-BD2E-2BDA121E424C","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: Avoid releasing netdev before teardown completes\n\nThe patch cited in the Fixes tag below changed the teardown code for\nOVS ports to no longer unconditionally take the RTNL. After this change,\nthe netdev_destroy() callback can proceed immediately to the call_rcu()\ninvocation if the IFF_OVS_DATAPATH flag is already cleared on the\nnetdev.\n\nThe ovs_netdev_detach_dev() function clears the flag before completing\nthe unregistration, and if it gets preempted after clearing the flag (as\ncan happen on an -rt kernel), netdev_destroy() can complete and the\ndevice can be freed before the unregistration completes. This leads to a\nsplat like:\n\n[ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI\n[ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT\n[ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025\n[ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0\n[ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90\n[ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246\n[ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000\n[ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05\n[ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000\n[ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006\n[ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000\n[ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000\n[ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0\n[ 998.393944] PKRU: 55555554\n[ 998.393946] Call Trace:\n[ 998.393949] \n[ 998.393952] ? show_trace_log_lvl+0x1b0/0x2f0\n[ 998.393961] ? show_trace_log_lvl+0x1b0/0x2f0\n[ 998.393975] ? dp_device_event+0x41/0x80 [openvswitch]\n[ 998.394009] ? __die_body.cold+0x8/0x12\n[ 998.394016] ? die_addr+0x3c/0x60\n[ 998.394027] ? exc_general_protection+0x16d/0x390\n[ 998.394042] ? asm_exc_general_protection+0x26/0x30\n[ 998.394058] ? dev_set_promiscuity+0x8d/0xa0\n[ 998.394066] ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch]\n[ 998.394092] dp_device_event+0x41/0x80 [openvswitch]\n[ 998.394102] notifier_call_chain+0x5a/0xd0\n[ 998.394106] unregister_netdevice_many_notify+0x51b/0xa60\n[ 998.394110] rtnl_dellink+0x169/0x3e0\n[ 998.394121] ? rt_mutex_slowlock.constprop.0+0x95/0xd0\n[ 998.394125] rtnetlink_rcv_msg+0x142/0x3f0\n[ 998.394128] ? avc_has_perm_noaudit+0x69/0xf0\n[ 998.394130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10\n[ 998.394132] netlink_rcv_skb+0x50/0x100\n[ 998.394138] netlink_unicast+0x292/0x3f0\n[ 998.394141] netlink_sendmsg+0x21b/0x470\n[ 998.394145] ____sys_sendmsg+0x39d/0x3d0\n[ 998.394149] ___sys_sendmsg+0x9a/0xe0\n[ 998.394156] __sys_sendmsg+0x7a/0xd0\n[ 998.394160] do_syscall_64+0x7f/0x170\n[ 998.394162] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 998.394165] RIP: 0033:0x7fad61bf4724\n[ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89\n[ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e\n[ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724\n[ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003\n[ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f\n[ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2\n---truncated---"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: net: openvswitch: Evitar liberar netdev antes de que la finalización se complete El parche citado en la etiqueta Fixes a continuación cambió el código de finalización para los puertos OVS para ya no tomar incondicionalmente el RTNL. Después de este cambio, la devolución de llamada netdev_destroy() puede proceder inmediatamente a la invocación de call_rcu() si el indicador IFF_OVS_DATAPATH ya está borrado en el netdev. La función ovs_netdev_detach_dev() borra el indicador antes de completar el desregistro, y si es interrumpida después de borrar el indicador (como puede ocurrir en un kernel -rt), netdev_destroy() puede completarse y el dispositivo puede ser liberado antes de que el desregistro se complete. Esto lleva a un splat como: [ 998.393867] Oops: general protection fault, probably for non-canonical address 0x ff00000001000239: 0000 [#1] SMP PTI\n[ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT\n[ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025\n[ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0\n[ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 menor que 48mayor que 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90\n[ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246\n[ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000\n[ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05\n[ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000\n[ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006\n[ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000\n[ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000\n[ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0\n[ 998.393944] PKRU: 55555554\n[ 998.394165] RIP: 0033:0x 7fad61bf4724\n[ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 menor que 48mayor que 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89\n[ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e\n[ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724\n[ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003\n[ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f\n[ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2\n- - -truncated- - -"}],"id":"CVE-2026-31508","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31508","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:25.586164Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:49.727","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33609454be4f582e686a4bf13d4482a5ca0f6c4b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/43579baa17270aa51f93eb09b6e4af6e047b7f6e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c3e25a7b711a402fcbbbcfbbdf2868ece1ae7c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5fdeaf591a0942772c2d18ff3563697a49ad01c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/755a6300afbd743cda4b102f24f343380ec0e0ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7c770dadfda5cbbde6aa3c4363ed513f1d212bf8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95265232b49765a4d00f4d028c100bb7185600f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df3c95be76103604e752131d9495a24814915ece"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31509.json b/data/2026/CVE-2026-31509.json index ff5d1d9afc..e0427dfcc0 100644 --- a/data/2026/CVE-2026-31509.json +++ b/data/2026/CVE-2026-31509.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/nfc/nci/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7ed00a3edc8597fe2333f524401e2889aa1b5edf","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"5eef9ebec7f5738f12cadede3545c05b34bf5ac3","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"ca54e904a071aa65ef3ad46ba42d51aaac6b73b4","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"eb435d150ca74b4d40f77f1a2266f3636ed64a79","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"d89b74bf08f067b55c03d7f999ba0a0e73177eb3","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"09143c0e8f3b03517e6233aad42f45c794d8df8e","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"4527025d440ce84bf56e75ce1df2e84cb8178616","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/nfc/nci/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8136AA8-F2F0-4960-9AAF-176AC6ACEA92","versionEndExcluding":"5.10.253","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.2:-:*:*:*:*:*:*","matchCriteriaId":"2BEBAC7C-43AE-4D02-A957-26F89F27E0AC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: fix circular locking dependency in nci_close_device\n\nnci_close_device() flushes rx_wq and tx_wq while holding req_lock.\nThis causes a circular locking dependency because nci_rx_work()\nrunning on rx_wq can end up taking req_lock too:\n\n nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete\n -> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target\n -> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock)\n\nMove the flush of rx_wq after req_lock has been released.\nThis should safe (I think) because NCI_UP has already been cleared\nand the transport is closed, so the work will see it and return\n-ENETDOWN.\n\nNIPA has been hitting this running the nci selftest with a debug\nkernel on roughly 4% of the runs."}],"id":"CVE-2026-31509","lastModified":"2026-06-17T10:33:52.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:49.947","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09143c0e8f3b03517e6233aad42f45c794d8df8e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4527025d440ce84bf56e75ce1df2e84cb8178616"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5eef9ebec7f5738f12cadede3545c05b34bf5ac3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ed00a3edc8597fe2333f524401e2889aa1b5edf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca54e904a071aa65ef3ad46ba42d51aaac6b73b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d89b74bf08f067b55c03d7f999ba0a0e73177eb3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb435d150ca74b4d40f77f1a2266f3636ed64a79"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/nfc/nci/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7ed00a3edc8597fe2333f524401e2889aa1b5edf","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"5eef9ebec7f5738f12cadede3545c05b34bf5ac3","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"ca54e904a071aa65ef3ad46ba42d51aaac6b73b4","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"eb435d150ca74b4d40f77f1a2266f3636ed64a79","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"d89b74bf08f067b55c03d7f999ba0a0e73177eb3","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"09143c0e8f3b03517e6233aad42f45c794d8df8e","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"},{"lessThan":"4527025d440ce84bf56e75ce1df2e84cb8178616","status":"affected","version":"6a2968aaf50c7a22fced77a5e24aa636281efca8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/nfc/nci/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8136AA8-F2F0-4960-9AAF-176AC6ACEA92","versionEndExcluding":"5.10.253","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.2:-:*:*:*:*:*:*","matchCriteriaId":"2BEBAC7C-43AE-4D02-A957-26F89F27E0AC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: fix circular locking dependency in nci_close_device\n\nnci_close_device() flushes rx_wq and tx_wq while holding req_lock.\nThis causes a circular locking dependency because nci_rx_work()\nrunning on rx_wq can end up taking req_lock too:\n\n nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete\n -> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target\n -> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock)\n\nMove the flush of rx_wq after req_lock has been released.\nThis should safe (I think) because NCI_UP has already been cleared\nand the transport is closed, so the work will see it and return\n-ENETDOWN.\n\nNIPA has been hitting this running the nci selftest with a debug\nkernel on roughly 4% of the runs."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnfc: nci: corregir dependencia de bloqueo circular en nci_close_device\n\nnci_close_device() vacía rx_wq y tx_wq mientras mantiene req_lock. Esto causa una dependencia de bloqueo circular porque nci_rx_work() ejecutándose en rx_wq puede terminar tomando req_lock también:\n\nnci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete\n -> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target\n -> nci_deactivate_target -> nci_request -> mutex_lock(ref:ndev -> req_lock)\n\nMover el vaciado de rx_wq después de que req_lock haya sido liberado. Esto debería ser seguro (creo) porque NCI_UP ya ha sido borrado y el transporte está cerrado, así que el trabajo lo verá y devolverá -ENETDOWN.\n\nNIPA ha estado encontrando esto ejecutando la autoprueba nci con un kernel de depuración en aproximadamente el 4% de las ejecuciones."}],"id":"CVE-2026-31509","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:49.947","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09143c0e8f3b03517e6233aad42f45c794d8df8e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4527025d440ce84bf56e75ce1df2e84cb8178616"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5eef9ebec7f5738f12cadede3545c05b34bf5ac3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7ed00a3edc8597fe2333f524401e2889aa1b5edf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca54e904a071aa65ef3ad46ba42d51aaac6b73b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d89b74bf08f067b55c03d7f999ba0a0e73177eb3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb435d150ca74b4d40f77f1a2266f3636ed64a79"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31510.json b/data/2026/CVE-2026-31510.json index b1fd579dd4..7e29c92526 100644 --- a/data/2026/CVE-2026-31510.json +++ b/data/2026/CVE-2026-31510.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d34776c7fa1f2c510f1cdd14823aba701babb4ad","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"03d4eafb0f3788239df63575951f6b4c97bbfda4","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"3c821bc0fbeaa27910a20d0b43c6008d099792af","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"a04a760c06bb591989db659439efdf106f0bae76","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"0780f9333852971ca77d110019e3a66ce5a7b100","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"1dc6db047919ecd59493cd51248b37381bbabcbb","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"898b89c90ff9496e64b9331040778cc4e1b28c9d","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"b6552e0503973daf6f23bd6ed9273ef131ee364f","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.6"},{"lessThan":"3.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D5CD1815-AFF3-425B-8361-008DA362D428","versionEndExcluding":"5.10.253","versionStartIncluding":"3.6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.6:-:*:*:*:*:*:*","matchCriteriaId":"E7D72FF4-3906-4585-B39A-A9B194F53204","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb\n\nBefore using sk pointer, check if it is null.\n\nFix the following:\n\n KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]\n CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025\n Workqueue: events l2cap_info_timeout\n RIP: 0010:kasan_byte_accessible+0x12/0x30\n Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce\n veth0_macvtap: entered promiscuous mode\n RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001\n RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000\n R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001\n FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0\n PKRU: 55555554\n Call Trace:\n \n __kasan_check_byte+0x12/0x40\n lock_acquire+0x79/0x2e0\n lock_sock_nested+0x48/0x100\n ? l2cap_sock_ready_cb+0x46/0x160\n l2cap_sock_ready_cb+0x46/0x160\n l2cap_conn_start+0x779/0xff0\n ? __pfx_l2cap_conn_start+0x10/0x10\n ? l2cap_info_timeout+0x60/0xa0\n ? __pfx___mutex_lock+0x10/0x10\n l2cap_info_timeout+0x68/0xa0\n ? process_scheduled_works+0xa8d/0x18c0\n process_scheduled_works+0xb6e/0x18c0\n ? __pfx_process_scheduled_works+0x10/0x10\n ? assign_work+0x3d5/0x5e0\n worker_thread+0xa53/0xfc0\n kthread+0x388/0x470\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x51e/0xb90\n ? __pfx_ret_from_fork+0x10/0x10\n veth1_macvtap: entered promiscuous mode\n ? __switch_to+0xc7d/0x1450\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \n Modules linked in:\n ---[ end trace 0000000000000000 ]---\n batman_adv: batadv0: Interface activated: batadv_slave_0\n batman_adv: batadv0: Interface activated: batadv_slave_1\n netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0\n RIP: 0010:kasan_byte_accessible+0x12/0x30\n Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce\n ieee80211 phy39: Selected rate control algorithm 'minstrel_ht'\n RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001\n RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000\n R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001\n FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0\n PKRU: 55555554\n Kernel panic - not syncing: Fatal exception"}],"id":"CVE-2026-31510","lastModified":"2026-11-05T22:18:36.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31510","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:36:09.886037Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:50.130","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03d4eafb0f3788239df63575951f6b4c97bbfda4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0780f9333852971ca77d110019e3a66ce5a7b100"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1dc6db047919ecd59493cd51248b37381bbabcbb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c821bc0fbeaa27910a20d0b43c6008d099792af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/898b89c90ff9496e64b9331040778cc4e1b28c9d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a04a760c06bb591989db659439efdf106f0bae76"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b6552e0503973daf6f23bd6ed9273ef131ee364f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d34776c7fa1f2c510f1cdd14823aba701babb4ad"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d34776c7fa1f2c510f1cdd14823aba701babb4ad","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"03d4eafb0f3788239df63575951f6b4c97bbfda4","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"3c821bc0fbeaa27910a20d0b43c6008d099792af","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"a04a760c06bb591989db659439efdf106f0bae76","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"0780f9333852971ca77d110019e3a66ce5a7b100","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"1dc6db047919ecd59493cd51248b37381bbabcbb","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"898b89c90ff9496e64b9331040778cc4e1b28c9d","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"},{"lessThan":"b6552e0503973daf6f23bd6ed9273ef131ee364f","status":"affected","version":"54a59aa2b562872781d6a8fc89f300d360941691","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.6"},{"lessThan":"3.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D5CD1815-AFF3-425B-8361-008DA362D428","versionEndExcluding":"5.10.253","versionStartIncluding":"3.6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.6:-:*:*:*:*:*:*","matchCriteriaId":"E7D72FF4-3906-4585-B39A-A9B194F53204","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb\n\nBefore using sk pointer, check if it is null.\n\nFix the following:\n\n KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]\n CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025\n Workqueue: events l2cap_info_timeout\n RIP: 0010:kasan_byte_accessible+0x12/0x30\n Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce\n veth0_macvtap: entered promiscuous mode\n RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001\n RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000\n R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001\n FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0\n PKRU: 55555554\n Call Trace:\n \n __kasan_check_byte+0x12/0x40\n lock_acquire+0x79/0x2e0\n lock_sock_nested+0x48/0x100\n ? l2cap_sock_ready_cb+0x46/0x160\n l2cap_sock_ready_cb+0x46/0x160\n l2cap_conn_start+0x779/0xff0\n ? __pfx_l2cap_conn_start+0x10/0x10\n ? l2cap_info_timeout+0x60/0xa0\n ? __pfx___mutex_lock+0x10/0x10\n l2cap_info_timeout+0x68/0xa0\n ? process_scheduled_works+0xa8d/0x18c0\n process_scheduled_works+0xb6e/0x18c0\n ? __pfx_process_scheduled_works+0x10/0x10\n ? assign_work+0x3d5/0x5e0\n worker_thread+0xa53/0xfc0\n kthread+0x388/0x470\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x51e/0xb90\n ? __pfx_ret_from_fork+0x10/0x10\n veth1_macvtap: entered promiscuous mode\n ? __switch_to+0xc7d/0x1450\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \n Modules linked in:\n ---[ end trace 0000000000000000 ]---\n batman_adv: batadv0: Interface activated: batadv_slave_0\n batman_adv: batadv0: Interface activated: batadv_slave_1\n netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0\n RIP: 0010:kasan_byte_accessible+0x12/0x30\n Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce\n ieee80211 phy39: Selected rate control algorithm 'minstrel_ht'\n RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001\n RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000\n R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001\n FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0\n PKRU: 55555554\n Kernel panic - not syncing: Fatal exception"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: Bluetooth: L2CAP: Corrección de desreferencia de puntero nulo en l2cap_sock_ready_cb Antes de usar el puntero sk, verificar si es nulo. Soluciona lo siguiente: KASAN: desreferencia de puntero nulo en el rango [0x 0000000000000260-0x 0000000000000267] CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 No contaminado 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full) Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025 Cola de trabajo: events l2cap_info_timeout RIP: 0010:kasan_byte_accessible+0x12/0x30 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df menor que 0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce veth0_macvtap: entró en modo promiscuo RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0 PKRU: 55555554 Traza de llamadas: [TASK] __kasan_check_byte+0x12/0x40 lock_acquire+0x79/0x2e0 lock_sock_nested+0x48/0x100 ? l2cap_sock_ready_cb+0x46/0x160 l2cap_sock_ready_cb+0x46/0x160 l2cap_conn_start+0x779/0xff0 ? __pfx_l2cap_conn_start+0x10/0x10 ? l2cap_info_timeout+0x60/0xa0 ? __pfx___mutex_lock+0x10/0x10 l2cap_info_timeout+0x68/0xa0 ? process_scheduled_works+0xa8d/0x 18c0 process_scheduled_works+0xb6e/0x 18c0 ? __pfx_process_scheduled_works+0x10/0x10 ? assign_work+0x3d5/0x5e0 worker_thread+0xa53/0xfc0 kthread+0x388/0x470 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x51e/0xb90 ? __pfx_ret_from_fork+0x10/0x10 veth1_macvtap: entró en modo promiscuo ? __switch_to+0xc7d/0x 1450 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 [/TASK] Módulos enlazados: - - -[ fin de la traza 0000000000000000 ]- - - batman_adv: batadv0: Interfaz activada: batadv_slave_0 batman_adv: batadv0: Interfaz activada: batadv_slave_1 netdevsim netdevsim7 netdevsim0: establecer [1, 0] tipo 2 familia 0 puerto 6081 - 0 netdevsim netdevsim7 netdevsim1: establecer [1, 0] tipo 2 familia 0 puerto 6081 - 0 netdevsim netdevsim7 netdevsim2: establecer [1, 0] tipo 2 familia 0 puerto 6081 - 0 netdevsim netdevsim7 netdevsim3: establecer [1, 0] tipo 2 familia 0 puerto 6081 - 0 RIP: 0010:kasan_byte_accessible+0x12/0x30 Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df menor que 0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce ieee80211 phy39: Algoritmo de control de velocidad seleccionado ’minstrel_ht’ RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001 RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000 R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0 PKRU: 55555554 Pánico del kernel - no sincronizando: Excepción fatal"}],"id":"CVE-2026-31510","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31510","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:36:09.886037Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:50.130","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03d4eafb0f3788239df63575951f6b4c97bbfda4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0780f9333852971ca77d110019e3a66ce5a7b100"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1dc6db047919ecd59493cd51248b37381bbabcbb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c821bc0fbeaa27910a20d0b43c6008d099792af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/898b89c90ff9496e64b9331040778cc4e1b28c9d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a04a760c06bb591989db659439efdf106f0bae76"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b6552e0503973daf6f23bd6ed9273ef131ee364f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d34776c7fa1f2c510f1cdd14823aba701babb4ad"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31511.json b/data/2026/CVE-2026-31511.json index 2b19448d2e..19a281e675 100644 --- a/data/2026/CVE-2026-31511.json +++ b/data/2026/CVE-2026-31511.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2074dfffad76981ca451cb7fc98703d04ac562fe","status":"affected","version":"0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a","versionType":"git"},{"lessThan":"340666172cf747de58c283d2eef1f335f050538b","status":"affected","version":"d71b98f253b079cbadc83266383f26fe7e9e103b","versionType":"git"},{"lessThan":"bafec9325d4de26b6c49db75b5d5172de652aae0","status":"affected","version":"302a1f674c00dd5581ab8e493ef44767c5101aab","versionType":"git"},{"lessThan":"3a89c33deffb3cb7877a7ea2e50734cd12b064f2","status":"affected","version":"302a1f674c00dd5581ab8e493ef44767c5101aab","versionType":"git"},{"lessThan":"5f5fa4cd35f707344f65ce9e225b6528691dbbaa","status":"affected","version":"302a1f674c00dd5581ab8e493ef44767c5101aab","versionType":"git"},{"status":"affected","version":"87a1f16f07c6c43771754075e08f45b41d237421","versionType":"git"},{"lessThan":"6.12.80","status":"affected","version":"6.12.59","versionType":"semver"},{"lessThan":"6.17","status":"affected","version":"6.16.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2E3E9EB4-7DEE-45DF-B63A-FE5F72A20A3F","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.59","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1C91278E-7FC3-4EFB-AE2C-E82D42F4D3AA","versionEndExcluding":"6.17","versionStartIncluding":"6.16.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"44CB3599-9974-4F35-B3CC-580CAC6FA38B","versionEndExcluding":"6.18.21","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete\n\nThis fixes the condition checking so mgmt_pending_valid is executed\nwhenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd)\nwould kfree(cmd) without unlinking it from the list first, leaving a\ndangling pointer. Any subsequent list traversal (e.g.,\nmgmt_pending_foreach during __mgmt_power_off, or another\nmgmt_pending_valid call) would dereference freed memory."}],"id":"CVE-2026-31511","lastModified":"2026-10-19T19:17:58.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31511","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:27.942863Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:50.343","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2074dfffad76981ca451cb7fc98703d04ac562fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/340666172cf747de58c283d2eef1f335f050538b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a89c33deffb3cb7877a7ea2e50734cd12b064f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5f5fa4cd35f707344f65ce9e225b6528691dbbaa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bafec9325d4de26b6c49db75b5d5172de652aae0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2074dfffad76981ca451cb7fc98703d04ac562fe","status":"affected","version":"0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a","versionType":"git"},{"lessThan":"340666172cf747de58c283d2eef1f335f050538b","status":"affected","version":"d71b98f253b079cbadc83266383f26fe7e9e103b","versionType":"git"},{"lessThan":"bafec9325d4de26b6c49db75b5d5172de652aae0","status":"affected","version":"302a1f674c00dd5581ab8e493ef44767c5101aab","versionType":"git"},{"lessThan":"3a89c33deffb3cb7877a7ea2e50734cd12b064f2","status":"affected","version":"302a1f674c00dd5581ab8e493ef44767c5101aab","versionType":"git"},{"lessThan":"5f5fa4cd35f707344f65ce9e225b6528691dbbaa","status":"affected","version":"302a1f674c00dd5581ab8e493ef44767c5101aab","versionType":"git"},{"status":"affected","version":"87a1f16f07c6c43771754075e08f45b41d237421","versionType":"git"},{"lessThan":"6.12.80","status":"affected","version":"6.12.59","versionType":"semver"},{"lessThan":"6.17","status":"affected","version":"6.16.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2E3E9EB4-7DEE-45DF-B63A-FE5F72A20A3F","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.59","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1C91278E-7FC3-4EFB-AE2C-E82D42F4D3AA","versionEndExcluding":"6.17","versionStartIncluding":"6.16.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"44CB3599-9974-4F35-B3CC-580CAC6FA38B","versionEndExcluding":"6.18.21","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete\n\nThis fixes the condition checking so mgmt_pending_valid is executed\nwhenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd)\nwould kfree(cmd) without unlinking it from the list first, leaving a\ndangling pointer. Any subsequent list traversal (e.g.,\nmgmt_pending_foreach during __mgmt_power_off, or another\nmgmt_pending_valid call) would dereference freed memory."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: MGMT: Corrección de puntero colgante en mgmt_add_adv_patterns_monitor_complete\n\nEsto corrige la comprobación de la condición para que mgmt_pending_valid se ejecute siempre que status != -ECANCELED; de lo contrario, llamar a mgmt_pending_free(cmd) haría kfree(cmd) sin desvincularlo de la lista primero, dejando un puntero colgante. Cualquier recorrido de lista posterior (por ejemplo, mgmt_pending_foreach durante __mgmt_power_off, o otra llamada a mgmt_pending_valid) desreferenciaría memoria liberada."}],"id":"CVE-2026-31511","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31511","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:27.942863Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:50.343","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2074dfffad76981ca451cb7fc98703d04ac562fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/340666172cf747de58c283d2eef1f335f050538b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a89c33deffb3cb7877a7ea2e50734cd12b064f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5f5fa4cd35f707344f65ce9e225b6528691dbbaa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bafec9325d4de26b6c49db75b5d5172de652aae0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31512.json b/data/2026/CVE-2026-31512.json index 85e5809d84..3e4be36a29 100644 --- a/data/2026/CVE-2026-31512.json +++ b/data/2026/CVE-2026-31512.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cef09691cfb61f6c91cc27c3d69634f81c8ab949","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"3340be2bafdcc806f048273ea6d8e82a6597aa1b","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"e47315b84d0eb188772c3ff5cf073cdbdefca6b4","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"477ad4976072056c348937e94f24583321938df4","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"40c7f7eea2f4d9cb0b3e924254c8c9053372168f","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"8c96f3bd4ae0802db90630be8e9851827e9c9209","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"5ad981249be52f5e4e92e0e97b436b569071cb86","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"c65bd945d1c08c3db756821b6bf9f1c4a77b29c6","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.14"},{"lessThan":"3.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96775134-B6E9-42CE-A367-9B4C33EFBF22","versionEndExcluding":"5.10.253","versionStartIncluding":"3.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.14:-:*:*:*:*:*:*","matchCriteriaId":"851B1505-0318-49F4-8D7C-196BE04FF173","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()\n\nl2cap_ecred_data_rcv() reads the SDU length field from skb->data using\nget_unaligned_le16() without first verifying that skb contains at least\nL2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads\npast the valid data in the skb.\n\nThe ERTM reassembly path correctly calls pskb_may_pull() before reading\nthe SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the\nsame validation to the Enhanced Credit Based Flow Control data path."}],"id":"CVE-2026-31512","lastModified":"2026-11-05T22:18:36.513","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31512","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:36:21.853077Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:50.490","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3340be2bafdcc806f048273ea6d8e82a6597aa1b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40c7f7eea2f4d9cb0b3e924254c8c9053372168f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/477ad4976072056c348937e94f24583321938df4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5ad981249be52f5e4e92e0e97b436b569071cb86"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8c96f3bd4ae0802db90630be8e9851827e9c9209"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c65bd945d1c08c3db756821b6bf9f1c4a77b29c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cef09691cfb61f6c91cc27c3d69634f81c8ab949"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e47315b84d0eb188772c3ff5cf073cdbdefca6b4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cef09691cfb61f6c91cc27c3d69634f81c8ab949","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"3340be2bafdcc806f048273ea6d8e82a6597aa1b","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"e47315b84d0eb188772c3ff5cf073cdbdefca6b4","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"477ad4976072056c348937e94f24583321938df4","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"40c7f7eea2f4d9cb0b3e924254c8c9053372168f","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"8c96f3bd4ae0802db90630be8e9851827e9c9209","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"5ad981249be52f5e4e92e0e97b436b569071cb86","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"},{"lessThan":"c65bd945d1c08c3db756821b6bf9f1c4a77b29c6","status":"affected","version":"aac23bf636593cc2d67144aed373a46a1a5f76b1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.14"},{"lessThan":"3.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96775134-B6E9-42CE-A367-9B4C33EFBF22","versionEndExcluding":"5.10.253","versionStartIncluding":"3.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.14:-:*:*:*:*:*:*","matchCriteriaId":"851B1505-0318-49F4-8D7C-196BE04FF173","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()\n\nl2cap_ecred_data_rcv() reads the SDU length field from skb->data using\nget_unaligned_le16() without first verifying that skb contains at least\nL2CAP_SDULEN_SIZE (2) bytes. When skb->len is less than 2, this reads\npast the valid data in the skb.\n\nThe ERTM reassembly path correctly calls pskb_may_pull() before reading\nthe SDU length (l2cap_reassemble_sdu, L2CAP_SAR_START case). Apply the\nsame validation to the Enhanced Credit Based Flow Control data path."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: L2CAP: Validar la longitud de la PDU antes de leer la longitud de la SDU en l2cap_ecred_data_rcv()\n\nl2cap_ecred_data_rcv() lee el campo de longitud de la SDU de skb -> data usando get_unaligned_le16() sin verificar primero que skb contenga al menos L2CAP_SDULEN_SIZE (2) bytes. Cuando skb -> len es menor que 2, esto lee más allá de los datos válidos en el skb.\n\nLa ruta de reensamblaje ERTM llama correctamente a pskb_may_pull() antes de leer la longitud de la SDU (l2cap_reassemble_sdu, caso L2CAP_SAR_START). Aplicar la misma validación a la ruta de datos de Control de Flujo Basado en Crédito Mejorado."}],"id":"CVE-2026-31512","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31512","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:36:21.853077Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:50.490","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3340be2bafdcc806f048273ea6d8e82a6597aa1b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40c7f7eea2f4d9cb0b3e924254c8c9053372168f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/477ad4976072056c348937e94f24583321938df4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5ad981249be52f5e4e92e0e97b436b569071cb86"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8c96f3bd4ae0802db90630be8e9851827e9c9209"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c65bd945d1c08c3db756821b6bf9f1c4a77b29c6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cef09691cfb61f6c91cc27c3d69634f81c8ab949"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e47315b84d0eb188772c3ff5cf073cdbdefca6b4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31513.json b/data/2026/CVE-2026-31513.json index 0922c39810..dcd3b12938 100644 --- a/data/2026/CVE-2026-31513.json +++ b/data/2026/CVE-2026-31513.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc","status":"affected","version":"935f324e4b2461df2cf7f02b4195082b4304c708","versionType":"git"},{"lessThan":"5b35f8211a913cfe7ab9d54fa36a272d2059a588","status":"affected","version":"e981a9392800ce2c5bca196a6ab2c55e9370efaa","versionType":"git"},{"lessThan":"a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b","status":"affected","version":"f3fdf2e7276a3edc5df55454275da20eac186970","versionType":"git"},{"lessThan":"9d87cb22195b2c67405f5485d525190747ad5493","status":"affected","version":"c28d2bff70444a85b3b86aaf241ece9408c7858c","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.12.80","status":"affected","version":"6.12.75","versionType":"semver"},{"lessThan":"6.18.21","status":"affected","version":"6.18.16","versionType":"semver"},{"lessThan":"6.19.11","status":"affected","version":"6.19.6","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E823EB64-1F92-40BB-891C-D94D00EDA086","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6C57E63A-04BA-47E0-A942-789F7236A636","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BFE33C3-C605-4CC2-9F15-3494BA78E2C9","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req\n\nSyzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd()\nthat is triggered by a malformed Enhanced Credit Based Connection Request.\n\nThe vulnerability stems from l2cap_ecred_conn_req(). The function allocates\na local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel\nIDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more\nthan 5 SCIDs, the function calculates `rsp_len` based on this unvalidated\n`cmd_len` before checking if the number of SCIDs exceeds\nL2CAP_ECRED_MAX_CID.\n\nIf the SCID count is too high, the function correctly jumps to the\n`response` label to reject the packet, but `rsp_len` retains the\nattacker's oversized value. Consequently, l2cap_send_cmd() is instructed\nto read past the end of the 18-byte `pdu` buffer, triggering a\nKASAN panic.\n\nFix this by moving the assignment of `rsp_len` to after the `num_scid`\nboundary check. If the packet is rejected, `rsp_len` will safely\nremain 0, and the error response will only read the 8-byte base header\nfrom the stack."}],"id":"CVE-2026-31513","lastModified":"2026-10-19T19:17:58.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31513","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:31.040486Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:50.673","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5b35f8211a913cfe7ab9d54fa36a272d2059a588"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d87cb22195b2c67405f5485d525190747ad5493"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc","status":"affected","version":"935f324e4b2461df2cf7f02b4195082b4304c708","versionType":"git"},{"lessThan":"5b35f8211a913cfe7ab9d54fa36a272d2059a588","status":"affected","version":"e981a9392800ce2c5bca196a6ab2c55e9370efaa","versionType":"git"},{"lessThan":"a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b","status":"affected","version":"f3fdf2e7276a3edc5df55454275da20eac186970","versionType":"git"},{"lessThan":"9d87cb22195b2c67405f5485d525190747ad5493","status":"affected","version":"c28d2bff70444a85b3b86aaf241ece9408c7858c","versionType":"git"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.12.80","status":"affected","version":"6.12.75","versionType":"semver"},{"lessThan":"6.18.21","status":"affected","version":"6.18.16","versionType":"semver"},{"lessThan":"6.19.11","status":"affected","version":"6.19.6","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E823EB64-1F92-40BB-891C-D94D00EDA086","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6C57E63A-04BA-47E0-A942-789F7236A636","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BFE33C3-C605-4CC2-9F15-3494BA78E2C9","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req\n\nSyzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd()\nthat is triggered by a malformed Enhanced Credit Based Connection Request.\n\nThe vulnerability stems from l2cap_ecred_conn_req(). The function allocates\na local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel\nIDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more\nthan 5 SCIDs, the function calculates `rsp_len` based on this unvalidated\n`cmd_len` before checking if the number of SCIDs exceeds\nL2CAP_ECRED_MAX_CID.\n\nIf the SCID count is too high, the function correctly jumps to the\n`response` label to reject the packet, but `rsp_len` retains the\nattacker's oversized value. Consequently, l2cap_send_cmd() is instructed\nto read past the end of the 18-byte `pdu` buffer, triggering a\nKASAN panic.\n\nFix this by moving the assignment of `rsp_len` to after the `num_scid`\nboundary check. If the packet is rejected, `rsp_len` will safely\nremain 0, and the error response will only read the 8-byte base header\nfrom the stack."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: L2CAP: Corrección de lectura fuera de límites de la pila en l2cap_ecred_conn_req\n\nSyzbot informó una lectura KASAN fuera de límites de la pila en l2cap_build_cmd() que es activada por una solicitud de conexión basada en crédito mejorada malformada.\n\nLa vulnerabilidad se origina en l2cap_ecred_conn_req(). La función asigna un búfer de pila local (’pdu’) diseñado para contener un máximo de 5 ID de canal de origen (SCID), con un total de 18 bytes. Cuando un atacante envía una solicitud con más de 5 SCID, la función calcula ’rsp_len’ basándose en este ’cmd_len’ no validado antes de verificar si el número de SCID excede L2CAP_ECRED_MAX_CID.\n\nSi el recuento de SCID es demasiado alto, la función salta correctamente a la etiqueta ’response’ para rechazar el paquete, pero ’rsp_len’ retiene el valor sobredimensionado del atacante. En consecuencia, se le indica a l2cap_send_cmd() que lea más allá del final del búfer ’pdu’ de 18 bytes, lo que desencadena un pánico KASAN.\n\nSolucione esto moviendo la asignación de ’rsp_len’ a después de la verificación de límites de ’num_scid’. Si el paquete es rechazado, ’rsp_len’ permanecerá de forma segura en 0, y la respuesta de error solo leerá el encabezado base de 8 bytes de la pila."}],"id":"CVE-2026-31513","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31513","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:31.040486Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:50.673","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5b35f8211a913cfe7ab9d54fa36a272d2059a588"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d87cb22195b2c67405f5485d525190747ad5493"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31514.json b/data/2026/CVE-2026-31514.json index 3b83e73ef8..fc0844dab2 100644 --- a/data/2026/CVE-2026-31514.json +++ b/data/2026/CVE-2026-31514.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/erofs/fileio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d1ba7d6b3cd1757b108d7b6856c92ae661d6c323","status":"affected","version":"ce63cb62d794c98c7631c2296fa845f2a8d0a4a1","versionType":"git"},{"lessThan":"5cf3972c8221abdb1b464a14ccf8103d840b9085","status":"affected","version":"ce63cb62d794c98c7631c2296fa845f2a8d0a4a1","versionType":"git"},{"lessThan":"5a5f23ef5431639db1ac3a0b274aef3a84cc413c","status":"affected","version":"ce63cb62d794c98c7631c2296fa845f2a8d0a4a1","versionType":"git"},{"lessThan":"eade54040384f54b7fb330e4b0975c5734850b3c","status":"affected","version":"ce63cb62d794c98c7631c2296fa845f2a8d0a4a1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/erofs/fileio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E823EB64-1F92-40BB-891C-D94D00EDA086","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DEA57E4E-36B0-40D5-98B9-6A50348C9E74","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A67B0458-DAE3-4940-BBB2-1A4D263AF27B","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: set fileio bio failed in short read case\n\nFor file-backed mount, IO requests are handled by vfs_iocb_iter_read().\nHowever, it can be interrupted by SIGKILL, returning the number of\nbytes actually copied. Unused folios in bio are unexpectedly marked\nas uptodate.\n\n vfs_read\n filemap_read\n filemap_get_pages\n filemap_readahead\n erofs_fileio_readahead\n erofs_fileio_rq_submit\n vfs_iocb_iter_read\n filemap_read\n filemap_get_pages <= detect signal\n erofs_fileio_ki_complete <= set all folios uptodate\n\nThis patch addresses this by setting short read bio with an error\ndirectly."}],"id":"CVE-2026-31514","lastModified":"2026-10-23T09:17:07.097","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:50.810","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a5f23ef5431639db1ac3a0b274aef3a84cc413c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5cf3972c8221abdb1b464a14ccf8103d840b9085"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d1ba7d6b3cd1757b108d7b6856c92ae661d6c323"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eade54040384f54b7fb330e4b0975c5734850b3c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/erofs/fileio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d1ba7d6b3cd1757b108d7b6856c92ae661d6c323","status":"affected","version":"ce63cb62d794c98c7631c2296fa845f2a8d0a4a1","versionType":"git"},{"lessThan":"5cf3972c8221abdb1b464a14ccf8103d840b9085","status":"affected","version":"ce63cb62d794c98c7631c2296fa845f2a8d0a4a1","versionType":"git"},{"lessThan":"5a5f23ef5431639db1ac3a0b274aef3a84cc413c","status":"affected","version":"ce63cb62d794c98c7631c2296fa845f2a8d0a4a1","versionType":"git"},{"lessThan":"eade54040384f54b7fb330e4b0975c5734850b3c","status":"affected","version":"ce63cb62d794c98c7631c2296fa845f2a8d0a4a1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/erofs/fileio.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E823EB64-1F92-40BB-891C-D94D00EDA086","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DEA57E4E-36B0-40D5-98B9-6A50348C9E74","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A67B0458-DAE3-4940-BBB2-1A4D263AF27B","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: set fileio bio failed in short read case\n\nFor file-backed mount, IO requests are handled by vfs_iocb_iter_read().\nHowever, it can be interrupted by SIGKILL, returning the number of\nbytes actually copied. Unused folios in bio are unexpectedly marked\nas uptodate.\n\n vfs_read\n filemap_read\n filemap_get_pages\n filemap_readahead\n erofs_fileio_readahead\n erofs_fileio_rq_submit\n vfs_iocb_iter_read\n filemap_read\n filemap_get_pages <= detect signal\n erofs_fileio_ki_complete <= set all folios uptodate\n\nThis patch addresses this by setting short read bio with an error\ndirectly."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nerofs: establecer que el bio de fileio falló en caso de lectura corta\n\nPara montajes respaldados por archivos, las solicitudes de E/S son manejadas por vfs_iocb_iter_read().\nSin embargo, puede ser interrumpido por SIGKILL, devolviendo el número de bytes realmente copiados. Folios no utilizados en el bio son marcados inesperadamente como actualizados.\n\n vfs_read\n filemap_read\n filemap_get_pages\n filemap_readahead\n erofs_fileio_readahead\n erofs_fileio_rq_submit\n vfs_iocb_iter_read\n filemap_read\n filemap_get_pages <= detectar señal\n erofs_fileio_ki_complete <= establecer todos los folios como actualizados\n\nEste parche aborda esto al establecer el bio de lectura corta con un error directamente."}],"id":"CVE-2026-31514","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:50.810","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a5f23ef5431639db1ac3a0b274aef3a84cc413c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5cf3972c8221abdb1b464a14ccf8103d840b9085"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d1ba7d6b3cd1757b108d7b6856c92ae661d6c323"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eade54040384f54b7fb330e4b0975c5734850b3c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31515.json b/data/2026/CVE-2026-31515.json index d7495b2822..3a6c5395bb 100644 --- a/data/2026/CVE-2026-31515.json +++ b/data/2026/CVE-2026-31515.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/key/af_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d0c5aa8dd38887714f1aad04236a3620b56a5e4e","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"e06b596fc4eb01936a2e5dccad17c946d660bab8","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"8ddf8de7e758f6888988467af9ffc8adf589fb16","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"d3225e6b9bd51ec177970a628fe4b11237ce87d5","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"7b18692c59afb8e5c364c8e3ac01e51dd6b52028","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"83f644ea92987c100b82d8481ae2230faeed3d34","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"ee836e820a40e2ca4da8af7310bff92d586772d4","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"eb2d16a7d599dc9d4df391b5e660df9949963786","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/key/af_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.21"},{"lessThan":"2.6.21","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36EBE72B-44B5-4850-AE2E-90E94D179AE3","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.21.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.21:-:*:*:*:*:*:*","matchCriteriaId":"A509AAC2-C059-4798-8B5E-AC4313926FD9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_key: validate families in pfkey_send_migrate()\n\nsyzbot was able to trigger a crash in skb_put() [1]\n\nIssue is that pfkey_send_migrate() does not check old/new families,\nand that set_ipsecrequest() @family argument was truncated,\nthus possibly overfilling the skb.\n\nValidate families early, do not wait set_ipsecrequest().\n\n[1]\n\nskbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:\n kernel BUG at net/core/skbuff.c:214 !\nCall Trace:\n \n skb_over_panic net/core/skbuff.c:219 [inline]\n skb_put+0x159/0x210 net/core/skbuff.c:2655\n skb_put_zero include/linux/skbuff.h:2788 [inline]\n set_ipsecrequest net/key/af_key.c:3532 [inline]\n pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636\n km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848\n xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705\n xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150"}],"id":"CVE-2026-31515","lastModified":"2026-11-10T13:18:58.137","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31515","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:36:29.210869Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:50.940","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7b18692c59afb8e5c364c8e3ac01e51dd6b52028"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83f644ea92987c100b82d8481ae2230faeed3d34"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ddf8de7e758f6888988467af9ffc8adf589fb16"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d0c5aa8dd38887714f1aad04236a3620b56a5e4e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3225e6b9bd51ec177970a628fe4b11237ce87d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e06b596fc4eb01936a2e5dccad17c946d660bab8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb2d16a7d599dc9d4df391b5e660df9949963786"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee836e820a40e2ca4da8af7310bff92d586772d4"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/key/af_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d0c5aa8dd38887714f1aad04236a3620b56a5e4e","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"e06b596fc4eb01936a2e5dccad17c946d660bab8","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"8ddf8de7e758f6888988467af9ffc8adf589fb16","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"d3225e6b9bd51ec177970a628fe4b11237ce87d5","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"7b18692c59afb8e5c364c8e3ac01e51dd6b52028","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"83f644ea92987c100b82d8481ae2230faeed3d34","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"ee836e820a40e2ca4da8af7310bff92d586772d4","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"},{"lessThan":"eb2d16a7d599dc9d4df391b5e660df9949963786","status":"affected","version":"08de61beab8a21c8e0b3906a97defda5f1f66ece","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/key/af_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.21"},{"lessThan":"2.6.21","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36EBE72B-44B5-4850-AE2E-90E94D179AE3","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.21.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.21:-:*:*:*:*:*:*","matchCriteriaId":"A509AAC2-C059-4798-8B5E-AC4313926FD9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_key: validate families in pfkey_send_migrate()\n\nsyzbot was able to trigger a crash in skb_put() [1]\n\nIssue is that pfkey_send_migrate() does not check old/new families,\nand that set_ipsecrequest() @family argument was truncated,\nthus possibly overfilling the skb.\n\nValidate families early, do not wait set_ipsecrequest().\n\n[1]\n\nskbuff: skb_over_panic: text:ffffffff8a752120 len:392 put:16 head:ffff88802a4ad040 data:ffff88802a4ad040 tail:0x188 end:0x180 dev:\n kernel BUG at net/core/skbuff.c:214 !\nCall Trace:\n \n skb_over_panic net/core/skbuff.c:219 [inline]\n skb_put+0x159/0x210 net/core/skbuff.c:2655\n skb_put_zero include/linux/skbuff.h:2788 [inline]\n set_ipsecrequest net/key/af_key.c:3532 [inline]\n pfkey_send_migrate+0x1270/0x2e50 net/key/af_key.c:3636\n km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848\n xfrm_migrate+0x2140/0x2450 net/xfrm/xfrm_policy.c:4705\n xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\naf_key: validar familias en pfkey_send_migrate()\n\nsyzbot pudo provocar un fallo en skb_put() [1]\n\nEl problema es que pfkey_send_migrate() no comprueba las familias antiguas/nuevas,\ny que el argumento @family de set_ipsecrequest() fue truncado,\nlo que posiblemente desbordaba el skb.\n\nValidar las familias pronto, no esperar a set_ipsecrequest().\n\n[1]\n\nskbuff: skb_over_panic: texto:ffffffff8a752120 longitud:392 puesto:16 cabecera:ffff88802a4ad040 datos:ffff88802a4ad040 cola:0x188 fin:0x180 dispositivo:[NULL]\nERROR del kernel en net/core/skbuff.c:214 !\nTraza de la llamada:\n[TASK]\n skb_over_panic net/core/skbuff.c:219 [inline]\n skb_put+0x159/0x210 net/core/skbuff.c:2655\n skb_put_zero include/linux/skbuff.h:2788 [inline]\n set_ipsecrequest net/key/af_key.c:3532 [inline]\n pfkey_send_migrate+0x 1270/0x 2e50 net/key/af_key.c:3636\n km_migrate+0x155/0x260 net/xfrm/xfrm_state.c:2848\n xfrm_migrate+0x 2140/0x 2450 net/xfrm/xfrm_policy.c:4705\n xfrm_do_migrate+0x8ff/0xaa0 net/xfrm/xfrm_user.c:3150"}],"id":"CVE-2026-31515","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31515","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:36:29.210869Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:50.940","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7b18692c59afb8e5c364c8e3ac01e51dd6b52028"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83f644ea92987c100b82d8481ae2230faeed3d34"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ddf8de7e758f6888988467af9ffc8adf589fb16"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d0c5aa8dd38887714f1aad04236a3620b56a5e4e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3225e6b9bd51ec177970a628fe4b11237ce87d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e06b596fc4eb01936a2e5dccad17c946d660bab8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb2d16a7d599dc9d4df391b5e660df9949963786"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee836e820a40e2ca4da8af7310bff92d586772d4"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31516.json b/data/2026/CVE-2026-31516.json index 2ebfdb029b..9c96dcfeb0 100644 --- a/data/2026/CVE-2026-31516.json +++ b/data/2026/CVE-2026-31516.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"56ea2257b83ee29a543f158159e3d1abc1e3e4fe","status":"affected","version":"880a6fab8f6ba5b5abe59ea68533202ddea1012c","versionType":"git"},{"lessThan":"8854e9367465d784046362698731c1111e3b39b8","status":"affected","version":"880a6fab8f6ba5b5abe59ea68533202ddea1012c","versionType":"git"},{"lessThan":"4e2e77843fef473ef47e322d52436d8308582a96","status":"affected","version":"880a6fab8f6ba5b5abe59ea68533202ddea1012c","versionType":"git"},{"lessThan":"29fe3a61bcdce398ee3955101c39f89c01a8a77e","status":"affected","version":"880a6fab8f6ba5b5abe59ea68533202ddea1012c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.18"},{"lessThan":"3.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7B818F6F-764A-42AE-90D4-B937B1934C2D","versionEndExcluding":"6.12.80","versionStartIncluding":"3.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.18:-:*:*:*:*:*:*","matchCriteriaId":"2C941823-DB24-432E-8F78-90665662756A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: prevent policy_hthresh.work from racing with netns teardown\n\nA XFRM_MSG_NEWSPDINFO request can queue the per-net work item\npolicy_hthresh.work onto the system workqueue.\n\nThe queued callback, xfrm_hash_rebuild(), retrieves the enclosing\nstruct net via container_of(). If the net namespace is torn down\nbefore that work runs, the associated struct net may already have\nbeen freed, and xfrm_hash_rebuild() may then dereference stale memory.\n\nxfrm_policy_fini() already flushes policy_hash_work during teardown,\nbut it does not synchronize policy_hthresh.work.\n\nSynchronize policy_hthresh.work in xfrm_policy_fini() as well, so the\nqueued work cannot outlive the net namespace teardown and access a\nfreed struct net."}],"id":"CVE-2026-31516","lastModified":"2026-10-19T19:17:58.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31516","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:33.949707Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:51.130","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29fe3a61bcdce398ee3955101c39f89c01a8a77e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e2e77843fef473ef47e322d52436d8308582a96"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/56ea2257b83ee29a543f158159e3d1abc1e3e4fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8854e9367465d784046362698731c1111e3b39b8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"56ea2257b83ee29a543f158159e3d1abc1e3e4fe","status":"affected","version":"880a6fab8f6ba5b5abe59ea68533202ddea1012c","versionType":"git"},{"lessThan":"8854e9367465d784046362698731c1111e3b39b8","status":"affected","version":"880a6fab8f6ba5b5abe59ea68533202ddea1012c","versionType":"git"},{"lessThan":"4e2e77843fef473ef47e322d52436d8308582a96","status":"affected","version":"880a6fab8f6ba5b5abe59ea68533202ddea1012c","versionType":"git"},{"lessThan":"29fe3a61bcdce398ee3955101c39f89c01a8a77e","status":"affected","version":"880a6fab8f6ba5b5abe59ea68533202ddea1012c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_policy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.18"},{"lessThan":"3.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7B818F6F-764A-42AE-90D4-B937B1934C2D","versionEndExcluding":"6.12.80","versionStartIncluding":"3.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.18:-:*:*:*:*:*:*","matchCriteriaId":"2C941823-DB24-432E-8F78-90665662756A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: prevent policy_hthresh.work from racing with netns teardown\n\nA XFRM_MSG_NEWSPDINFO request can queue the per-net work item\npolicy_hthresh.work onto the system workqueue.\n\nThe queued callback, xfrm_hash_rebuild(), retrieves the enclosing\nstruct net via container_of(). If the net namespace is torn down\nbefore that work runs, the associated struct net may already have\nbeen freed, and xfrm_hash_rebuild() may then dereference stale memory.\n\nxfrm_policy_fini() already flushes policy_hash_work during teardown,\nbut it does not synchronize policy_hthresh.work.\n\nSynchronize policy_hthresh.work in xfrm_policy_fini() as well, so the\nqueued work cannot outlive the net namespace teardown and access a\nfreed struct net."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm: evitar que policy_hthresh.work compita con el desmantelamiento de netns\n\nUna solicitud XFRM_MSG_NEWSPDINFO puede encolar el elemento de trabajo por red policy_hthresh.work en la cola de trabajo del sistema.\n\nLa devolución de llamada encolada, xfrm_hash_rebuild(), recupera la struct net contenedora a través de container_of(). Si el espacio de nombres de red es desmantelado antes de que se ejecute ese trabajo, la struct net asociada puede que ya haya sido liberada, y xfrm_hash_rebuild() puede entonces desreferenciar memoria obsoleta.\n\nxfrm_policy_fini() ya vacía policy_hash_work durante el desmantelamiento, pero no sincroniza policy_hthresh.work.\n\nSincronizar policy_hthresh.work también en xfrm_policy_fini(), para que el trabajo encolado no pueda sobrevivir al desmantelamiento del espacio de nombres de red y acceder a una struct net liberada."}],"id":"CVE-2026-31516","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31516","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:33.949707Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:51.130","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29fe3a61bcdce398ee3955101c39f89c01a8a77e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e2e77843fef473ef47e322d52436d8308582a96"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/56ea2257b83ee29a543f158159e3d1abc1e3e4fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8854e9367465d784046362698731c1111e3b39b8"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31517.json b/data/2026/CVE-2026-31517.json index 1bad66c890..bb81ec0495 100644 --- a/data/2026/CVE-2026-31517.json +++ b/data/2026/CVE-2026-31517.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"33a7b36268933c75bdc355e5531951e0ea9f1951","status":"affected","version":"5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7","versionType":"git"},{"lessThan":"7fdfe8f6efeb0e1200e22a903f2471539f54522b","status":"affected","version":"5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7","versionType":"git"},{"lessThan":"0b352f83cabfefdaafa806d6471f0eca117dc7d5","status":"affected","version":"5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8BA62FCD-8829-4508-AFE2-0C12960267CD","versionEndExcluding":"6.18.21","versionStartIncluding":"6.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*","matchCriteriaId":"7DE421BA-0600-4401-A175-73CAB6A6FB4E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly\n\nIn iptfs_reassem_cont(), IP-TFS attempts to append data to the new inner\npacket 'newskb' that is being reassembled. First a zero-copy approach is\ntried if it succeeds then newskb becomes non-linear.\n\nWhen a subsequent fragment in the same datagram does not meet the\nfast-path conditions, a memory copy is performed. It calls skb_put() to\nappend the data and as newskb is non-linear it triggers\nSKB_LINEAR_ASSERT check.\n\n Oops: invalid opcode: 0000 [#1] SMP NOPTI\n [...]\n RIP: 0010:skb_put+0x3c/0x40\n [...]\n Call Trace:\n \n iptfs_reassem_cont+0x1ab/0x5e0 [xfrm_iptfs]\n iptfs_input_ordered+0x2af/0x380 [xfrm_iptfs]\n iptfs_input+0x122/0x3e0 [xfrm_iptfs]\n xfrm_input+0x91e/0x1a50\n xfrm4_esp_rcv+0x3a/0x110\n ip_protocol_deliver_rcu+0x1d7/0x1f0\n ip_local_deliver_finish+0xbe/0x1e0\n __netif_receive_skb_core.constprop.0+0xb56/0x1120\n __netif_receive_skb_list_core+0x133/0x2b0\n netif_receive_skb_list_internal+0x1ff/0x3f0\n napi_complete_done+0x81/0x220\n virtnet_poll+0x9d6/0x116e [virtio_net]\n __napi_poll.constprop.0+0x2b/0x270\n net_rx_action+0x162/0x360\n handle_softirqs+0xdc/0x510\n __irq_exit_rcu+0xe7/0x110\n irq_exit_rcu+0xe/0x20\n common_interrupt+0x85/0xa0\n \n \n\nFix this by checking if the skb is non-linear. If it is, linearize it by\ncalling skb_linearize(). As the initial allocation of newskb originally\nreserved enough tailroom for the entire reassembled packet we do not\nneed to check if we have enough tailroom or extend it."}],"id":"CVE-2026-31517","lastModified":"2026-06-17T10:33:53.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:51.273","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b352f83cabfefdaafa806d6471f0eca117dc7d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33a7b36268933c75bdc355e5531951e0ea9f1951"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7fdfe8f6efeb0e1200e22a903f2471539f54522b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"33a7b36268933c75bdc355e5531951e0ea9f1951","status":"affected","version":"5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7","versionType":"git"},{"lessThan":"7fdfe8f6efeb0e1200e22a903f2471539f54522b","status":"affected","version":"5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7","versionType":"git"},{"lessThan":"0b352f83cabfefdaafa806d6471f0eca117dc7d5","status":"affected","version":"5f2b6a9095743a6bf1f34c43c4fe78fa8bdf5ad7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_iptfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8BA62FCD-8829-4508-AFE2-0C12960267CD","versionEndExcluding":"6.18.21","versionStartIncluding":"6.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.14:-:*:*:*:*:*:*","matchCriteriaId":"7DE421BA-0600-4401-A175-73CAB6A6FB4E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly\n\nIn iptfs_reassem_cont(), IP-TFS attempts to append data to the new inner\npacket 'newskb' that is being reassembled. First a zero-copy approach is\ntried if it succeeds then newskb becomes non-linear.\n\nWhen a subsequent fragment in the same datagram does not meet the\nfast-path conditions, a memory copy is performed. It calls skb_put() to\nappend the data and as newskb is non-linear it triggers\nSKB_LINEAR_ASSERT check.\n\n Oops: invalid opcode: 0000 [#1] SMP NOPTI\n [...]\n RIP: 0010:skb_put+0x3c/0x40\n [...]\n Call Trace:\n \n iptfs_reassem_cont+0x1ab/0x5e0 [xfrm_iptfs]\n iptfs_input_ordered+0x2af/0x380 [xfrm_iptfs]\n iptfs_input+0x122/0x3e0 [xfrm_iptfs]\n xfrm_input+0x91e/0x1a50\n xfrm4_esp_rcv+0x3a/0x110\n ip_protocol_deliver_rcu+0x1d7/0x1f0\n ip_local_deliver_finish+0xbe/0x1e0\n __netif_receive_skb_core.constprop.0+0xb56/0x1120\n __netif_receive_skb_list_core+0x133/0x2b0\n netif_receive_skb_list_internal+0x1ff/0x3f0\n napi_complete_done+0x81/0x220\n virtnet_poll+0x9d6/0x116e [virtio_net]\n __napi_poll.constprop.0+0x2b/0x270\n net_rx_action+0x162/0x360\n handle_softirqs+0xdc/0x510\n __irq_exit_rcu+0xe7/0x110\n irq_exit_rcu+0xe/0x20\n common_interrupt+0x85/0xa0\n \n \n\nFix this by checking if the skb is non-linear. If it is, linearize it by\ncalling skb_linearize(). As the initial allocation of newskb originally\nreserved enough tailroom for the entire reassembled packet we do not\nneed to check if we have enough tailroom or extend it."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm: iptfs: corrige el pánico de skb_put() en skb no lineal durante el reensamblaje\n\nEn iptfs_reassem_cont(), IP-TFS intenta adjuntar datos al nuevo paquete interno ’newskb’ que está siendo reensamblado. Primero se intenta un enfoque de copia cero; si tiene éxito, entonces newskb se vuelve no lineal.\n\nCuando un fragmento subsiguiente en el mismo datagrama no cumple las condiciones de ruta rápida, se realiza una copia en memoria. Llama a skb_put() para adjuntar los datos y, como newskb es no lineal, activa la comprobación SKB_LINEAR_ASSERT.\n\n Oops: código de operación inválido: 0000 [#1] SMP NOPTI\n [...]\n RIP: 0010:skb_put+0x3c/0x40\n [...]\n Traza de Llamadas:\n [IRQ]\n iptfs_reassem_cont+0x1ab/0x5e0 [xfrm_iptfs]\n iptfs_input_ordered+0x2af/0x380 [xfrm_iptfs]\n iptfs_input+0x122/0x3e0 [xfrm_iptfs]\n xfrm_input+0x91e/0x 1a50\n xfrm4_esp_rcv+0x3a/0x110\n ip_protocol_deliver_rcu+0x1d7/0x1f0\n ip_local_deliver_finish+0xbe/0x1e0\n __netif_receive_skb_core.constprop.0+0xb56/0x 1120\n __netif_receive_skb_list_core+0x133/0x2b0\n netif_receive_skb_list_internal+0x1ff/0x3f0\n napi_complete_done+0x81/0x220\n virtnet_poll+0x9d6/0x 116e [virtio_net]\n __napi_poll.constprop.0+0x2b/0x270\n net_rx_action+0x162/0x360\n handle_softirqs+0xdc/0x510\n __irq_exit_rcu+0xe7/0x110\n irq_exit_rcu+0xe/0x20\n common_interrupt+0x85/0xa0\n [/IRQ]\n [TASK]\n\nSoluciona esto comprobando si el skb es no lineal. Si lo es, linealízalo llamando a skb_linearize(). Dado que la asignación inicial de newskb originalmente reservó suficiente espacio de cola para todo el paquete reensamblado, no necesitamos comprobar si tenemos suficiente espacio de cola o extenderlo."}],"id":"CVE-2026-31517","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:51.273","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b352f83cabfefdaafa806d6471f0eca117dc7d5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33a7b36268933c75bdc355e5531951e0ea9f1951"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7fdfe8f6efeb0e1200e22a903f2471539f54522b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31518.json b/data/2026/CVE-2026-31518.json index 8a7d1dc43e..f74f5e5d50 100644 --- a/data/2026/CVE-2026-31518.json +++ b/data/2026/CVE-2026-31518.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/esp4.c","net/ipv6/esp6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"aca3ad0c262f54a5b5c95dda80a48365997d1224","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"41aafca57de4a4c026701622bd4648f112a9edcd","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"4820847e036ff1035b01b69ad68dfc17e7028fe9","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"6a3ec6efbc4f90e0ccb2e71574f07351f19996f4","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"df6f995358dc1f3c42484f5cfe241d7bd3e1cd15","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"88d386243ed374ac969dabd3bbc1409a31d81818","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"6aa9841d917532d0f2d932d1ff2f3a94305aaf47","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/esp4.c","net/ipv6/esp6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.6"},{"lessThan":"5.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A46EE847-2B8F-4145-AB46-8D057B48AFC9","versionEndExcluding":"5.10.253","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nesp: fix skb leak with espintcp and async crypto\n\nWhen the TX queue for espintcp is full, esp_output_tail_tcp will\nreturn an error and not free the skb, because with synchronous crypto,\nthe common xfrm output code will drop the packet for us.\n\nWith async crypto (esp_output_done), we need to drop the skb when\nesp_output_tail_tcp returns an error."}],"id":"CVE-2026-31518","lastModified":"2026-11-10T13:18:58.357","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31518","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:36:38.445309Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:51.410","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/41aafca57de4a4c026701622bd4648f112a9edcd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4820847e036ff1035b01b69ad68dfc17e7028fe9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6a3ec6efbc4f90e0ccb2e71574f07351f19996f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6aa9841d917532d0f2d932d1ff2f3a94305aaf47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/88d386243ed374ac969dabd3bbc1409a31d81818"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aca3ad0c262f54a5b5c95dda80a48365997d1224"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df6f995358dc1f3c42484f5cfe241d7bd3e1cd15"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/esp4.c","net/ipv6/esp6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"aca3ad0c262f54a5b5c95dda80a48365997d1224","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"41aafca57de4a4c026701622bd4648f112a9edcd","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"4820847e036ff1035b01b69ad68dfc17e7028fe9","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"6a3ec6efbc4f90e0ccb2e71574f07351f19996f4","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"df6f995358dc1f3c42484f5cfe241d7bd3e1cd15","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"88d386243ed374ac969dabd3bbc1409a31d81818","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"6aa9841d917532d0f2d932d1ff2f3a94305aaf47","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"},{"lessThan":"0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2","status":"affected","version":"e27cca96cd68fa2c6814c90f9a1cfd36bb68c593","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/esp4.c","net/ipv6/esp6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.6"},{"lessThan":"5.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A46EE847-2B8F-4145-AB46-8D057B48AFC9","versionEndExcluding":"5.10.253","versionStartIncluding":"5.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nesp: fix skb leak with espintcp and async crypto\n\nWhen the TX queue for espintcp is full, esp_output_tail_tcp will\nreturn an error and not free the skb, because with synchronous crypto,\nthe common xfrm output code will drop the packet for us.\n\nWith async crypto (esp_output_done), we need to drop the skb when\nesp_output_tail_tcp returns an error."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nesp: corregir fuga de skb con espintcp y criptografía asíncrona\n\nCuando la cola TX para espintcp está llena, esp_output_tail_tcp devolverá un error y no liberará el skb, porque con criptografía síncrona, el código de salida xfrm común descartará el paquete por nosotros.\n\nCon criptografía asíncrona (esp_output_done), necesitamos descartar el skb cuando esp_output_tail_tcp devuelve un error."}],"id":"CVE-2026-31518","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31518","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:36:38.445309Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:51.410","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/41aafca57de4a4c026701622bd4648f112a9edcd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4820847e036ff1035b01b69ad68dfc17e7028fe9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6a3ec6efbc4f90e0ccb2e71574f07351f19996f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6aa9841d917532d0f2d932d1ff2f3a94305aaf47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/88d386243ed374ac969dabd3bbc1409a31d81818"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aca3ad0c262f54a5b5c95dda80a48365997d1224"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df6f995358dc1f3c42484f5cfe241d7bd3e1cd15"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31519.json b/data/2026/CVE-2026-31519.json index b153fdbfd9..a25f918674 100644 --- a/data/2026/CVE-2026-31519.json +++ b/data/2026/CVE-2026-31519.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/ioctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d43da8de0ed376abafbad8a245a1835e8f66cb0f","status":"affected","version":"c71bf099abddf3e0fdc27f251ba76fca1461d49a","versionType":"git"},{"lessThan":"c57276ced3c3207f42182dfa2f0d8e860357e111","status":"affected","version":"c71bf099abddf3e0fdc27f251ba76fca1461d49a","versionType":"git"},{"lessThan":"a41a9b8d19a98b45591528c6e54d31cc66271d1e","status":"affected","version":"c71bf099abddf3e0fdc27f251ba76fca1461d49a","versionType":"git"},{"lessThan":"2ec578e6452138ab76f6c9a9c18711fcd197649f","status":"affected","version":"c71bf099abddf3e0fdc27f251ba76fca1461d49a","versionType":"git"},{"lessThan":"696683f214495db3cdacab9a713efaaced8660f8","status":"affected","version":"c71bf099abddf3e0fdc27f251ba76fca1461d49a","versionType":"git"},{"lessThan":"5131fa077f9bb386a1b901bf5b247041f0ec8f80","status":"affected","version":"c71bf099abddf3e0fdc27f251ba76fca1461d49a","versionType":"git"},{"status":"affected","version":"c4ba0bd9db5e8fd2664be0fd4ec01335fe3268eb","versionType":"git"},{"lessThan":"2.6.33","status":"affected","version":"2.6.32.19","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/ioctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.33"},{"lessThan":"2.6.33","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"495F91B8-83FD-48D7-9D47-5088CDFF7B18","versionEndExcluding":"2.6.33","versionStartIncluding":"2.6.32.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"94AAE858-E85D-4733-BCA5-FB4C40663DF1","versionEndExcluding":"6.1.168","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create\n\nWe have recently observed a number of subvolumes with broken dentries.\nls-ing the parent dir looks like:\n\ndrwxrwxrwt 1 root root 16 Jan 23 16:49 .\ndrwxr-xr-x 1 root root 24 Jan 23 16:48 ..\nd????????? ? ? ? ? ? broken_subvol\n\nand similarly stat-ing the file fails.\n\nIn this state, deleting the subvol fails with ENOENT, but attempting to\ncreate a new file or subvol over it errors out with EEXIST and even\naborts the fs. Which leaves us a bit stuck.\n\ndmesg contains a single notable error message reading:\n\"could not do orphan cleanup -2\"\n\n2 is ENOENT and the error comes from the failure handling path of\nbtrfs_orphan_cleanup(), with the stack leading back up to\nbtrfs_lookup().\n\nbtrfs_lookup\nbtrfs_lookup_dentry\nbtrfs_orphan_cleanup // prints that message and returns -ENOENT\n\nAfter some detailed inspection of the internal state, it became clear\nthat:\n- there are no orphan items for the subvol\n- the subvol is otherwise healthy looking, it is not half-deleted or\n anything, there is no drop progress, etc.\n- the subvol was created a while ago and does the meaningful first\n btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much\n later.\n- after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT,\n which results in a negative dentry for the subvolume via\n d_splice_alias(NULL, dentry), leading to the observed behavior. The\n bug can be mitigated by dropping the dentry cache, at which point we\n can successfully delete the subvolume if we want.\n\ni.e.,\nbtrfs_lookup()\n btrfs_lookup_dentry()\n if (!sb_rdonly(inode->vfs_inode)->vfs_inode)\n btrfs_orphan_cleanup(sub_root)\n test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP)\n btrfs_search_slot() // finds orphan item for inode N\n ...\n prints \"could not do orphan cleanup -2\"\n if (inode == ERR_PTR(-ENOENT))\n inode = NULL;\n return d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume\n\nbtrfs_orphan_cleanup() does test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP)\non the root when it runs, so it cannot run more than once on a given\nroot, so something else must run concurrently. However, the obvious\nroutes to deleting an orphan when nlinks goes to 0 should not be able to\nrun without first doing a lookup into the subvolume, which should run\nbtrfs_orphan_cleanup() and set the bit.\n\nThe final important observation is that create_subvol() calls\nd_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if\nthe dentry cache gets dropped, the next lookup into the subvolume will\nmake a real call into btrfs_orphan_cleanup() for the first time. This\nopens up the possibility of concurrently deleting the inode/orphan items\nbut most typical evict() paths will be holding a reference on the parent\ndentry (child dentry holds parent->d_lockref.count via dget in\nd_alloc(), released in __dentry_kill()) and prevent the parent from\nbeing removed from the dentry cache.\n\nThe one exception is delayed iputs. Ordered extent creation calls\nigrab() on the inode. If the file is unlinked and closed while those\nrefs are held, iput() in __dentry_kill() decrements i_count but does\nnot trigger eviction (i_count > 0). The child dentry is freed and the\nsubvol dentry's d_lockref.count drops to 0, making it evictable while\nthe inode is still alive.\n\nSince there are two races (the race between writeback and unlink and\nthe race between lookup and delayed iputs), and there are too many moving\nparts, the following three diagrams show the complete picture.\n(Only the second and third are races)\n\nPhase 1:\nCreate Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set\n\nbtrfs_mksubvol()\n lookup_one_len()\n __lookup_slow()\n d_alloc_parallel()\n __d_alloc() // d_lockref.count = 1\n create_subvol(dentry)\n // doesn't touch the bit..\n d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.c\n---truncated---"}],"id":"CVE-2026-31519","lastModified":"2026-11-05T22:18:37.120","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31519","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:36:46.914519Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:51.580","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ec578e6452138ab76f6c9a9c18711fcd197649f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5131fa077f9bb386a1b901bf5b247041f0ec8f80"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/696683f214495db3cdacab9a713efaaced8660f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a41a9b8d19a98b45591528c6e54d31cc66271d1e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c57276ced3c3207f42182dfa2f0d8e860357e111"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d43da8de0ed376abafbad8a245a1835e8f66cb0f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/ioctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d43da8de0ed376abafbad8a245a1835e8f66cb0f","status":"affected","version":"c71bf099abddf3e0fdc27f251ba76fca1461d49a","versionType":"git"},{"lessThan":"c57276ced3c3207f42182dfa2f0d8e860357e111","status":"affected","version":"c71bf099abddf3e0fdc27f251ba76fca1461d49a","versionType":"git"},{"lessThan":"a41a9b8d19a98b45591528c6e54d31cc66271d1e","status":"affected","version":"c71bf099abddf3e0fdc27f251ba76fca1461d49a","versionType":"git"},{"lessThan":"2ec578e6452138ab76f6c9a9c18711fcd197649f","status":"affected","version":"c71bf099abddf3e0fdc27f251ba76fca1461d49a","versionType":"git"},{"lessThan":"696683f214495db3cdacab9a713efaaced8660f8","status":"affected","version":"c71bf099abddf3e0fdc27f251ba76fca1461d49a","versionType":"git"},{"lessThan":"5131fa077f9bb386a1b901bf5b247041f0ec8f80","status":"affected","version":"c71bf099abddf3e0fdc27f251ba76fca1461d49a","versionType":"git"},{"status":"affected","version":"c4ba0bd9db5e8fd2664be0fd4ec01335fe3268eb","versionType":"git"},{"lessThan":"2.6.33","status":"affected","version":"2.6.32.19","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/ioctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.33"},{"lessThan":"2.6.33","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"495F91B8-83FD-48D7-9D47-5088CDFF7B18","versionEndExcluding":"2.6.33","versionStartIncluding":"2.6.32.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"94AAE858-E85D-4733-BCA5-FB4C40663DF1","versionEndExcluding":"6.1.168","versionStartIncluding":"2.6.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create\n\nWe have recently observed a number of subvolumes with broken dentries.\nls-ing the parent dir looks like:\n\ndrwxrwxrwt 1 root root 16 Jan 23 16:49 .\ndrwxr-xr-x 1 root root 24 Jan 23 16:48 ..\nd????????? ? ? ? ? ? broken_subvol\n\nand similarly stat-ing the file fails.\n\nIn this state, deleting the subvol fails with ENOENT, but attempting to\ncreate a new file or subvol over it errors out with EEXIST and even\naborts the fs. Which leaves us a bit stuck.\n\ndmesg contains a single notable error message reading:\n\"could not do orphan cleanup -2\"\n\n2 is ENOENT and the error comes from the failure handling path of\nbtrfs_orphan_cleanup(), with the stack leading back up to\nbtrfs_lookup().\n\nbtrfs_lookup\nbtrfs_lookup_dentry\nbtrfs_orphan_cleanup // prints that message and returns -ENOENT\n\nAfter some detailed inspection of the internal state, it became clear\nthat:\n- there are no orphan items for the subvol\n- the subvol is otherwise healthy looking, it is not half-deleted or\n anything, there is no drop progress, etc.\n- the subvol was created a while ago and does the meaningful first\n btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much\n later.\n- after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT,\n which results in a negative dentry for the subvolume via\n d_splice_alias(NULL, dentry), leading to the observed behavior. The\n bug can be mitigated by dropping the dentry cache, at which point we\n can successfully delete the subvolume if we want.\n\ni.e.,\nbtrfs_lookup()\n btrfs_lookup_dentry()\n if (!sb_rdonly(inode->vfs_inode)->vfs_inode)\n btrfs_orphan_cleanup(sub_root)\n test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP)\n btrfs_search_slot() // finds orphan item for inode N\n ...\n prints \"could not do orphan cleanup -2\"\n if (inode == ERR_PTR(-ENOENT))\n inode = NULL;\n return d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume\n\nbtrfs_orphan_cleanup() does test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP)\non the root when it runs, so it cannot run more than once on a given\nroot, so something else must run concurrently. However, the obvious\nroutes to deleting an orphan when nlinks goes to 0 should not be able to\nrun without first doing a lookup into the subvolume, which should run\nbtrfs_orphan_cleanup() and set the bit.\n\nThe final important observation is that create_subvol() calls\nd_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if\nthe dentry cache gets dropped, the next lookup into the subvolume will\nmake a real call into btrfs_orphan_cleanup() for the first time. This\nopens up the possibility of concurrently deleting the inode/orphan items\nbut most typical evict() paths will be holding a reference on the parent\ndentry (child dentry holds parent->d_lockref.count via dget in\nd_alloc(), released in __dentry_kill()) and prevent the parent from\nbeing removed from the dentry cache.\n\nThe one exception is delayed iputs. Ordered extent creation calls\nigrab() on the inode. If the file is unlinked and closed while those\nrefs are held, iput() in __dentry_kill() decrements i_count but does\nnot trigger eviction (i_count > 0). The child dentry is freed and the\nsubvol dentry's d_lockref.count drops to 0, making it evictable while\nthe inode is still alive.\n\nSince there are two races (the race between writeback and unlink and\nthe race between lookup and delayed iputs), and there are too many moving\nparts, the following three diagrams show the complete picture.\n(Only the second and third are races)\n\nPhase 1:\nCreate Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set\n\nbtrfs_mksubvol()\n lookup_one_len()\n __lookup_slow()\n d_alloc_parallel()\n __d_alloc() // d_lockref.count = 1\n create_subvol(dentry)\n // doesn't touch the bit..\n d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.c\n---truncated---"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: btrfs: establecer BTRFS_ROOT_ORPHAN_CLEANUP durante la creación de un subvolumen Hemos observado recientemente varios subvolúmenes con dentries rotos.\nAl ejecutar ’ls’ en el directorio padre, se ve así: drwxrwxrwt 1 root root 16 Jan 23 16:49 .\ndrwxr-xr-x 1 root root 24 Jan 23 16:48 ..\nd????????? ? ? ? ? ? broken_subvol y de manera similar, la operación ’stat’ sobre el archivo falla. En este estado, eliminar el subvolumen falla con ENOENT, pero intentar crear un nuevo archivo o subvolumen sobre él produce un error con EEXIST e incluso aborta el sistema de archivos (fs). Lo que nos deja un poco atascados. dmesg contiene un único mensaje de error notable que dice:\n’could not do orphan cleanup -2’ 2 es ENOENT y el error proviene de la ruta de manejo de fallos de btrfs_orphan_cleanup(), con la pila de llamadas remontándose hasta btrfs_lookup(). btrfs_lookup\nbtrfs_lookup_dentry\nbtrfs_orphan_cleanup // imprime ese mensaje y devuelve -ENOENT Después de una inspección detallada del estado interno, quedó claro que:\n- no hay elementos huérfanos para el subvolumen\n- el subvolumen, por lo demás, parece saludable, no está medio eliminado ni nada por el estilo, no hay progreso de eliminación, etc.\n- el subvolumen fue creado hace un tiempo y realiza la primera llamada significativa a btrfs_orphan_cleanup() que establece BTRFS_ROOT_ORPHAN_CLEANUP mucho más tarde.\n- después de que btrfs_orphan_cleanup() falla, btrfs_lookup_dentry() devuelve -ENOENT, lo que resulta en un dentry negativo para el subvolumen a través de d_splice_alias(NULL, dentry), lo que lleva al comportamiento observado. El error puede mitigarse eliminando la caché de dentries, momento en el que podemos eliminar exitosamente el subvolumen si lo deseamos. Es decir,\nbtrfs_lookup() btrfs_lookup_dentry() if (!sb_rdonly(inode-mayor que vfs_inode)-mayor que vfs_inode) btrfs_orphan_cleanup(sub_root) test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) btrfs_search_slot() // encuentra el elemento huérfano para el inodo N ... imprime ’could not do orphan cleanup -2’ if (inode == ERR_PTR(-ENOENT)) inode = NULL; return d_splice_alias(NULL, dentry) // DENTRY NEGATIVO para un subvolumen válido btrfs_orphan_cleanup() ejecuta test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) en la raíz cuando se ejecuta, por lo que no puede ejecutarse más de una vez en una raíz determinada, por lo que algo más debe ejecutarse concurrentemente. Sin embargo, las rutas obvias para eliminar un huérfano cuando nlinks llega a 0 no deberían poder ejecutarse sin antes realizar una búsqueda en el subvolumen, lo que debería ejecutar btrfs_orphan_cleanup() y establecer el bit. La última observación importante es que create_subvol() llama a d_instantiate_new() pero no establece BTRFS_ROOT_ORPHAN_CLEANUP, por lo que si la caché de dentries se elimina, la siguiente búsqueda en el subvolumen realizará una llamada real a btrfs_orphan_cleanup() por primera vez. Esto abre la posibilidad de eliminar concurrentemente los elementos inodo/huérfano, pero la mayoría de las rutas típicas de evict() mantendrán una referencia al dentry padre (el dentry hijo mantiene parent -> d_lockref.count a través de dget en d_alloc(), liberado en __dentry_kill()) y evitarán que el padre sea eliminado de la caché de dentries. La única excepción son los iputs retrasados. La creación ordenada de extensiones llama a igrab() en el inodo. Si el archivo se desvincula y se cierra mientras se mantienen esas referencias, iput() en __dentry_kill() decrementa i_count pero no activa la expulsión (i_count mayor que 0). El dentry hijo se libera y d_lockref.count del dentry del subvolumen cae a 0, haciéndolo expulsable mientras el inodo aún está vivo. Dado que hay dos condiciones de carrera (la condición de carrera entre writeback y unlink y la condición de carrera entre lookup e iputs retrasados), y hay demasiadas partes móviles, los siguientes tres diagramas muestran el panorama completo.\n(Solo la segunda y la tercera son --TRUNCADO--"}],"id":"CVE-2026-31519","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31519","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:36:46.914519Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:51.580","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ec578e6452138ab76f6c9a9c18711fcd197649f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5131fa077f9bb386a1b901bf5b247041f0ec8f80"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/696683f214495db3cdacab9a713efaaced8660f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a41a9b8d19a98b45591528c6e54d31cc66271d1e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c57276ced3c3207f42182dfa2f0d8e860357e111"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d43da8de0ed376abafbad8a245a1835e8f66cb0f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31520.json b/data/2026/CVE-2026-31520.json index 466fc81fe1..029afc549d 100644 --- a/data/2026/CVE-2026-31520.json +++ b/data/2026/CVE-2026-31520.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-apple.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e2f090aeb7b9930a964e151910f4d45b04c8a7e5","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"2635d0c715f3fb177e0f80ecd5fa48feb6bf3884","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"31860c3f7ac66ab897a8c90dc4e74fa17ca0b624","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"be1a341c161430282acdfe2ac99b413271575cf1","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"e652ebd29928181c3e6820e303da25873e9917d4","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"239c15116d80f67d32f00acc34575f1a6b699613","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-apple.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3AC7ECFB-6178-47EB-B821-2568DE6BFF85","versionEndExcluding":"6.1.168","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: apple: avoid memory leak in apple_report_fixup()\n\nThe apple_report_fixup() function was returning a\nnewly kmemdup()-allocated buffer, but never freeing it.\n\nThe caller of report_fixup() does not take ownership of the returned\npointer, but it *is* permitted to return a sub-portion of the input\nrdesc, whose lifetime is managed by the caller."}],"id":"CVE-2026-31520","lastModified":"2026-11-05T22:18:37.320","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31520","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:02.146634Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:51.770","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/239c15116d80f67d32f00acc34575f1a6b699613"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2635d0c715f3fb177e0f80ecd5fa48feb6bf3884"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/31860c3f7ac66ab897a8c90dc4e74fa17ca0b624"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/be1a341c161430282acdfe2ac99b413271575cf1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2f090aeb7b9930a964e151910f4d45b04c8a7e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e652ebd29928181c3e6820e303da25873e9917d4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-apple.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e2f090aeb7b9930a964e151910f4d45b04c8a7e5","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"2635d0c715f3fb177e0f80ecd5fa48feb6bf3884","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"31860c3f7ac66ab897a8c90dc4e74fa17ca0b624","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"be1a341c161430282acdfe2ac99b413271575cf1","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"e652ebd29928181c3e6820e303da25873e9917d4","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"},{"lessThan":"239c15116d80f67d32f00acc34575f1a6b699613","status":"affected","version":"6e143293e17a73c9313f91c5ca3aaacbaef030cf","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-apple.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3AC7ECFB-6178-47EB-B821-2568DE6BFF85","versionEndExcluding":"6.1.168","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: apple: avoid memory leak in apple_report_fixup()\n\nThe apple_report_fixup() function was returning a\nnewly kmemdup()-allocated buffer, but never freeing it.\n\nThe caller of report_fixup() does not take ownership of the returned\npointer, but it *is* permitted to return a sub-portion of the input\nrdesc, whose lifetime is managed by the caller."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nHID: apple: evitar una fuga de memoria en apple_report_fixup()\n\nLa función apple_report_fixup() estaba devolviendo un búfer recién asignado con kmemdup(), pero nunca lo liberaba.\n\nEl llamador de report_fixup() no toma posesión del puntero devuelto, pero sí está permitido devolver una subporción del rdesc de entrada, cuya vida útil es gestionada por el llamador."}],"id":"CVE-2026-31520","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31520","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:02.146634Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:51.770","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/239c15116d80f67d32f00acc34575f1a6b699613"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2635d0c715f3fb177e0f80ecd5fa48feb6bf3884"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/31860c3f7ac66ab897a8c90dc4e74fa17ca0b624"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/be1a341c161430282acdfe2ac99b413271575cf1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2f090aeb7b9930a964e151910f4d45b04c8a7e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e652ebd29928181c3e6820e303da25873e9917d4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31521.json b/data/2026/CVE-2026-31521.json index afd4b44672..1baab68f37 100644 --- a/data/2026/CVE-2026-31521.json +++ b/data/2026/CVE-2026-31521.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/module/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5d16f519b6eb1d071807e57efe0df2baa8d32ad6","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"4bbdb0e48176fd281c2b9a211b110db6fd94e175","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"082f15d2887329e0f43fd3727e69365f5bfe5d2c","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ec2b22a58073f80739013588af448ff6e2ab906f","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ef75dc1401d8e797ee51559a0dd0336c225e1776","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6ba6957c640f58dc8ef046981a045da43e47ea23","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"f9d69d5e7bde2295eb7488a56f094ac8f5383b92","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/module/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A0A14F27-2B54-495E-9E83-FD1A2D3AC85C","versionEndExcluding":"5.15.203","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmodule: Fix kernel panic when a symbol st_shndx is out of bounds\n\nThe module loader doesn't check for bounds of the ELF section index in\nsimplify_symbols():\n\n for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {\n\t\tconst char *name = info->strtab + sym[i].st_name;\n\n\t\tswitch (sym[i].st_shndx) {\n\t\tcase SHN_COMMON:\n\n\t\t[...]\n\n\t\tdefault:\n\t\t\t/* Divert to percpu allocation if a percpu var. */\n\t\t\tif (sym[i].st_shndx == info->index.pcpu)\n\t\t\t\tsecbase = (unsigned long)mod_percpu(mod);\n\t\t\telse\n /** HERE --> **/\t\tsecbase = info->sechdrs[sym[i].st_shndx].sh_addr;\n\t\t\tsym[i].st_value += secbase;\n\t\t\tbreak;\n\t\t}\n\t}\n\nA symbol with an out-of-bounds st_shndx value, for example 0xffff\n(known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic:\n\n BUG: unable to handle page fault for address: ...\n RIP: 0010:simplify_symbols+0x2b2/0x480\n ...\n Kernel panic - not syncing: Fatal exception\n\nThis can happen when module ELF is legitimately using SHN_XINDEX or\nwhen it is corrupted.\n\nAdd a bounds check in simplify_symbols() to validate that st_shndx is\nwithin the valid range before using it.\n\nThis issue was discovered due to a bug in llvm-objcopy, see relevant\ndiscussion for details [1].\n\n[1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/"}],"id":"CVE-2026-31521","lastModified":"2026-11-10T13:18:58.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:08.586542Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:51.930","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/082f15d2887329e0f43fd3727e69365f5bfe5d2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4bbdb0e48176fd281c2b9a211b110db6fd94e175"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5d16f519b6eb1d071807e57efe0df2baa8d32ad6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6ba6957c640f58dc8ef046981a045da43e47ea23"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ec2b22a58073f80739013588af448ff6e2ab906f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef75dc1401d8e797ee51559a0dd0336c225e1776"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f9d69d5e7bde2295eb7488a56f094ac8f5383b92"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/module/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5d16f519b6eb1d071807e57efe0df2baa8d32ad6","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"4bbdb0e48176fd281c2b9a211b110db6fd94e175","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"082f15d2887329e0f43fd3727e69365f5bfe5d2c","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ec2b22a58073f80739013588af448ff6e2ab906f","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ef75dc1401d8e797ee51559a0dd0336c225e1776","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6ba6957c640f58dc8ef046981a045da43e47ea23","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"f9d69d5e7bde2295eb7488a56f094ac8f5383b92","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/module/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A0A14F27-2B54-495E-9E83-FD1A2D3AC85C","versionEndExcluding":"5.15.203","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmodule: Fix kernel panic when a symbol st_shndx is out of bounds\n\nThe module loader doesn't check for bounds of the ELF section index in\nsimplify_symbols():\n\n for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {\n\t\tconst char *name = info->strtab + sym[i].st_name;\n\n\t\tswitch (sym[i].st_shndx) {\n\t\tcase SHN_COMMON:\n\n\t\t[...]\n\n\t\tdefault:\n\t\t\t/* Divert to percpu allocation if a percpu var. */\n\t\t\tif (sym[i].st_shndx == info->index.pcpu)\n\t\t\t\tsecbase = (unsigned long)mod_percpu(mod);\n\t\t\telse\n /** HERE --> **/\t\tsecbase = info->sechdrs[sym[i].st_shndx].sh_addr;\n\t\t\tsym[i].st_value += secbase;\n\t\t\tbreak;\n\t\t}\n\t}\n\nA symbol with an out-of-bounds st_shndx value, for example 0xffff\n(known as SHN_XINDEX or SHN_HIRESERVE), may cause a kernel panic:\n\n BUG: unable to handle page fault for address: ...\n RIP: 0010:simplify_symbols+0x2b2/0x480\n ...\n Kernel panic - not syncing: Fatal exception\n\nThis can happen when module ELF is legitimately using SHN_XINDEX or\nwhen it is corrupted.\n\nAdd a bounds check in simplify_symbols() to validate that st_shndx is\nwithin the valid range before using it.\n\nThis issue was discovered due to a bug in llvm-objcopy, see relevant\ndiscussion for details [1].\n\n[1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmódulo: Solucionar pánico del kernel cuando un símbolo st_shndx está fuera de límites\n\nEl cargador de módulos no verifica los límites del índice de sección ELF en simplify_symbols():\n\n for (i = 1; i < symsec -> sh_size / sizeof(Elf_Sym); i++) {\n\t\tconst char name = info -> strtab + sym[i].st_name;\n\n\t\tswitch (sym[i].st_shndx) {\n\t\tcase SHN_COMMON:\n\n\t\t[...]\n\n\t\tdefault:\n\t\t\t/* Desviar a la asignación por CPU si es una variable por CPU. */\n\t\t\tif (sym[i].st_shndx == info -> index.pcpu)\n\t\t\t\tsecbase = (unsigned long)mod_percpu(mod);\n\t\t\telse\n / AQUÍ - /\t\tsecbase = info -> sechdrs[sym[i].st_shndx].sh_addr;\n\t\t\tsym[i].st_value += secbase;\n\t\t\tbreak;\n\t\t}\n\t}\n\nUn símbolo con un valor st_shndx fuera de límites, por ejemplo 0x ffff (conocido como SHN_XINDEX o SHN_HIRESERVE), puede causar un pánico del kernel:\n\n BUG: no se puede manejar el fallo de página para la dirección: ...\n RIP: 0010:simplify_symbols+0x2b2/0x480\n ...\n Pánico del kernel - no sincronizando: Excepción fatal\n\nEsto puede ocurrir cuando el ELF del módulo está utilizando legítimamente SHN_XINDEX o cuando está corrupto.\n\nAñadir una verificación de límites en simplify_symbols() para validar que st_shndx está dentro del rango válido antes de usarlo.\n\nEste problema fue descubierto debido a un error en llvm-objcopy, ver la discusión relevante para más detalles [1].\n\n[1] https://lore.kernel.org/linux-modules/20251224005752.201911-1-ihor.solodrai@linux.dev/"}],"id":"CVE-2026-31521","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:08.586542Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:51.930","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/082f15d2887329e0f43fd3727e69365f5bfe5d2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4bbdb0e48176fd281c2b9a211b110db6fd94e175"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5d16f519b6eb1d071807e57efe0df2baa8d32ad6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6ba6957c640f58dc8ef046981a045da43e47ea23"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ec2b22a58073f80739013588af448ff6e2ab906f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef75dc1401d8e797ee51559a0dd0336c225e1776"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f9d69d5e7bde2295eb7488a56f094ac8f5383b92"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31522.json b/data/2026/CVE-2026-31522.json index a71f06ab07..989a5c7194 100644 --- a/data/2026/CVE-2026-31522.json +++ b/data/2026/CVE-2026-31522.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-magicmouse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"579c4c9857acdc8380fa99803f355f878bd766cb","status":"affected","version":"e6ad399596bd234be4722022146e33e15c7e424d","versionType":"git"},{"lessThan":"d84c21aabaab517b9aaf9bc1d785922cb9db2f31","status":"affected","version":"0b91b4e4dae63cd43871fc2012370b86ee588f91","versionType":"git"},{"lessThan":"7edfe4346b052b708645d0acc0f186425766b785","status":"affected","version":"0b91b4e4dae63cd43871fc2012370b86ee588f91","versionType":"git"},{"lessThan":"79e5dcc95d9abed6f8203cfd529f4ec71f0e505d","status":"affected","version":"0b91b4e4dae63cd43871fc2012370b86ee588f91","versionType":"git"},{"lessThan":"136f605e246b4bfe7ac2259471d1ff814aed0084","status":"affected","version":"0b91b4e4dae63cd43871fc2012370b86ee588f91","versionType":"git"},{"lessThan":"fa95b0146358b49f9858139b67314591fd5871b0","status":"affected","version":"0b91b4e4dae63cd43871fc2012370b86ee588f91","versionType":"git"},{"lessThan":"91e8c6e601bdc1ccdf886479b6513c01c7e51c2c","status":"affected","version":"0b91b4e4dae63cd43871fc2012370b86ee588f91","versionType":"git"},{"status":"affected","version":"c394bd1bc8537e61593b6b6799e01495c7cf9008","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.17","versionType":"semver"},{"lessThan":"5.17","status":"affected","version":"5.16.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-magicmouse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AA3AB8BC-6A05-41D5-B4AC-D91E87648E18","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7532EA4E-6958-4B4C-8270-4601DA8D95B6","versionEndExcluding":"5.17","versionStartIncluding":"5.16.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3AC7ECFB-6178-47EB-B821-2568DE6BFF85","versionEndExcluding":"6.1.168","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: magicmouse: avoid memory leak in magicmouse_report_fixup()\n\nThe magicmouse_report_fixup() function was returning a\nnewly kmemdup()-allocated buffer, but never freeing it.\n\nThe caller of report_fixup() does not take ownership of the returned\npointer, but it *is* permitted to return a sub-portion of the input\nrdesc, whose lifetime is managed by the caller."}],"id":"CVE-2026-31522","lastModified":"2026-11-05T22:18:37.803","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:15.850629Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:52.100","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/136f605e246b4bfe7ac2259471d1ff814aed0084"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/579c4c9857acdc8380fa99803f355f878bd766cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/79e5dcc95d9abed6f8203cfd529f4ec71f0e505d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7edfe4346b052b708645d0acc0f186425766b785"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/91e8c6e601bdc1ccdf886479b6513c01c7e51c2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d84c21aabaab517b9aaf9bc1d785922cb9db2f31"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fa95b0146358b49f9858139b67314591fd5871b0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-magicmouse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"579c4c9857acdc8380fa99803f355f878bd766cb","status":"affected","version":"e6ad399596bd234be4722022146e33e15c7e424d","versionType":"git"},{"lessThan":"d84c21aabaab517b9aaf9bc1d785922cb9db2f31","status":"affected","version":"0b91b4e4dae63cd43871fc2012370b86ee588f91","versionType":"git"},{"lessThan":"7edfe4346b052b708645d0acc0f186425766b785","status":"affected","version":"0b91b4e4dae63cd43871fc2012370b86ee588f91","versionType":"git"},{"lessThan":"79e5dcc95d9abed6f8203cfd529f4ec71f0e505d","status":"affected","version":"0b91b4e4dae63cd43871fc2012370b86ee588f91","versionType":"git"},{"lessThan":"136f605e246b4bfe7ac2259471d1ff814aed0084","status":"affected","version":"0b91b4e4dae63cd43871fc2012370b86ee588f91","versionType":"git"},{"lessThan":"fa95b0146358b49f9858139b67314591fd5871b0","status":"affected","version":"0b91b4e4dae63cd43871fc2012370b86ee588f91","versionType":"git"},{"lessThan":"91e8c6e601bdc1ccdf886479b6513c01c7e51c2c","status":"affected","version":"0b91b4e4dae63cd43871fc2012370b86ee588f91","versionType":"git"},{"status":"affected","version":"c394bd1bc8537e61593b6b6799e01495c7cf9008","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.17","versionType":"semver"},{"lessThan":"5.17","status":"affected","version":"5.16.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-magicmouse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.17"},{"lessThan":"5.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AA3AB8BC-6A05-41D5-B4AC-D91E87648E18","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7532EA4E-6958-4B4C-8270-4601DA8D95B6","versionEndExcluding":"5.17","versionStartIncluding":"5.16.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3AC7ECFB-6178-47EB-B821-2568DE6BFF85","versionEndExcluding":"6.1.168","versionStartIncluding":"5.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: magicmouse: avoid memory leak in magicmouse_report_fixup()\n\nThe magicmouse_report_fixup() function was returning a\nnewly kmemdup()-allocated buffer, but never freeing it.\n\nThe caller of report_fixup() does not take ownership of the returned\npointer, but it *is* permitted to return a sub-portion of the input\nrdesc, whose lifetime is managed by the caller."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nHID: magicmouse: evitar fuga de memoria en magicmouse_report_fixup()\n\nLa función magicmouse_report_fixup() estaba devolviendo un búfer recién asignado con kmemdup(), pero nunca lo liberaba.\n\nEl llamador de report_fixup() no asume la propiedad del puntero devuelto, pero sí está permitido devolver una sub-porción del rdesc de entrada, cuya vida útil es gestionada por el llamador."}],"id":"CVE-2026-31522","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:15.850629Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:52.100","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/136f605e246b4bfe7ac2259471d1ff814aed0084"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/579c4c9857acdc8380fa99803f355f878bd766cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/79e5dcc95d9abed6f8203cfd529f4ec71f0e505d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7edfe4346b052b708645d0acc0f186425766b785"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/91e8c6e601bdc1ccdf886479b6513c01c7e51c2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d84c21aabaab517b9aaf9bc1d785922cb9db2f31"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fa95b0146358b49f9858139b67314591fd5871b0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31523.json b/data/2026/CVE-2026-31523.json index 3591f6a517..fa0e1fa5e7 100644 --- a/data/2026/CVE-2026-31523.json +++ b/data/2026/CVE-2026-31523.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nvme/host/pci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"965e2c943f065122f14282a88d70a8a92e12a4da","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"ba167d5982e2eb6ff9356d409eca592ce99555da","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"0685dd9cb855ab77fcf3577b4702ba1d6df1c98d","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"6f12734c4b619f923a4df0b1a46b8098b187d324","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"acbc72dd1a09df53cafcf577259f4678be6afd6d","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"b96c7b25eb1b748f3e3b1832ebf028b0b223d7e3","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"b222680ba55e018426c4535067a008f1d81a5d21","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"166e31d7dbf6aa44829b98aa446bda5c9580f12a","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nvme/host/pci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.0"},{"lessThan":"5.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A58C0269-40CC-43D7-8F8A-B2C38025D165","versionEndExcluding":"5.10.253","versionStartIncluding":"5.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: ensure we're polling a polled queue\n\nA user can change the polled queue count at run time. There's a brief\nwindow during a reset where a hipri task may try to poll that queue\nbefore the block layer has updated the queue maps, which would race with\nthe now interrupt driven queue and may cause double completions."}],"id":"CVE-2026-31523","lastModified":"2026-11-05T22:18:37.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31523","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:23.406892Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:52.263","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0685dd9cb855ab77fcf3577b4702ba1d6df1c98d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/166e31d7dbf6aa44829b98aa446bda5c9580f12a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6f12734c4b619f923a4df0b1a46b8098b187d324"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/965e2c943f065122f14282a88d70a8a92e12a4da"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/acbc72dd1a09df53cafcf577259f4678be6afd6d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b222680ba55e018426c4535067a008f1d81a5d21"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b96c7b25eb1b748f3e3b1832ebf028b0b223d7e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba167d5982e2eb6ff9356d409eca592ce99555da"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nvme/host/pci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"965e2c943f065122f14282a88d70a8a92e12a4da","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"ba167d5982e2eb6ff9356d409eca592ce99555da","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"0685dd9cb855ab77fcf3577b4702ba1d6df1c98d","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"6f12734c4b619f923a4df0b1a46b8098b187d324","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"acbc72dd1a09df53cafcf577259f4678be6afd6d","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"b96c7b25eb1b748f3e3b1832ebf028b0b223d7e3","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"b222680ba55e018426c4535067a008f1d81a5d21","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"},{"lessThan":"166e31d7dbf6aa44829b98aa446bda5c9580f12a","status":"affected","version":"4b04cc6a8f86c4842314def22332de1f15de8523","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nvme/host/pci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.0"},{"lessThan":"5.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A58C0269-40CC-43D7-8F8A-B2C38025D165","versionEndExcluding":"5.10.253","versionStartIncluding":"5.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: ensure we're polling a polled queue\n\nA user can change the polled queue count at run time. There's a brief\nwindow during a reset where a hipri task may try to poll that queue\nbefore the block layer has updated the queue maps, which would race with\nthe now interrupt driven queue and may cause double completions."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnvme-pci: asegurar que estamos sondeando una cola sondeada\n\nUn usuario puede cambiar el recuento de colas sondeadas en tiempo de ejecución. Hay una breve ventana durante un reinicio donde una tarea de alta prioridad puede intentar sondear esa cola antes de que la capa de bloques haya actualizado los mapas de cola, lo que competiría con la cola ahora impulsada por interrupciones y puede causar dobles finalizaciones."}],"id":"CVE-2026-31523","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31523","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:23.406892Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:52.263","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0685dd9cb855ab77fcf3577b4702ba1d6df1c98d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/166e31d7dbf6aa44829b98aa446bda5c9580f12a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6f12734c4b619f923a4df0b1a46b8098b187d324"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/965e2c943f065122f14282a88d70a8a92e12a4da"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/acbc72dd1a09df53cafcf577259f4678be6afd6d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b222680ba55e018426c4535067a008f1d81a5d21"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b96c7b25eb1b748f3e3b1832ebf028b0b223d7e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba167d5982e2eb6ff9356d409eca592ce99555da"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31524.json b/data/2026/CVE-2026-31524.json index d62dc74519..36e17989b9 100644 --- a/data/2026/CVE-2026-31524.json +++ b/data/2026/CVE-2026-31524.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-asus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"726765b43deb2b4723869d673cc5fc6f7a3b2059","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"ede95cfcab8064d9a08813fbd7ed42cea8843dcf","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"f20f17cffbe34fb330267e0f8084f5565f807444","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"84724ac4821a160d47b84289adf139023027bdbb","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"2bad24c17742fc88973d6aea526ce1353f5334a3","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-asus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7144BCBC-124B-49FA-8BCC-259910F77E5A","versionEndExcluding":"5.10.253","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: asus: avoid memory leak in asus_report_fixup()\n\nThe asus_report_fixup() function was returning a newly allocated\nkmemdup()-allocated buffer, but never freeing it. Switch to\ndevm_kzalloc() to ensure the memory is managed and freed automatically\nwhen the device is removed.\n\nThe caller of report_fixup() does not take ownership of the returned\npointer, but it is permitted to return a pointer whose lifetime is at\nleast that of the input buffer.\n\nAlso fix a harmless out-of-bounds read by copying only the original\ndescriptor size."}],"id":"CVE-2026-31524","lastModified":"2026-11-05T22:18:38.180","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:29.086575Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:52.430","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2bad24c17742fc88973d6aea526ce1353f5334a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/726765b43deb2b4723869d673cc5fc6f7a3b2059"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/84724ac4821a160d47b84289adf139023027bdbb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ede95cfcab8064d9a08813fbd7ed42cea8843dcf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f20f17cffbe34fb330267e0f8084f5565f807444"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-asus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"726765b43deb2b4723869d673cc5fc6f7a3b2059","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"ede95cfcab8064d9a08813fbd7ed42cea8843dcf","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"f20f17cffbe34fb330267e0f8084f5565f807444","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"84724ac4821a160d47b84289adf139023027bdbb","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"},{"lessThan":"2bad24c17742fc88973d6aea526ce1353f5334a3","status":"affected","version":"5703e52cc711bc01e72cf12b86a126909c79d213","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-asus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7144BCBC-124B-49FA-8BCC-259910F77E5A","versionEndExcluding":"5.10.253","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: asus: avoid memory leak in asus_report_fixup()\n\nThe asus_report_fixup() function was returning a newly allocated\nkmemdup()-allocated buffer, but never freeing it. Switch to\ndevm_kzalloc() to ensure the memory is managed and freed automatically\nwhen the device is removed.\n\nThe caller of report_fixup() does not take ownership of the returned\npointer, but it is permitted to return a pointer whose lifetime is at\nleast that of the input buffer.\n\nAlso fix a harmless out-of-bounds read by copying only the original\ndescriptor size."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nHID: asus: evitar fuga de memoria en asus_report_fixup()\n\nLa función asus_report_fixup() estaba devolviendo un búfer recién asignado con kmemdup(), pero nunca lo liberaba. Cambiar a devm_kzalloc() para asegurar que la memoria se gestione y libere automáticamente cuando el dispositivo es retirado.\n\nEl llamador de report_fixup() no toma posesión del puntero devuelto, pero se permite devolver un puntero cuya vida útil sea al menos la del búfer de entrada.\n\nTambién se corrige una lectura fuera de límites inofensiva copiando solo el tamaño original del descriptor."}],"id":"CVE-2026-31524","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31524","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:29.086575Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:52.430","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2bad24c17742fc88973d6aea526ce1353f5334a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/726765b43deb2b4723869d673cc5fc6f7a3b2059"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/84724ac4821a160d47b84289adf139023027bdbb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ede95cfcab8064d9a08813fbd7ed42cea8843dcf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f20f17cffbe34fb330267e0f8084f5565f807444"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31525.json b/data/2026/CVE-2026-31525.json index cb0c8829f1..5436c4ddb4 100644 --- a/data/2026/CVE-2026-31525.json +++ b/data/2026/CVE-2026-31525.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/bpf/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"694ea55f1b1c74f9942d91ec366ae9e822422e42","status":"affected","version":"ec0e2da95f72d4a46050a4d994e4fe471474fd80","versionType":"git"},{"lessThan":"9ab1227765c446942f290c83382f0b19887c55cf","status":"affected","version":"ec0e2da95f72d4a46050a4d994e4fe471474fd80","versionType":"git"},{"lessThan":"f14ca604c0ff274fba19f73f1f0485c0047c1396","status":"affected","version":"ec0e2da95f72d4a46050a4d994e4fe471474fd80","versionType":"git"},{"lessThan":"0d5d8c3ce45c734aaf3c51cbef59155a6746157d","status":"affected","version":"ec0e2da95f72d4a46050a4d994e4fe471474fd80","versionType":"git"},{"lessThan":"c77b30bd1dcb61f66c640ff7d2757816210c7cb0","status":"affected","version":"ec0e2da95f72d4a46050a4d994e4fe471474fd80","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/bpf/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2DC0D2CD-6CF8-469A-B3F5-E48375FDA274","versionEndExcluding":"6.6.131","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN\n\nThe BPF interpreter's signed 32-bit division and modulo handlers use\nthe kernel abs() macro on s32 operands. The abs() macro documentation\n(include/linux/math.h) explicitly states the result is undefined when\nthe input is the type minimum. When DST contains S32_MIN (0x80000000),\nabs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged\non arm64/x86. This value is then sign-extended to u64 as\n0xFFFFFFFF80000000, causing do_div() to compute the wrong result.\n\nThe verifier's abstract interpretation (scalar32_min_max_sdiv) computes\nthe mathematically correct result for range tracking, creating a\nverifier/interpreter mismatch that can be exploited for out-of-bounds\nmap value access.\n\nIntroduce abs_s32() which handles S32_MIN correctly by casting to u32\nbefore negating, avoiding signed overflow entirely. Replace all 8\nabs((s32)...) call sites in the interpreter's sdiv32/smod32 handlers.\n\ns32 is the only affected case -- the s64 division/modulo handlers do\nnot use abs()."}],"id":"CVE-2026-31525","lastModified":"2026-10-19T19:17:58.723","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31525","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:36.308610Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:52.607","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d5d8c3ce45c734aaf3c51cbef59155a6746157d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/694ea55f1b1c74f9942d91ec366ae9e822422e42"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ab1227765c446942f290c83382f0b19887c55cf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c77b30bd1dcb61f66c640ff7d2757816210c7cb0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f14ca604c0ff274fba19f73f1f0485c0047c1396"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/bpf/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"694ea55f1b1c74f9942d91ec366ae9e822422e42","status":"affected","version":"ec0e2da95f72d4a46050a4d994e4fe471474fd80","versionType":"git"},{"lessThan":"9ab1227765c446942f290c83382f0b19887c55cf","status":"affected","version":"ec0e2da95f72d4a46050a4d994e4fe471474fd80","versionType":"git"},{"lessThan":"f14ca604c0ff274fba19f73f1f0485c0047c1396","status":"affected","version":"ec0e2da95f72d4a46050a4d994e4fe471474fd80","versionType":"git"},{"lessThan":"0d5d8c3ce45c734aaf3c51cbef59155a6746157d","status":"affected","version":"ec0e2da95f72d4a46050a4d994e4fe471474fd80","versionType":"git"},{"lessThan":"c77b30bd1dcb61f66c640ff7d2757816210c7cb0","status":"affected","version":"ec0e2da95f72d4a46050a4d994e4fe471474fd80","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/bpf/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2DC0D2CD-6CF8-469A-B3F5-E48375FDA274","versionEndExcluding":"6.6.131","versionStartIncluding":"6.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN\n\nThe BPF interpreter's signed 32-bit division and modulo handlers use\nthe kernel abs() macro on s32 operands. The abs() macro documentation\n(include/linux/math.h) explicitly states the result is undefined when\nthe input is the type minimum. When DST contains S32_MIN (0x80000000),\nabs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged\non arm64/x86. This value is then sign-extended to u64 as\n0xFFFFFFFF80000000, causing do_div() to compute the wrong result.\n\nThe verifier's abstract interpretation (scalar32_min_max_sdiv) computes\nthe mathematically correct result for range tracking, creating a\nverifier/interpreter mismatch that can be exploited for out-of-bounds\nmap value access.\n\nIntroduce abs_s32() which handles S32_MIN correctly by casting to u32\nbefore negating, avoiding signed overflow entirely. Replace all 8\nabs((s32)...) call sites in the interpreter's sdiv32/smod32 handlers.\n\ns32 is the only affected case -- the s64 division/modulo handlers do\nnot use abs()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf: Corrige el comportamiento indefinido en el intérprete sdiv/smod para INT_MIN\n\nLos manejadores de división y módulo con signo de 32 bits del intérprete BPF usan la macro abs() del kernel en operandos s32. La documentación de la macro abs() (include/linux/math.h) establece explícitamente que el resultado es indefinido cuando la entrada es el mínimo del tipo. Cuando DST contiene S32_MIN (0x 80000000), abs((s32)DST) desencadena un comportamiento indefinido y devuelve S32_MIN sin cambios en arm64/x86. Este valor es luego extendido por signo a u64 como 0x FFFFFFFF80000000, haciendo que do_div() calcule el resultado incorrecto.\n\nLa interpretación abstracta del verificador (scalar32_min_max_sdiv) calcula el resultado matemáticamente correcto para el seguimiento de rangos, creando una discrepancia entre verificador/intérprete que puede ser explotada para acceso a valores de mapa fuera de límites.\n\nSe introduce abs_s32() que maneja S32_MIN correctamente al convertir a u32 antes de negar, evitando completamente el desbordamiento con signo. Reemplazar los 8 sitios de llamada de abs((s32)...) en los manejadores sdiv32/smod32 del intérprete.\n\ns32 es el único caso afectado - - los manejadores de división/módulo s64 no usan abs()."}],"id":"CVE-2026-31525","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31525","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:36.308610Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:52.607","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d5d8c3ce45c734aaf3c51cbef59155a6746157d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/694ea55f1b1c74f9942d91ec366ae9e822422e42"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ab1227765c446942f290c83382f0b19887c55cf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c77b30bd1dcb61f66c640ff7d2757816210c7cb0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f14ca604c0ff274fba19f73f1f0485c0047c1396"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31526.json b/data/2026/CVE-2026-31526.json index 78066abeae..32e3c906d2 100644 --- a/data/2026/CVE-2026-31526.json +++ b/data/2026/CVE-2026-31526.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/bpf/verifier.c","tools/testing/selftests/bpf/progs/exceptions_fail.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4eca06a55417c3b2e538656d12c89e224343653e","status":"affected","version":"f18b03fabaa9b7c80e80b72a621f481f0d706ae0","versionType":"git"},{"lessThan":"c0281da1f2aa5c2fca3a05f79b86bea96591c358","status":"affected","version":"f18b03fabaa9b7c80e80b72a621f481f0d706ae0","versionType":"git"},{"lessThan":"5a399f3117642494e35545f6ca397d3e177c1f9b","status":"affected","version":"f18b03fabaa9b7c80e80b72a621f481f0d706ae0","versionType":"git"},{"lessThan":"6c2128505f61b504c79a20b89596feba61388112","status":"affected","version":"f18b03fabaa9b7c80e80b72a621f481f0d706ae0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/bpf/verifier.c","tools/testing/selftests/bpf/progs/exceptions_fail.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"360DD289-F962-4797-9A3C-FD8C4CE9DF15","versionEndExcluding":"6.18.21","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix exception exit lock checking for subprogs\n\nprocess_bpf_exit_full() passes check_lock = !curframe to\ncheck_resource_leak(), which is false in cases when bpf_throw() is\ncalled from a static subprog. This makes check_resource_leak() to skip\nvalidation of active_rcu_locks, active_preempt_locks, and\nactive_irq_id on exception exits from subprogs.\n\nAt runtime bpf_throw() unwinds the stack via ORC without releasing any\nuser-acquired locks, which may cause various issues as the result.\n\nFix by setting check_lock = true for exception exits regardless of\ncurframe, since exceptions bypass all intermediate frame\ncleanup. Update the error message prefix to \"bpf_throw\" for exception\nexits to distinguish them from normal BPF_EXIT.\n\nFix reject_subprog_with_rcu_read_lock test which was previously\npassing for the wrong reason. Test program returned directly from the\nsubprog call without closing the RCU section, so the error was\ntriggered by the unclosed RCU lock on normal exit, not by\nbpf_throw. Update __msg annotations for affected tests to match the\nnew \"bpf_throw\" error prefix.\n\nThe spin_lock case is not affected because they are already checked [1]\nat the call site in do_check_insn() before bpf_throw can run.\n\n[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/bpf/verifier.c?h=v7.0-rc4#n21098"}],"id":"CVE-2026-31526","lastModified":"2026-11-05T22:18:38.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31526","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:35.566566Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:52.763","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4eca06a55417c3b2e538656d12c89e224343653e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a399f3117642494e35545f6ca397d3e177c1f9b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6c2128505f61b504c79a20b89596feba61388112"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c0281da1f2aa5c2fca3a05f79b86bea96591c358"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/bpf/verifier.c","tools/testing/selftests/bpf/progs/exceptions_fail.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4eca06a55417c3b2e538656d12c89e224343653e","status":"affected","version":"f18b03fabaa9b7c80e80b72a621f481f0d706ae0","versionType":"git"},{"lessThan":"c0281da1f2aa5c2fca3a05f79b86bea96591c358","status":"affected","version":"f18b03fabaa9b7c80e80b72a621f481f0d706ae0","versionType":"git"},{"lessThan":"5a399f3117642494e35545f6ca397d3e177c1f9b","status":"affected","version":"f18b03fabaa9b7c80e80b72a621f481f0d706ae0","versionType":"git"},{"lessThan":"6c2128505f61b504c79a20b89596feba61388112","status":"affected","version":"f18b03fabaa9b7c80e80b72a621f481f0d706ae0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/bpf/verifier.c","tools/testing/selftests/bpf/progs/exceptions_fail.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"360DD289-F962-4797-9A3C-FD8C4CE9DF15","versionEndExcluding":"6.18.21","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix exception exit lock checking for subprogs\n\nprocess_bpf_exit_full() passes check_lock = !curframe to\ncheck_resource_leak(), which is false in cases when bpf_throw() is\ncalled from a static subprog. This makes check_resource_leak() to skip\nvalidation of active_rcu_locks, active_preempt_locks, and\nactive_irq_id on exception exits from subprogs.\n\nAt runtime bpf_throw() unwinds the stack via ORC without releasing any\nuser-acquired locks, which may cause various issues as the result.\n\nFix by setting check_lock = true for exception exits regardless of\ncurframe, since exceptions bypass all intermediate frame\ncleanup. Update the error message prefix to \"bpf_throw\" for exception\nexits to distinguish them from normal BPF_EXIT.\n\nFix reject_subprog_with_rcu_read_lock test which was previously\npassing for the wrong reason. Test program returned directly from the\nsubprog call without closing the RCU section, so the error was\ntriggered by the unclosed RCU lock on normal exit, not by\nbpf_throw. Update __msg annotations for affected tests to match the\nnew \"bpf_throw\" error prefix.\n\nThe spin_lock case is not affected because they are already checked [1]\nat the call site in do_check_insn() before bpf_throw can run.\n\n[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/bpf/verifier.c?h=v7.0-rc4#n21098"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf: Corrección de la comprobación de bloqueo en salida por excepción para subprogs\n\nprocess_bpf_exit_full() pasa check_lock = !curframe a check_resource_leak(), lo cual es falso en casos cuando se llama a bpf_throw() desde un subprog estático. Esto hace que check_resource_leak() omita la validación de active_rcu_locks, active_preempt_locks y active_irq_id en salidas por excepción desde subprogs.\n\nEn tiempo de ejecución, bpf_throw() desenrolla la pila a través de ORC sin liberar ningún bloqueo adquirido por el usuario, lo cual puede causar varios problemas como resultado.\n\nSolución estableciendo check_lock = true para salidas por excepción independientemente de curframe, ya que las excepciones omiten toda la limpieza de marcos intermedios. Actualizar el prefijo del mensaje de error a ’bpf_throw’ para salidas por excepción para distinguirlas de un BPF_EXIT normal.\n\nCorrección de la prueba reject_subprog_with_rcu_read_lock que anteriormente pasaba por la razón equivocada. El programa de prueba regresó directamente de la llamada al subprog sin cerrar la sección RCU, por lo que el error fue activado por el bloqueo RCU no cerrado en una salida normal, no por bpf_throw. Actualizar las anotaciones __msg para las pruebas afectadas para que coincidan con el nuevo prefijo de error ’bpf_throw’.\n\nEl caso spin_lock no se ve afectado porque ya se comprueban [1] en el sitio de llamada en do_check_insn() antes de que bpf_throw pueda ejecutarse.\n\n[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/bpf/verifier.c?h=v7.0-rc4#n21098"}],"id":"CVE-2026-31526","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31526","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:35.566566Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:52.763","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4eca06a55417c3b2e538656d12c89e224343653e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a399f3117642494e35545f6ca397d3e177c1f9b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6c2128505f61b504c79a20b89596feba61388112"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c0281da1f2aa5c2fca3a05f79b86bea96591c358"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31527.json b/data/2026/CVE-2026-31527.json index 4ce970f98c..ad93ca9595 100644 --- a/data/2026/CVE-2026-31527.json +++ b/data/2026/CVE-2026-31527.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/base/platform.c","drivers/bus/simple-pm-bus.c","drivers/clk/imx/clk-scu.c","drivers/slimbus/qcom-ngd-ctrl.c","include/linux/platform_device.h","sound/soc/samsung/i2s.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"492349e5e4a369a8b62781100a3ade470bf1ce6b","status":"affected","version":"3d713e0e382e6fcfb4bba1501645b66c129ad60b","versionType":"git"},{"lessThan":"9a6086d2a828dd2ff74cf9abcae456670febd71f","status":"affected","version":"3d713e0e382e6fcfb4bba1501645b66c129ad60b","versionType":"git"},{"lessThan":"7c02a9bd7d14a89065fcf672b86d8e1d1a41d3b1","status":"affected","version":"3d713e0e382e6fcfb4bba1501645b66c129ad60b","versionType":"git"},{"lessThan":"edee7ee5a14c3b33f6d54641f5af5c5e9180992d","status":"affected","version":"3d713e0e382e6fcfb4bba1501645b66c129ad60b","versionType":"git"},{"lessThan":"2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d","status":"affected","version":"3d713e0e382e6fcfb4bba1501645b66c129ad60b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/base/platform.c","drivers/bus/simple-pm-bus.c","drivers/clk/imx/clk-scu.c","drivers/slimbus/qcom-ngd-ctrl.c","include/linux/platform_device.h","sound/soc/samsung/i2s.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.17"},{"lessThan":"3.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.142","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"564BF73E-2070-41D2-8204-794C46879E01","versionEndExcluding":"6.12.80","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: platform: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]"}],"id":"CVE-2026-31527","lastModified":"2026-11-05T22:18:38.500","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31527","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:40.862642Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:52.903","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/492349e5e4a369a8b62781100a3ade470bf1ce6b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7c02a9bd7d14a89065fcf672b86d8e1d1a41d3b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a6086d2a828dd2ff74cf9abcae456670febd71f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/edee7ee5a14c3b33f6d54641f5af5c5e9180992d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/base/platform.c","drivers/bus/simple-pm-bus.c","drivers/clk/imx/clk-scu.c","drivers/slimbus/qcom-ngd-ctrl.c","include/linux/platform_device.h","sound/soc/samsung/i2s.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"492349e5e4a369a8b62781100a3ade470bf1ce6b","status":"affected","version":"3d713e0e382e6fcfb4bba1501645b66c129ad60b","versionType":"git"},{"lessThan":"9a6086d2a828dd2ff74cf9abcae456670febd71f","status":"affected","version":"3d713e0e382e6fcfb4bba1501645b66c129ad60b","versionType":"git"},{"lessThan":"7c02a9bd7d14a89065fcf672b86d8e1d1a41d3b1","status":"affected","version":"3d713e0e382e6fcfb4bba1501645b66c129ad60b","versionType":"git"},{"lessThan":"edee7ee5a14c3b33f6d54641f5af5c5e9180992d","status":"affected","version":"3d713e0e382e6fcfb4bba1501645b66c129ad60b","versionType":"git"},{"lessThan":"2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d","status":"affected","version":"3d713e0e382e6fcfb4bba1501645b66c129ad60b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/base/platform.c","drivers/bus/simple-pm-bus.c","drivers/clk/imx/clk-scu.c","drivers/slimbus/qcom-ngd-ctrl.c","include/linux/platform_device.h","sound/soc/samsung/i2s.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.17"},{"lessThan":"3.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.142","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"564BF73E-2070-41D2-8204-794C46879E01","versionEndExcluding":"6.12.80","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: platform: use generic driver_override infrastructure\n\nWhen a driver is probed through __driver_attach(), the bus' match()\ncallback is called without the device lock held, thus accessing the\ndriver_override field without a lock, which can cause a UAF.\n\nFix this by using the driver-core driver_override infrastructure taking\ncare of proper locking internally.\n\nNote that calling match() from __driver_attach() without the device lock\nheld is intentional. [1]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndriver core: platform: usar infraestructura genérica de driver_override\n\nCuando un controlador es sondeado a través de __driver_attach(), se llama a la función de devolución de llamada match() del bus sin el bloqueo del dispositivo adquirido, accediendo así al campo driver_override sin un bloqueo, lo que puede causar un UAF.\n\nEsto se soluciona usando la infraestructura de driver_override del driver-core, gestionando internamente el bloqueo adecuado.\n\nTenga en cuenta que llamar a match() desde __driver_attach() sin el bloqueo del dispositivo adquirido es intencional. [1]"}],"id":"CVE-2026-31527","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31527","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:40.862642Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:52.903","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/492349e5e4a369a8b62781100a3ade470bf1ce6b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7c02a9bd7d14a89065fcf672b86d8e1d1a41d3b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a6086d2a828dd2ff74cf9abcae456670febd71f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/edee7ee5a14c3b33f6d54641f5af5c5e9180992d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31528.json b/data/2026/CVE-2026-31528.json index 6c1beadc1e..95288b1f68 100644 --- a/data/2026/CVE-2026-31528.json +++ b/data/2026/CVE-2026-31528.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"656f35b463995bee024d948440128230aacd81e1","status":"affected","version":"bd27568117664b8b3e259721393df420ed51f57b","versionType":"git"},{"lessThan":"3a696e84a8b1fafdd774bb30d62919faf844d9e4","status":"affected","version":"bd27568117664b8b3e259721393df420ed51f57b","versionType":"git"},{"lessThan":"35f7914e54fe7f13654c22ee045b05e4b6d8062b","status":"affected","version":"bd27568117664b8b3e259721393df420ed51f57b","versionType":"git"},{"lessThan":"4c759446046500a1a6785b25725725c3ff087ace","status":"affected","version":"bd27568117664b8b3e259721393df420ed51f57b","versionType":"git"},{"lessThan":"4b9ce671960627b2505b3f64742544ae9801df97","status":"affected","version":"bd27568117664b8b3e259721393df420ed51f57b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Make sure to use pmu_ctx->pmu for groups\n\nOliver reported that x86_pmu_del() ended up doing an out-of-bound memory access\nwhen group_sched_in() fails and needs to roll back.\n\nThis *should* be handled by the transaction callbacks, but he found that when\nthe group leader is a software event, the transaction handlers of the wrong PMU\nare used. Despite the move_group case in perf_event_open() and group_sched_in()\nusing pmu_ctx->pmu.\n\nTurns out, inherit uses event->pmu to clone the events, effectively undoing the\nmove_group case for all inherited contexts. Fix this by also making inherit use\npmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context.\n\nSimilarly, __perf_event_read() should use equally use pmu_ctx->pmu for the\ngroup case."}],"id":"CVE-2026-31528","lastModified":"2026-10-19T19:17:58.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:38.614462Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:53.040","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/35f7914e54fe7f13654c22ee045b05e4b6d8062b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a696e84a8b1fafdd774bb30d62919faf844d9e4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b9ce671960627b2505b3f64742544ae9801df97"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c759446046500a1a6785b25725725c3ff087ace"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/656f35b463995bee024d948440128230aacd81e1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"656f35b463995bee024d948440128230aacd81e1","status":"affected","version":"bd27568117664b8b3e259721393df420ed51f57b","versionType":"git"},{"lessThan":"3a696e84a8b1fafdd774bb30d62919faf844d9e4","status":"affected","version":"bd27568117664b8b3e259721393df420ed51f57b","versionType":"git"},{"lessThan":"35f7914e54fe7f13654c22ee045b05e4b6d8062b","status":"affected","version":"bd27568117664b8b3e259721393df420ed51f57b","versionType":"git"},{"lessThan":"4c759446046500a1a6785b25725725c3ff087ace","status":"affected","version":"bd27568117664b8b3e259721393df420ed51f57b","versionType":"git"},{"lessThan":"4b9ce671960627b2505b3f64742544ae9801df97","status":"affected","version":"bd27568117664b8b3e259721393df420ed51f57b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Make sure to use pmu_ctx->pmu for groups\n\nOliver reported that x86_pmu_del() ended up doing an out-of-bound memory access\nwhen group_sched_in() fails and needs to roll back.\n\nThis *should* be handled by the transaction callbacks, but he found that when\nthe group leader is a software event, the transaction handlers of the wrong PMU\nare used. Despite the move_group case in perf_event_open() and group_sched_in()\nusing pmu_ctx->pmu.\n\nTurns out, inherit uses event->pmu to clone the events, effectively undoing the\nmove_group case for all inherited contexts. Fix this by also making inherit use\npmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context.\n\nSimilarly, __perf_event_read() should use equally use pmu_ctx->pmu for the\ngroup case."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nperf: Asegurarse de usar pmu_ctx -> pmu para grupos\n\nOliver informó que x86_pmu_del() terminó realizando un acceso a memoria fuera de límites cuando group_sched_in() falla y necesita revertir.\n\nEsto debería ser manejado por las retrollamadas de transacción, pero él encontró que cuando el líder del grupo es un evento de software, se utilizan los manejadores de transacción de la PMU incorrecta. A pesar de que el caso move_group en perf_event_open() y group_sched_in() usan pmu_ctx -> pmu.\n\nResulta que inherit usa event -> pmu para clonar los eventos, deshaciendo efectivamente el caso move_group para todos los contextos heredados. Solucione esto haciendo también que inherit use pmu_ctx -> pmu, asegurando que todos los contadores heredados terminen en el mismo contexto pmu.\n\nDe manera similar, __perf_event_read() debería usar igualmente pmu_ctx -> pmu para el caso de grupo."}],"id":"CVE-2026-31528","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:38.614462Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:53.040","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/35f7914e54fe7f13654c22ee045b05e4b6d8062b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a696e84a8b1fafdd774bb30d62919faf844d9e4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b9ce671960627b2505b3f64742544ae9801df97"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c759446046500a1a6785b25725725c3ff087ace"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/656f35b463995bee024d948440128230aacd81e1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31529.json b/data/2026/CVE-2026-31529.json index 738e875417..90ae514934 100644 --- a/data/2026/CVE-2026-31529.json +++ b/data/2026/CVE-2026-31529.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/cxl/core/region.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f1b4741adf08b0063291ec1b0dfa9c3d55644933","status":"affected","version":"d6602e25819dea2c239972e98e09ba5db4aebd22","versionType":"git"},{"lessThan":"77b310bb7b5ff8c017524df83292e0242ba89791","status":"affected","version":"d6602e25819dea2c239972e98e09ba5db4aebd22","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/cxl/core/region.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/region: Fix leakage in __construct_region()\n\nFailing the first sysfs_update_group() needs to explicitly\nkfree the resource as it is too early for cxl_region_iomem_release()\nto do so."}],"id":"CVE-2026-31529","lastModified":"2026-06-17T10:33:55.297","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:53.183","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/77b310bb7b5ff8c017524df83292e0242ba89791"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1b4741adf08b0063291ec1b0dfa9c3d55644933"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/cxl/core/region.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f1b4741adf08b0063291ec1b0dfa9c3d55644933","status":"affected","version":"d6602e25819dea2c239972e98e09ba5db4aebd22","versionType":"git"},{"lessThan":"77b310bb7b5ff8c017524df83292e0242ba89791","status":"affected","version":"d6602e25819dea2c239972e98e09ba5db4aebd22","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/cxl/core/region.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/region: Fix leakage in __construct_region()\n\nFailing the first sysfs_update_group() needs to explicitly\nkfree the resource as it is too early for cxl_region_iomem_release()\nto do so."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncxl/region: Corrección de fuga en __construct_region()\n\nSi falla la primera sysfs_update_group(), es necesario liberar explícitamente el recurso con kfree, ya que es demasiado pronto para que cxl_region_iomem_release() lo haga."}],"id":"CVE-2026-31529","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-22T14:16:53.183","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/77b310bb7b5ff8c017524df83292e0242ba89791"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1b4741adf08b0063291ec1b0dfa9c3d55644933"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31530.json b/data/2026/CVE-2026-31530.json index e70988127a..2e16c9501e 100644 --- a/data/2026/CVE-2026-31530.json +++ b/data/2026/CVE-2026-31530.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/cxl/core/port.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b1f62588ab1be6c9535d74348003c86b47ec4abd","status":"affected","version":"2345df54249c6fb7779e2a72b427ee79ed3eaad5","versionType":"git"},{"lessThan":"d216a4bd138eb57cc4ae7c43b2f709e3482af7e2","status":"affected","version":"2345df54249c6fb7779e2a72b427ee79ed3eaad5","versionType":"git"},{"lessThan":"2c32141462045cf93d54a5146a0ba572b83533dd","status":"affected","version":"2345df54249c6fb7779e2a72b427ee79ed3eaad5","versionType":"git"},{"lessThan":"f7dc6f381a1e5f068333f1faa9265d6af1df4235","status":"affected","version":"2345df54249c6fb7779e2a72b427ee79ed3eaad5","versionType":"git"},{"lessThan":"19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4","status":"affected","version":"2345df54249c6fb7779e2a72b427ee79ed3eaad5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/cxl/core/port.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.3"},{"lessThan":"6.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"525BA660-423E-45E7-987B-D0A26771C45B","versionEndExcluding":"6.12.80","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/port: Fix use after free of parent_port in cxl_detach_ep()\n\ncxl_detach_ep() is called during bottom-up removal when all CXL memory\ndevices beneath a switch port have been removed. For each port in the\nhierarchy it locks both the port and its parent, removes the endpoint,\nand if the port is now empty, marks it dead and unregisters the port\nby calling delete_switch_port(). There are two places during this work\nwhere the parent_port may be used after freeing:\n\nFirst, a concurrent detach may have already processed a port by the\ntime a second worker finds it via bus_find_device(). Without pinning\nparent_port, it may already be freed when we discover port->dead and\nattempt to unlock the parent_port. In a production kernel that's a\nsilent memory corruption, with lock debug, it looks like this:\n\n[]DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current())\n[]WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310\n[]Call Trace:\n[]mutex_unlock+0xd/0x20\n[]cxl_detach_ep+0x180/0x400 [cxl_core]\n[]devm_action_release+0x10/0x20\n[]devres_release_all+0xa8/0xe0\n[]device_unbind_cleanup+0xd/0xa0\n[]really_probe+0x1a6/0x3e0\n\nSecond, delete_switch_port() releases three devm actions registered\nagainst parent_port. The last of those is unregister_port() and it\ncalls device_unregister() on the child port, which can cascade. If\nparent_port is now also empty the device core may unregister and free\nit too. So by the time delete_switch_port() returns, parent_port may\nbe free, and the subsequent device_unlock(&parent_port->dev) operates\non freed memory. The kernel log looks same as above, with a different\noffset in cxl_detach_ep().\n\nBoth of these issues stem from the absence of a lifetime guarantee\nbetween a child port and its parent port.\n\nEstablish a lifetime rule for ports: child ports hold a reference to\ntheir parent device until release. Take the reference when the port\nis allocated and drop it when released. This ensures the parent is\nvalid for the full lifetime of the child and eliminates the use after\nfree window in cxl_detach_ep().\n\nThis is easily reproduced with a reload of cxl_acpi in QEMU with CXL\ndevices present."}],"id":"CVE-2026-31530","lastModified":"2026-11-05T22:18:38.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:47.922657Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:53.293","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c32141462045cf93d54a5146a0ba572b83533dd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b1f62588ab1be6c9535d74348003c86b47ec4abd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d216a4bd138eb57cc4ae7c43b2f709e3482af7e2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7dc6f381a1e5f068333f1faa9265d6af1df4235"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/cxl/core/port.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b1f62588ab1be6c9535d74348003c86b47ec4abd","status":"affected","version":"2345df54249c6fb7779e2a72b427ee79ed3eaad5","versionType":"git"},{"lessThan":"d216a4bd138eb57cc4ae7c43b2f709e3482af7e2","status":"affected","version":"2345df54249c6fb7779e2a72b427ee79ed3eaad5","versionType":"git"},{"lessThan":"2c32141462045cf93d54a5146a0ba572b83533dd","status":"affected","version":"2345df54249c6fb7779e2a72b427ee79ed3eaad5","versionType":"git"},{"lessThan":"f7dc6f381a1e5f068333f1faa9265d6af1df4235","status":"affected","version":"2345df54249c6fb7779e2a72b427ee79ed3eaad5","versionType":"git"},{"lessThan":"19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4","status":"affected","version":"2345df54249c6fb7779e2a72b427ee79ed3eaad5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/cxl/core/port.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.3"},{"lessThan":"6.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"525BA660-423E-45E7-987B-D0A26771C45B","versionEndExcluding":"6.12.80","versionStartIncluding":"6.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/port: Fix use after free of parent_port in cxl_detach_ep()\n\ncxl_detach_ep() is called during bottom-up removal when all CXL memory\ndevices beneath a switch port have been removed. For each port in the\nhierarchy it locks both the port and its parent, removes the endpoint,\nand if the port is now empty, marks it dead and unregisters the port\nby calling delete_switch_port(). There are two places during this work\nwhere the parent_port may be used after freeing:\n\nFirst, a concurrent detach may have already processed a port by the\ntime a second worker finds it via bus_find_device(). Without pinning\nparent_port, it may already be freed when we discover port->dead and\nattempt to unlock the parent_port. In a production kernel that's a\nsilent memory corruption, with lock debug, it looks like this:\n\n[]DEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current())\n[]WARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310\n[]Call Trace:\n[]mutex_unlock+0xd/0x20\n[]cxl_detach_ep+0x180/0x400 [cxl_core]\n[]devm_action_release+0x10/0x20\n[]devres_release_all+0xa8/0xe0\n[]device_unbind_cleanup+0xd/0xa0\n[]really_probe+0x1a6/0x3e0\n\nSecond, delete_switch_port() releases three devm actions registered\nagainst parent_port. The last of those is unregister_port() and it\ncalls device_unregister() on the child port, which can cascade. If\nparent_port is now also empty the device core may unregister and free\nit too. So by the time delete_switch_port() returns, parent_port may\nbe free, and the subsequent device_unlock(&parent_port->dev) operates\non freed memory. The kernel log looks same as above, with a different\noffset in cxl_detach_ep().\n\nBoth of these issues stem from the absence of a lifetime guarantee\nbetween a child port and its parent port.\n\nEstablish a lifetime rule for ports: child ports hold a reference to\ntheir parent device until release. Take the reference when the port\nis allocated and drop it when released. This ensures the parent is\nvalid for the full lifetime of the child and eliminates the use after\nfree window in cxl_detach_ep().\n\nThis is easily reproduced with a reload of cxl_acpi in QEMU with CXL\ndevices present."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncxl/port: Corrección de uso después de liberación de parent_port en cxl_detach_ep()\n\ncxl_detach_ep() es llamada durante la eliminación de abajo hacia arriba cuando todos los dispositivos de memoria CXL debajo de un puerto de switch han sido eliminados. Para cada puerto en la jerarquía, bloquea tanto el puerto como su padre, elimina el punto final, y si el puerto ahora está vacío, lo marca como muerto y anula el registro del puerto llamando a delete_switch_port(). Hay dos lugares durante este trabajo donde parent_port puede ser usado después de su liberación:\n\nPrimero, una desconexión concurrente puede haber procesado ya un puerto para cuando un segundo trabajador lo encuentra a través de bus_find_device(). Sin fijar parent_port, puede que ya esté liberado cuando descubrimos port -> dead e intentamos desbloquear parent_port. En un kernel de producción eso es una corrupción de memoria silenciosa, con depuración de bloqueo, se ve así:\n\nDEBUG_LOCKS_WARN_ON(__owner_task(owner) != get_current())\nWARNING: kernel/locking/mutex.c:949 at __mutex_unlock_slowpath+0x1ee/0x310\nTraza de Llamada:\nmutex_unlock+0xd/0x20\ncxl_detach_ep+0x180/0x400 [cxl_core]\ndevm_action_release+0x10/0x20\ndevres_release_all+0xa8/0xe0\ndevice_unbind_cleanup+0xd/0xa0\nreally_probe+0x1a6/0x3e0\n\nSegundo, delete_switch_port() libera tres acciones devm registradas contra parent_port. La última de ellas es unregister_port() y llama a device_unregister() en el puerto hijo, lo que puede generar una cascada. Si parent_port ahora también está vacío el núcleo del dispositivo puede anular su registro y liberarlo también. Así que para cuando delete_switch_port() regresa, parent_port puede estar libre, y el subsiguiente device_unlock(ref:parent_port -> dev) opera sobre memoria liberada. El registro del kernel se ve igual que el anterior, con un desplazamiento diferente en cxl_detach_ep().\n\nAmbos de estos problemas provienen de la ausencia de una garantía de vida útil entre un puerto hijo y su puerto padre.\n\nEstablecer una regla de vida útil para los puertos: los puertos hijos mantienen una referencia a su dispositivo padre hasta su liberación. Tomar la referencia cuando el puerto es asignado y soltarla cuando es liberado. Esto asegura que el padre sea válido durante toda la vida útil del hijo y elimina la ventana de uso después de liberación en cxl_detach_ep().\n\nEsto se reproduce fácilmente con una recarga de cxl_acpi en QEMU con dispositivos CXL presentes."}],"id":"CVE-2026-31530","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:47.922657Z","version":"2.0.3"}}]},"published":"2026-04-22T14:16:53.293","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/19d2f0b97a131198efc2c4ca3eb7f980bba8c2b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c32141462045cf93d54a5146a0ba572b83533dd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b1f62588ab1be6c9535d74348003c86b47ec4abd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d216a4bd138eb57cc4ae7c43b2f709e3482af7e2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7dc6f381a1e5f068333f1faa9265d6af1df4235"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31531.json b/data/2026/CVE-2026-31531.json index b218bb7c37..7eacb84f17 100644 --- a/data/2026/CVE-2026-31531.json +++ b/data/2026/CVE-2026-31531.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/nexthop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5f479aac1262959e54cdd978d873be5f202e2a40","status":"affected","version":"430a049190de3c9e219f43084de9f1122da04570","versionType":"git"},{"lessThan":"18a4543c1750f96be63e349936d2dfdcb360b2dc","status":"affected","version":"430a049190de3c9e219f43084de9f1122da04570","versionType":"git"},{"lessThan":"615517f3f8d53b0cf41507c7599971e17adfdfa5","status":"affected","version":"430a049190de3c9e219f43084de9f1122da04570","versionType":"git"},{"lessThan":"40bd39e383a0478fd5c221f393df05fd9d70cfbc","status":"affected","version":"430a049190de3c9e219f43084de9f1122da04570","versionType":"git"},{"lessThan":"635038fe19db391117e66b46bdc2b6e447ac801d","status":"affected","version":"430a049190de3c9e219f43084de9f1122da04570","versionType":"git"},{"lessThan":"14cf0cd35361f4e94824bf8a42f72713d7702a73","status":"affected","version":"430a049190de3c9e219f43084de9f1122da04570","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/nexthop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.3"},{"lessThan":"5.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A776C96C-AD0E-490C-AE7A-9FB2F402EB0D","versionEndExcluding":"6.12.83","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()\n\nWhen querying a nexthop object via RTM_GETNEXTHOP, the kernel currently\nallocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for\nsingle nexthops and small Equal-Cost Multi-Path groups, this fixed\nallocation fails for large nexthop groups like 512 nexthops.\n\nThis results in the following warning splat:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Call Trace:\n \n rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n netlink_sendmsg (net/netlink/af_netlink.c:1894)\n ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n ___sys_sendmsg (net/socket.c:2641)\n __sys_sendmsg (net/socket.c:2671)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \n\nFix this by allocating the size dynamically using nh_nlmsg_size() and\nusing nlmsg_new(), this is consistent with nexthop_notify() behavior. In\naddition, adjust nh_nlmsg_size_grp() so it calculates the size needed\nbased on flags passed. While at it, also add the size of NHA_FDB for\nnexthop group size calculation as it was missing too.\n\nThis cannot be reproduced via iproute2 as the group size is currently\nlimited and the command fails as follows:\n\naddattr_l ERROR: message exceeded bound of 1048"}],"id":"CVE-2026-31531","lastModified":"2026-11-05T22:18:38.863","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:53.479222Z","version":"2.0.3"}}]},"published":"2026-04-23T12:17:01.820","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14cf0cd35361f4e94824bf8a42f72713d7702a73"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/18a4543c1750f96be63e349936d2dfdcb360b2dc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40bd39e383a0478fd5c221f393df05fd9d70cfbc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5f479aac1262959e54cdd978d873be5f202e2a40"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/615517f3f8d53b0cf41507c7599971e17adfdfa5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/635038fe19db391117e66b46bdc2b6e447ac801d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/nexthop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5f479aac1262959e54cdd978d873be5f202e2a40","status":"affected","version":"430a049190de3c9e219f43084de9f1122da04570","versionType":"git"},{"lessThan":"18a4543c1750f96be63e349936d2dfdcb360b2dc","status":"affected","version":"430a049190de3c9e219f43084de9f1122da04570","versionType":"git"},{"lessThan":"615517f3f8d53b0cf41507c7599971e17adfdfa5","status":"affected","version":"430a049190de3c9e219f43084de9f1122da04570","versionType":"git"},{"lessThan":"40bd39e383a0478fd5c221f393df05fd9d70cfbc","status":"affected","version":"430a049190de3c9e219f43084de9f1122da04570","versionType":"git"},{"lessThan":"635038fe19db391117e66b46bdc2b6e447ac801d","status":"affected","version":"430a049190de3c9e219f43084de9f1122da04570","versionType":"git"},{"lessThan":"14cf0cd35361f4e94824bf8a42f72713d7702a73","status":"affected","version":"430a049190de3c9e219f43084de9f1122da04570","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/nexthop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.3"},{"lessThan":"5.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A776C96C-AD0E-490C-AE7A-9FB2F402EB0D","versionEndExcluding":"6.12.83","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()\n\nWhen querying a nexthop object via RTM_GETNEXTHOP, the kernel currently\nallocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for\nsingle nexthops and small Equal-Cost Multi-Path groups, this fixed\nallocation fails for large nexthop groups like 512 nexthops.\n\nThis results in the following warning splat:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Call Trace:\n \n rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n netlink_sendmsg (net/netlink/af_netlink.c:1894)\n ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n ___sys_sendmsg (net/socket.c:2641)\n __sys_sendmsg (net/socket.c:2671)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \n\nFix this by allocating the size dynamically using nh_nlmsg_size() and\nusing nlmsg_new(), this is consistent with nexthop_notify() behavior. In\naddition, adjust nh_nlmsg_size_grp() so it calculates the size needed\nbased on flags passed. While at it, also add the size of NHA_FDB for\nnexthop group size calculation as it was missing too.\n\nThis cannot be reproduced via iproute2 as the group size is currently\nlimited and the command fails as follows:\n\naddattr_l ERROR: message exceeded bound of 1048"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nipv4: nexthop: asignar skb dinámicamente en rtm_get_nexthop()\n\nAl consultar un objeto nexthop a través de RTM_GETNEXTHOP, el kernel actualmente\nasigna un skb de tamaño fijo usando NLMSG_GOODSIZE. Si bien es suficiente para\nnexthops individuales y grupos pequeños de rutas de costo igual (Equal-Cost Multi-Path), esta asignación\nfija falla para grupos grandes de nexthops como 512 nexthops.\n\nEsto resulta en el siguiente ’warning splat’:\n\n WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608\n [...]\n RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395)\n [...]\n Rastro de llamada:\n [TASK]\n rtnetlink_rcv_msg (net/core/rtnetlink.c:6989)\n netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)\n netlink_sendmsg (net/netlink/af_netlink.c:1894)\n ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585)\n ___sys_sendmsg (net/socket.c:2641)\n __sys_sendmsg (net/socket.c:2671)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n [/TASK]\n\nSolucione esto asignando el tamaño dinámicamente usando nh_nlmsg_size() y\nusando nlmsg_new(), esto es consistente con el comportamiento de nexthop_notify(). Además,\najuste nh_nlmsg_size_grp() para que calcule el tamaño necesario\nbasado en las banderas pasadas. Ya que estamos, también agregue el tamaño de NHA_FDB para\nel cálculo del tamaño del grupo nexthop, ya que también faltaba.\n\nEsto no puede ser reproducido a través de iproute2 ya que el tamaño del grupo está actualmente\nlimitado y el comando falla de la siguiente manera:\n\naddattr_l ERROR: el mensaje excedió el límite de 1048"}],"id":"CVE-2026-31531","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31531","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:53.479222Z","version":"2.0.3"}}]},"published":"2026-04-23T12:17:01.820","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/14cf0cd35361f4e94824bf8a42f72713d7702a73"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/18a4543c1750f96be63e349936d2dfdcb360b2dc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/40bd39e383a0478fd5c221f393df05fd9d70cfbc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5f479aac1262959e54cdd978d873be5f202e2a40"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/615517f3f8d53b0cf41507c7599971e17adfdfa5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/635038fe19db391117e66b46bdc2b6e447ac801d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31532.json b/data/2026/CVE-2026-31532.json index 657bb3b79c..ff1b7c1fb4 100644 --- a/data/2026/CVE-2026-31532.json +++ b/data/2026/CVE-2026-31532.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/can/raw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"64c8553decf5a5f2417bd54761ea0a832c56c4ca","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"3f43f12fde34737fba091b7e3ab391e14ddbb0be","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"5e9cfffad898bbeaafd0ea608a6d267362f050fc","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"572f0bf536ebc14f6e7da3d21a85cf076de8358e","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"7201a531b9a5ed892bfda5ded9194ef622de8ffa","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"34c1741254ff972e8375faf176678a248826fe3a","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"a535a9217ca3f2fccedaafb2fddb4c48f27d36dc","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/can/raw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.1"},{"lessThan":"4.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8685D118-4F50-41C7-BC57-C25C32A44EB6","versionEndIncluding":"6.6.136","versionStartIncluding":"4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4C4EAA6A-7949-4B29-BD69-5BB05C4D1A6B","versionEndExcluding":"6.18.24","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: raw: fix ro->uniq use-after-free in raw_rcv()\n\nraw_release() unregisters raw CAN receive filters via can_rx_unregister(),\nbut receiver deletion is deferred with call_rcu(). This leaves a window\nwhere raw_rcv() may still be running in an RCU read-side critical section\nafter raw_release() frees ro->uniq, leading to a use-after-free of the\npercpu uniq storage.\n\nMove free_percpu(ro->uniq) out of raw_release() and into a raw-specific\nsocket destructor. can_rx_unregister() takes an extra reference to the\nsocket and only drops it from the RCU callback, so freeing uniq from\nsk_destruct ensures the percpu area is not released until the relevant\ncallbacks have drained.\n\n[mkl: applied manually]"}],"id":"CVE-2026-31532","lastModified":"2026-10-19T19:17:59.040","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31532","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:40.984593Z","version":"2.0.3"}}]},"published":"2026-04-23T12:17:01.927","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/34c1741254ff972e8375faf176678a248826fe3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3f43f12fde34737fba091b7e3ab391e14ddbb0be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/572f0bf536ebc14f6e7da3d21a85cf076de8358e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e9cfffad898bbeaafd0ea608a6d267362f050fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/64c8553decf5a5f2417bd54761ea0a832c56c4ca"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7201a531b9a5ed892bfda5ded9194ef622de8ffa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a535a9217ca3f2fccedaafb2fddb4c48f27d36dc"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/can/raw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"64c8553decf5a5f2417bd54761ea0a832c56c4ca","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"3f43f12fde34737fba091b7e3ab391e14ddbb0be","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"5e9cfffad898bbeaafd0ea608a6d267362f050fc","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"572f0bf536ebc14f6e7da3d21a85cf076de8358e","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"7201a531b9a5ed892bfda5ded9194ef622de8ffa","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"34c1741254ff972e8375faf176678a248826fe3a","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"},{"lessThan":"a535a9217ca3f2fccedaafb2fddb4c48f27d36dc","status":"affected","version":"514ac99c64b22d83b52dfee3b8becaa69a92bc4a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/can/raw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.1"},{"lessThan":"4.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8685D118-4F50-41C7-BC57-C25C32A44EB6","versionEndIncluding":"6.6.136","versionStartIncluding":"4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4C4EAA6A-7949-4B29-BD69-5BB05C4D1A6B","versionEndExcluding":"6.18.24","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: raw: fix ro->uniq use-after-free in raw_rcv()\n\nraw_release() unregisters raw CAN receive filters via can_rx_unregister(),\nbut receiver deletion is deferred with call_rcu(). This leaves a window\nwhere raw_rcv() may still be running in an RCU read-side critical section\nafter raw_release() frees ro->uniq, leading to a use-after-free of the\npercpu uniq storage.\n\nMove free_percpu(ro->uniq) out of raw_release() and into a raw-specific\nsocket destructor. can_rx_unregister() takes an extra reference to the\nsocket and only drops it from the RCU callback, so freeing uniq from\nsk_destruct ensures the percpu area is not released until the relevant\ncallbacks have drained.\n\n[mkl: applied manually]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncan: raw: corregir el uso después de liberación de ro -> uniq en raw_rcv()\n\nraw_release() anula el registro de los filtros de recepción CAN raw a través de can_rx_unregister(), pero la eliminación del receptor se difiere con call_rcu(). Esto deja una ventana donde raw_rcv() aún puede estar ejecutándose en una sección crítica del lado de lectura de RCU después de que raw_release() libera ro -> uniq, lo que lleva a un uso después de liberación del almacenamiento percpu uniq.\n\nMover free_percpu(ro -> uniq) fuera de raw_release() y a un destructor de socket específico de raw. can_rx_unregister() toma una referencia adicional al socket y solo la libera desde la devolución de llamada RCU, por lo que liberar uniq desde sk_destruct asegura que el área percpu no se libera hasta que las devoluciones de llamada relevantes se hayan procesado.\n\n[mkl: aplicado manualmente]"}],"id":"CVE-2026-31532","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31532","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:40.984593Z","version":"2.0.3"}}]},"published":"2026-04-23T12:17:01.927","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/34c1741254ff972e8375faf176678a248826fe3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3f43f12fde34737fba091b7e3ab391e14ddbb0be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/572f0bf536ebc14f6e7da3d21a85cf076de8358e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e9cfffad898bbeaafd0ea608a6d267362f050fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/64c8553decf5a5f2417bd54761ea0a832c56c4ca"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7201a531b9a5ed892bfda5ded9194ef622de8ffa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a535a9217ca3f2fccedaafb2fddb4c48f27d36dc"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31533.json b/data/2026/CVE-2026-31533.json index 2adeab7de8..9ae7626647 100644 --- a/data/2026/CVE-2026-31533.json +++ b/data/2026/CVE-2026-31533.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/tls/tls_sw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"414fc5e5a5aff776c150f1b86770e0a25a35df3a","status":"affected","version":"3ade391adc584f17b5570fd205de3ad029090368","versionType":"git"},{"lessThan":"02f3ecadb23558bbe068e6504118f1b712d4ece0","status":"affected","version":"cd1bbca03f3c1d845ce274c0d0a66de8e5929f72","versionType":"git"},{"lessThan":"0e43e0a3c94044acc74b8e0927c27972eb5a59e8","status":"affected","version":"13eca403876bbea3716e82cdfe6f1e6febb38754","versionType":"git"},{"lessThan":"aa9facde6c5005205874c37db3fd25799d741baf","status":"affected","version":"8590541473188741055d27b955db0777569438e3","versionType":"git"},{"lessThan":"5d70eb25b41e9b010828cd12818b06a0c3b04412","status":"affected","version":"8590541473188741055d27b955db0777569438e3","versionType":"git"},{"lessThan":"2694d408b0e595024e0fc1d64ff9db0358580f74","status":"affected","version":"8590541473188741055d27b955db0777569438e3","versionType":"git"},{"lessThan":"a9b8b18364fffce4c451e6f6fd218fa4ab646705","status":"affected","version":"8590541473188741055d27b955db0777569438e3","versionType":"git"},{"status":"affected","version":"ab6397f072e5097f267abf5cb08a8004e6b17694","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.160","versionType":"semver"},{"lessThan":"6.1.169","status":"affected","version":"6.1.84","versionType":"semver"},{"lessThan":"6.6.135","status":"affected","version":"6.6.18","versionType":"semver"},{"lessThan":"6.8","status":"affected","version":"6.7.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/tls/tls_sw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A29AFD5E-6896-4DFA-8018-AFA880F634CC","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.160","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"118714D3-361A-4D4F-BE4E-F7CF8690973B","versionEndExcluding":"6.1.169","versionStartIncluding":"6.1.84","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FB41CC30-AD79-4103-B14D-D6DE8056D2C0","versionEndExcluding":"6.6.135","versionStartIncluding":"6.6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9048C5C2-5073-4D52-BC14-154912BA5D82","versionEndExcluding":"6.8","versionStartIncluding":"6.7.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"22EC6892-A996-4004-BCB5-EB94BBD59707","versionEndExcluding":"6.12.82","versionStartIncluding":"6.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: fix use-after-free in -EBUSY error path of tls_do_encryption\n\nThe -EBUSY handling in tls_do_encryption(), introduced by commit\n859054147318 (\"net: tls: handle backlogging of crypto requests\"), has\na use-after-free due to double cleanup of encrypt_pending and the\nscatterlist entry.\n\nWhen crypto_aead_encrypt() returns -EBUSY, the request is enqueued to\nthe cryptd backlog and the async callback tls_encrypt_done() will be\ninvoked upon completion. That callback unconditionally restores the\nscatterlist entry (sge->offset, sge->length) and decrements\nctx->encrypt_pending. However, if tls_encrypt_async_wait() returns an\nerror, the synchronous error path in tls_do_encryption() performs the\nsame cleanup again, double-decrementing encrypt_pending and\ndouble-restoring the scatterlist.\n\nThe double-decrement corrupts the encrypt_pending sentinel (initialized\nto 1), making tls_encrypt_async_wait() permanently skip the wait for\npending async callbacks. A subsequent sendmsg can then free the\ntls_rec via bpf_exec_tx_verdict() while a cryptd callback is still\npending, resulting in a use-after-free when the callback fires on the\nfreed record.\n\nFix this by skipping the synchronous cleanup when the -EBUSY async\nwait returns an error, since the callback has already handled\nencrypt_pending and sge restoration."}],"id":"CVE-2026-31533","lastModified":"2026-11-10T13:18:58.867","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31533","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:43.493740Z","version":"2.0.3"}}]},"published":"2026-04-23T18:16:26.857","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/02f3ecadb23558bbe068e6504118f1b712d4ece0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e43e0a3c94044acc74b8e0927c27972eb5a59e8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2694d408b0e595024e0fc1d64ff9db0358580f74"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/414fc5e5a5aff776c150f1b86770e0a25a35df3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5d70eb25b41e9b010828cd12818b06a0c3b04412"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a9b8b18364fffce4c451e6f6fd218fa4ab646705"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aa9facde6c5005205874c37db3fd25799d741baf"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/tls/tls_sw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"414fc5e5a5aff776c150f1b86770e0a25a35df3a","status":"affected","version":"3ade391adc584f17b5570fd205de3ad029090368","versionType":"git"},{"lessThan":"02f3ecadb23558bbe068e6504118f1b712d4ece0","status":"affected","version":"cd1bbca03f3c1d845ce274c0d0a66de8e5929f72","versionType":"git"},{"lessThan":"0e43e0a3c94044acc74b8e0927c27972eb5a59e8","status":"affected","version":"13eca403876bbea3716e82cdfe6f1e6febb38754","versionType":"git"},{"lessThan":"aa9facde6c5005205874c37db3fd25799d741baf","status":"affected","version":"8590541473188741055d27b955db0777569438e3","versionType":"git"},{"lessThan":"5d70eb25b41e9b010828cd12818b06a0c3b04412","status":"affected","version":"8590541473188741055d27b955db0777569438e3","versionType":"git"},{"lessThan":"2694d408b0e595024e0fc1d64ff9db0358580f74","status":"affected","version":"8590541473188741055d27b955db0777569438e3","versionType":"git"},{"lessThan":"a9b8b18364fffce4c451e6f6fd218fa4ab646705","status":"affected","version":"8590541473188741055d27b955db0777569438e3","versionType":"git"},{"status":"affected","version":"ab6397f072e5097f267abf5cb08a8004e6b17694","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.160","versionType":"semver"},{"lessThan":"6.1.169","status":"affected","version":"6.1.84","versionType":"semver"},{"lessThan":"6.6.135","status":"affected","version":"6.6.18","versionType":"semver"},{"lessThan":"6.8","status":"affected","version":"6.7.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/tls/tls_sw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.8"},{"lessThan":"6.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A29AFD5E-6896-4DFA-8018-AFA880F634CC","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.160","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"118714D3-361A-4D4F-BE4E-F7CF8690973B","versionEndExcluding":"6.1.169","versionStartIncluding":"6.1.84","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FB41CC30-AD79-4103-B14D-D6DE8056D2C0","versionEndExcluding":"6.6.135","versionStartIncluding":"6.6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9048C5C2-5073-4D52-BC14-154912BA5D82","versionEndExcluding":"6.8","versionStartIncluding":"6.7.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"22EC6892-A996-4004-BCB5-EB94BBD59707","versionEndExcluding":"6.12.82","versionStartIncluding":"6.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: fix use-after-free in -EBUSY error path of tls_do_encryption\n\nThe -EBUSY handling in tls_do_encryption(), introduced by commit\n859054147318 (\"net: tls: handle backlogging of crypto requests\"), has\na use-after-free due to double cleanup of encrypt_pending and the\nscatterlist entry.\n\nWhen crypto_aead_encrypt() returns -EBUSY, the request is enqueued to\nthe cryptd backlog and the async callback tls_encrypt_done() will be\ninvoked upon completion. That callback unconditionally restores the\nscatterlist entry (sge->offset, sge->length) and decrements\nctx->encrypt_pending. However, if tls_encrypt_async_wait() returns an\nerror, the synchronous error path in tls_do_encryption() performs the\nsame cleanup again, double-decrementing encrypt_pending and\ndouble-restoring the scatterlist.\n\nThe double-decrement corrupts the encrypt_pending sentinel (initialized\nto 1), making tls_encrypt_async_wait() permanently skip the wait for\npending async callbacks. A subsequent sendmsg can then free the\ntls_rec via bpf_exec_tx_verdict() while a cryptd callback is still\npending, resulting in a use-after-free when the callback fires on the\nfreed record.\n\nFix this by skipping the synchronous cleanup when the -EBUSY async\nwait returns an error, since the callback has already handled\nencrypt_pending and sge restoration."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/tls: corrige uso después de liberación en la ruta de error -EBUSY de tls_do_encryption\n\nEl manejo de -EBUSY en tls_do_encryption(), introducido por el commit 859054147318 (’net: tls: maneja el retraso de las solicitudes criptográficas’), tiene un uso después de liberación debido a la doble limpieza de encrypt_pending y la entrada de scatterlist.\n\nCuando crypto_aead_encrypt() devuelve -EBUSY, la solicitud se encola en el backlog de cryptd y la devolución de llamada asíncrona tls_encrypt_done() será invocada al finalizar. Esa devolución de llamada restaura incondicionalmente la entrada de scatterlist (sge -> offset, sge -> length) y decrementa ctx -> encrypt_pending. Sin embargo, si tls_encrypt_async_wait() devuelve un error, la ruta de error síncrona en tls_do_encryption() realiza la misma limpieza de nuevo, decrementando doblemente encrypt_pending y restaurando doblemente el scatterlist.\n\nEl doble decremento corrompe el centinela encrypt_pending (inicializado a 1), haciendo que tls_encrypt_async_wait() omita permanentemente la espera de las devoluciones de llamada asíncronas pendientes. Un sendmsg posterior puede entonces liberar el tls_rec a través de bpf_exec_tx_verdict() mientras una devolución de llamada de cryptd aún está pendiente, resultando en un uso después de liberación cuando la devolución de llamada se activa en el registro liberado.\n\nSoluciona esto omitiendo la limpieza síncrona cuando la espera asíncrona de -EBUSY devuelve un error, ya que la devolución de llamada ya ha manejado la restauración de encrypt_pending y sge."}],"id":"CVE-2026-31533","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31533","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:43.493740Z","version":"2.0.3"}}]},"published":"2026-04-23T18:16:26.857","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/02f3ecadb23558bbe068e6504118f1b712d4ece0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e43e0a3c94044acc74b8e0927c27972eb5a59e8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2694d408b0e595024e0fc1d64ff9db0358580f74"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/414fc5e5a5aff776c150f1b86770e0a25a35df3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5d70eb25b41e9b010828cd12818b06a0c3b04412"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a9b8b18364fffce4c451e6f6fd218fa4ab646705"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aa9facde6c5005205874c37db3fd25799d741baf"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31535.json b/data/2026/CVE-2026-31535.json index 5542d3c8f4..921b48a685 100644 --- a/data/2026/CVE-2026-31535.json +++ b/data/2026/CVE-2026-31535.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smbdirect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f664e6e8a81103cb45c8802a9bc7499e0902c458","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"},{"lessThan":"be8845ad5d6558703d20567d8702155598325db8","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"},{"lessThan":"9911b1ed187a770a43950bf51f340ad4b7beecba","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smbdirect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1D06FE45-F85F-4F59-A12C-C72C3C580DA4","versionEndExcluding":"6.18.11","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EE543C0D-A06B-414F-A403-CB1E088F261E","versionEndExcluding":"6.19.1","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: make use of smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer."}],"id":"CVE-2026-31535","lastModified":"2026-11-05T22:18:39.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31535","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:58.578551Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:27.427","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9911b1ed187a770a43950bf51f340ad4b7beecba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/be8845ad5d6558703d20567d8702155598325db8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f664e6e8a81103cb45c8802a9bc7499e0902c458"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smbdirect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f664e6e8a81103cb45c8802a9bc7499e0902c458","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"},{"lessThan":"be8845ad5d6558703d20567d8702155598325db8","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"},{"lessThan":"9911b1ed187a770a43950bf51f340ad4b7beecba","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smbdirect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1D06FE45-F85F-4F59-A12C-C72C3C580DA4","versionEndExcluding":"6.18.11","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EE543C0D-A06B-414F-A403-CB1E088F261E","versionEndExcluding":"6.19.1","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: make use of smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: cliente: hacer uso de smbdirect_socket.recv_io.credits.available\n\nLa lógica de gestionar los créditos de recv contando los recv_io publicados y los créditos concedidos es propensa a condiciones de carrera.\n\nEsto se debe a que el par podría haber consumido ya un crédito, pero entre la recepción del recv entrante en el hardware y el procesamiento de la finalización en las funciones ’recv_done’, es probable que tengamos una ventana donde concedemos créditos que en realidad no existen.\n\nAsí que es mejor tener un contador dedicado para los créditos disponibles, el cual será incrementado cuando publiquemos nuevos búferes de recv y vaciado cuando concedamos los créditos al par."}],"id":"CVE-2026-31535","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31535","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:37:58.578551Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:27.427","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9911b1ed187a770a43950bf51f340ad4b7beecba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/be8845ad5d6558703d20567d8702155598325db8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f664e6e8a81103cb45c8802a9bc7499e0902c458"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31536.json b/data/2026/CVE-2026-31536.json index e96474ce93..2418b734ba 100644 --- a/data/2026/CVE-2026-31536.json +++ b/data/2026/CVE-2026-31536.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"24082642654f3e5149913946e89c00a297a8868f","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"e38b415c024bc3b6321bf8650dbf3f4aab8e74b3","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"9da82dc73cb03e85d716a2609364572367a5ff47","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15E921F5-9862-4FCB-AB2A-5ADDE34536EF","versionEndExcluding":"6.18.11","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EE543C0D-A06B-414F-A403-CB1E088F261E","versionEndExcluding":"6.19.1","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: let send_done handle a completion without IB_SEND_SIGNALED\n\nWith smbdirect_send_batch processing we likely have requests without\nIB_SEND_SIGNALED, which will be destroyed in the final request\nthat has IB_SEND_SIGNALED set.\n\nIf the connection is broken all requests are signaled\neven without explicit IB_SEND_SIGNALED."}],"id":"CVE-2026-31536","lastModified":"2026-06-17T10:33:56.000","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:27.530","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/24082642654f3e5149913946e89c00a297a8868f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9da82dc73cb03e85d716a2609364572367a5ff47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e38b415c024bc3b6321bf8650dbf3f4aab8e74b3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"24082642654f3e5149913946e89c00a297a8868f","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"e38b415c024bc3b6321bf8650dbf3f4aab8e74b3","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"9da82dc73cb03e85d716a2609364572367a5ff47","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15E921F5-9862-4FCB-AB2A-5ADDE34536EF","versionEndExcluding":"6.18.11","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EE543C0D-A06B-414F-A403-CB1E088F261E","versionEndExcluding":"6.19.1","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: let send_done handle a completion without IB_SEND_SIGNALED\n\nWith smbdirect_send_batch processing we likely have requests without\nIB_SEND_SIGNALED, which will be destroyed in the final request\nthat has IB_SEND_SIGNALED set.\n\nIf the connection is broken all requests are signaled\neven without explicit IB_SEND_SIGNALED."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: servidor: permitir que send_done maneje una finalización sin IB_SEND_SIGNALED\n\nCon el procesamiento de smbdirect_send_batch probablemente tenemos solicitudes sin IB_SEND_SIGNALED, las cuales serán destruidas en la solicitud final que tiene IB_SEND_SIGNALED establecido.\n\nSi la conexión se rompe, todas las solicitudes son señalizadas incluso sin IB_SEND_SIGNALED explícito."}],"id":"CVE-2026-31536","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:27.530","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/24082642654f3e5149913946e89c00a297a8868f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9da82dc73cb03e85d716a2609364572367a5ff47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e38b415c024bc3b6321bf8650dbf3f4aab8e74b3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31537.json b/data/2026/CVE-2026-31537.json index 03eede0473..448c15d70a 100644 --- a/data/2026/CVE-2026-31537.json +++ b/data/2026/CVE-2026-31537.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"79242e7b6bc63efec28b7c235bc320806afce6c0","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15E921F5-9862-4FCB-AB2A-5ADDE34536EF","versionEndExcluding":"6.18.11","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EE543C0D-A06B-414F-A403-CB1E088F261E","versionEndExcluding":"6.19.1","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: make use of smbdirect_socket.send_io.bcredits\n\nIt turns out that our code will corrupt the stream of\nreassabled data transfer messages when we trigger an\nimmendiate (empty) send.\n\nIn order to fix this we'll have a single 'batch' credit per\nconnection. And code getting that credit is free to use\nas much messages until remaining_length reaches 0, then\nthe batch credit it given back and the next logical send can\nhappen."}],"id":"CVE-2026-31537","lastModified":"2026-06-17T10:33:56.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:27.633","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/34abd408c8ba24d7c97bd02ba874d8c714f49db1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/79242e7b6bc63efec28b7c235bc320806afce6c0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"79242e7b6bc63efec28b7c235bc320806afce6c0","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"},{"lessThan":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","status":"affected","version":"0626e6641f6b467447c81dd7678a69c66f7746cf","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15E921F5-9862-4FCB-AB2A-5ADDE34536EF","versionEndExcluding":"6.18.11","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EE543C0D-A06B-414F-A403-CB1E088F261E","versionEndExcluding":"6.19.1","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: make use of smbdirect_socket.send_io.bcredits\n\nIt turns out that our code will corrupt the stream of\nreassabled data transfer messages when we trigger an\nimmendiate (empty) send.\n\nIn order to fix this we'll have a single 'batch' credit per\nconnection. And code getting that credit is free to use\nas much messages until remaining_length reaches 0, then\nthe batch credit it given back and the next logical send can\nhappen."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: servidor: hacer uso de smbdirect_socket.send_io.bcredits\n\nResulta que nuestro código corromperá el flujo de mensajes de transferencia de datos reensamblados cuando activamos un envío inmediato (vacío).\n\nPara solucionar esto, tendremos un único crédito ’batch’ por conexión. Y el código que obtiene ese crédito es libre de usar tantos mensajes hasta que remaining_length llegue a 0, entonces el crédito batch es devuelto y el siguiente envío lógico puede ocurrir."}],"id":"CVE-2026-31537","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:27.633","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/34abd408c8ba24d7c97bd02ba874d8c714f49db1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/79242e7b6bc63efec28b7c235bc320806afce6c0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31538.json b/data/2026/CVE-2026-31538.json index 2f2d81f6a2..14efba3c54 100644 --- a/data/2026/CVE-2026-31538.json +++ b/data/2026/CVE-2026-31538.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"66c082e3d4651e8629a393a9e182b01eb50fb0a3","status":"affected","version":"89b021a72663c4d96d8a8b85272bb42d991a1c6f","versionType":"git"},{"lessThan":"809cbd31aa4f87a1b889532244c9cf30eb022385","status":"affected","version":"89b021a72663c4d96d8a8b85272bb42d991a1c6f","versionType":"git"},{"lessThan":"26ad87a2cfb8c1384620d1693a166ed87303046e","status":"affected","version":"89b021a72663c4d96d8a8b85272bb42d991a1c6f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1D06FE45-F85F-4F59-A12C-C72C3C580DA4","versionEndExcluding":"6.18.11","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EE543C0D-A06B-414F-A403-CB1E088F261E","versionEndExcluding":"6.19.1","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: make use of smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer.\n\nThis fixes regression Namjae reported with\nthe 6.18 release."}],"id":"CVE-2026-31538","lastModified":"2026-06-17T10:33:56.200","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:27.740","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26ad87a2cfb8c1384620d1693a166ed87303046e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66c082e3d4651e8629a393a9e182b01eb50fb0a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/809cbd31aa4f87a1b889532244c9cf30eb022385"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"66c082e3d4651e8629a393a9e182b01eb50fb0a3","status":"affected","version":"89b021a72663c4d96d8a8b85272bb42d991a1c6f","versionType":"git"},{"lessThan":"809cbd31aa4f87a1b889532244c9cf30eb022385","status":"affected","version":"89b021a72663c4d96d8a8b85272bb42d991a1c6f","versionType":"git"},{"lessThan":"26ad87a2cfb8c1384620d1693a166ed87303046e","status":"affected","version":"89b021a72663c4d96d8a8b85272bb42d991a1c6f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1D06FE45-F85F-4F59-A12C-C72C3C580DA4","versionEndExcluding":"6.18.11","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EE543C0D-A06B-414F-A403-CB1E088F261E","versionEndExcluding":"6.19.1","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: make use of smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer.\n\nThis fixes regression Namjae reported with\nthe 6.18 release."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: servidor: hacer uso de smbdirect_socket.recv_io.credits.available\n\nLa lógica de gestionar los créditos de recepción contando los recv_io publicados y los créditos concedidos es propensa a condiciones de carrera.\n\nEsto se debe a que el par podría haber consumido ya un crédito, pero entre la recepción del recv entrante en el hardware y el procesamiento de la finalización en las funciones ’recv_done’ es probable que tengamos una ventana donde concedemos créditos que en realidad no existen.\n\nAsí que es mejor tener un contador dedicado para los créditos disponibles, el cual se incrementará cuando publiquemos nuevos búferes de recepción y se vaciará cuando concedamos los créditos al par.\n\nEsto corrige la regresión que Namjae informó con la versión 6.18."}],"id":"CVE-2026-31538","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:27.740","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/26ad87a2cfb8c1384620d1693a166ed87303046e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66c082e3d4651e8629a393a9e182b01eb50fb0a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/809cbd31aa4f87a1b889532244c9cf30eb022385"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31539.json b/data/2026/CVE-2026-31539.json index 6f9a8a8ce3..017da9ac64 100644 --- a/data/2026/CVE-2026-31539.json +++ b/data/2026/CVE-2026-31539.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/common/smbdirect/smbdirect_socket.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e811e60e1cc79923c4388146eb1fa26a7482731e","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"},{"lessThan":"f99996870222b598914a1f49d7375dc23752c237","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"},{"lessThan":"6e3c5052f9686192e178806e017b7377155f4bab","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/common/smbdirect/smbdirect_socket.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1D06FE45-F85F-4F59-A12C-C72C3C580DA4","versionEndExcluding":"6.18.11","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EE543C0D-A06B-414F-A403-CB1E088F261E","versionEndExcluding":"6.19.1","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: smbdirect: introduce smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer."}],"id":"CVE-2026-31539","lastModified":"2026-10-19T19:17:59.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31539","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:46.426998Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:27.843","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e3c5052f9686192e178806e017b7377155f4bab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e811e60e1cc79923c4388146eb1fa26a7482731e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f99996870222b598914a1f49d7375dc23752c237"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/common/smbdirect/smbdirect_socket.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e811e60e1cc79923c4388146eb1fa26a7482731e","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"},{"lessThan":"f99996870222b598914a1f49d7375dc23752c237","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"},{"lessThan":"6e3c5052f9686192e178806e017b7377155f4bab","status":"affected","version":"5fb9b459b3686e366640edd4e62805ef7b4de927","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/common/smbdirect/smbdirect_socket.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1D06FE45-F85F-4F59-A12C-C72C3C580DA4","versionEndExcluding":"6.18.11","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EE543C0D-A06B-414F-A403-CB1E088F261E","versionEndExcluding":"6.19.1","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: smbdirect: introduce smbdirect_socket.recv_io.credits.available\n\nThe logic off managing recv credits by counting posted recv_io and\ngranted credits is racy.\n\nThat's because the peer might already consumed a credit,\nbut between receiving the incoming recv at the hardware\nand processing the completion in the 'recv_done' functions\nwe likely have a window where we grant credits, which\ndon't really exist.\n\nSo we better have a decicated counter for the\navailable credits, which will be incremented\nwhen we posted new recv buffers and drained when\nwe grant the credits to the peer."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: smbdirect: se introduce smbdirect_socket.recv_io.credits.available\n\nLa lógica de gestionar los créditos recv contando los recv_io publicados y los créditos concedidos es propensa a condiciones de carrera.\n\nEsto se debe a que el par ya podría haber consumido un crédito, pero entre la recepción del recv entrante en el hardware y el procesamiento de la finalización en las funciones ’recv_done’ es probable que tengamos una ventana donde concedemos créditos que en realidad no existen.\n\nAsí que es mejor tener un contador dedicado para los créditos disponibles, el cual será incrementado cuando publiquemos nuevos búferes recv y disminuido cuando concedamos los créditos al par."}],"id":"CVE-2026-31539","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31539","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:46.426998Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:27.843","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e3c5052f9686192e178806e017b7377155f4bab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e811e60e1cc79923c4388146eb1fa26a7482731e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f99996870222b598914a1f49d7375dc23752c237"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31540.json b/data/2026/CVE-2026-31540.json index d675be6f02..efa2e4056d 100644 --- a/data/2026/CVE-2026-31540.json +++ b/data/2026/CVE-2026-31540.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/i915/gt/intel_engine_cs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"db8b1bebe81ffb410ddd746b6869f72e22420850","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"},{"lessThan":"da6552d67012a1cf0585f2eb401d0c4abcf108c9","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"},{"lessThan":"df1f4a7d9cf689b4e96c95255228896505f44c31","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"},{"lessThan":"2e20a886b443a71b573ceaed3ca7053d15380916","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"},{"lessThan":"cf4b224ffb9a58181be32b64130fc36cf59c3192","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"},{"lessThan":"1a16150729db8d997e39519f9d58e6b435c4c087","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"},{"lessThan":"0162ab3220bac870e43e229e6e3024d1a21c3f26","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/i915/gt/intel_engine_cs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1DBCF7FC-ED56-411B-9D33-F0CEF61B6F85","versionEndExcluding":"5.15.203","versionStartIncluding":"4.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Check set_default_submission() before deferencing\n\nWhen the i915 driver firmware binaries are not present, the\nset_default_submission pointer is not set. This pointer is\ndereferenced during suspend anyways.\n\nAdd a check to make sure it is set before dereferencing.\n\n[ 23.289926] PM: suspend entry (deep)\n[ 23.293558] Filesystems sync: 0.000 seconds\n[ 23.298010] Freezing user space processes\n[ 23.302771] Freezing user space processes completed (elapsed 0.000 seconds)\n[ 23.309766] OOM killer disabled.\n[ 23.313027] Freezing remaining freezable tasks\n[ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)\n[ 23.342038] serial 00:05: disabled\n[ 23.345719] serial 00:02: disabled\n[ 23.349342] serial 00:01: disabled\n[ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache\n[ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache\n[ 23.361635] ata1.00: Entering standby power mode\n[ 23.368863] ata2.00: Entering standby power mode\n[ 23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 23.452194] #PF: supervisor instruction fetch in kernel mode\n[ 23.457896] #PF: error_code(0x0010) - not-present page\n[ 23.463065] PGD 0 P4D 0\n[ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI\n[ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)\n[ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN\n[ 23.496511] Workqueue: async async_run_entry_fn\n[ 23.501087] RIP: 0010:0x0\n[ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n[ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246\n[ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f\n[ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000\n[ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff\n[ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8\n[ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68\n[ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000\n[ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0\n[ 23.572539] PKRU: 55555554\n[ 23.575281] Call Trace:\n[ 23.577770] \n[ 23.579905] intel_engines_reset_default_submission+0x42/0x60\n[ 23.585695] __intel_gt_unset_wedged+0x191/0x200\n[ 23.590360] intel_gt_unset_wedged+0x20/0x40\n[ 23.594675] gt_sanitize+0x15e/0x170\n[ 23.598290] i915_gem_suspend_late+0x6b/0x180\n[ 23.602692] i915_drm_suspend_late+0x35/0xf0\n[ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10\n[ 23.611843] dpm_run_callback+0x78/0x1c0\n[ 23.615817] device_suspend_late+0xde/0x2e0\n[ 23.620037] async_suspend_late+0x18/0x30\n[ 23.624082] async_run_entry_fn+0x25/0xa0\n[ 23.628129] process_one_work+0x15b/0x380\n[ 23.632182] worker_thread+0x2a5/0x3c0\n[ 23.635973] ? __pfx_worker_thread+0x10/0x10\n[ 23.640279] kthread+0xf6/0x1f0\n[ 23.643464] ? __pfx_kthread+0x10/0x10\n[ 23.647263] ? __pfx_kthread+0x10/0x10\n[ 23.651045] ret_from_fork+0x131/0x190\n[ 23.654837] ? __pfx_kthread+0x10/0x10\n[ 23.658634] ret_from_fork_asm+0x1a/0x30\n[ 23.662597] \n[ 23.664826] Modules linked in:\n[ 23.667914] CR2: 0000000000000000\n[ 23.671271] ------------[ cut here ]------------\n\n(cherry picked from commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad)"}],"id":"CVE-2026-31540","lastModified":"2026-11-05T22:18:39.203","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31540","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:07.826588Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:27.957","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0162ab3220bac870e43e229e6e3024d1a21c3f26"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a16150729db8d997e39519f9d58e6b435c4c087"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e20a886b443a71b573ceaed3ca7053d15380916"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cf4b224ffb9a58181be32b64130fc36cf59c3192"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/da6552d67012a1cf0585f2eb401d0c4abcf108c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/db8b1bebe81ffb410ddd746b6869f72e22420850"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df1f4a7d9cf689b4e96c95255228896505f44c31"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/i915/gt/intel_engine_cs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"db8b1bebe81ffb410ddd746b6869f72e22420850","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"},{"lessThan":"da6552d67012a1cf0585f2eb401d0c4abcf108c9","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"},{"lessThan":"df1f4a7d9cf689b4e96c95255228896505f44c31","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"},{"lessThan":"2e20a886b443a71b573ceaed3ca7053d15380916","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"},{"lessThan":"cf4b224ffb9a58181be32b64130fc36cf59c3192","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"},{"lessThan":"1a16150729db8d997e39519f9d58e6b435c4c087","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"},{"lessThan":"0162ab3220bac870e43e229e6e3024d1a21c3f26","status":"affected","version":"ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/i915/gt/intel_engine_cs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1DBCF7FC-ED56-411B-9D33-F0CEF61B6F85","versionEndExcluding":"5.15.203","versionStartIncluding":"4.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Check set_default_submission() before deferencing\n\nWhen the i915 driver firmware binaries are not present, the\nset_default_submission pointer is not set. This pointer is\ndereferenced during suspend anyways.\n\nAdd a check to make sure it is set before dereferencing.\n\n[ 23.289926] PM: suspend entry (deep)\n[ 23.293558] Filesystems sync: 0.000 seconds\n[ 23.298010] Freezing user space processes\n[ 23.302771] Freezing user space processes completed (elapsed 0.000 seconds)\n[ 23.309766] OOM killer disabled.\n[ 23.313027] Freezing remaining freezable tasks\n[ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)\n[ 23.342038] serial 00:05: disabled\n[ 23.345719] serial 00:02: disabled\n[ 23.349342] serial 00:01: disabled\n[ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache\n[ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache\n[ 23.361635] ata1.00: Entering standby power mode\n[ 23.368863] ata2.00: Entering standby power mode\n[ 23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 23.452194] #PF: supervisor instruction fetch in kernel mode\n[ 23.457896] #PF: error_code(0x0010) - not-present page\n[ 23.463065] PGD 0 P4D 0\n[ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI\n[ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)\n[ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN\n[ 23.496511] Workqueue: async async_run_entry_fn\n[ 23.501087] RIP: 0010:0x0\n[ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n[ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246\n[ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f\n[ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000\n[ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff\n[ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8\n[ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68\n[ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000\n[ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0\n[ 23.572539] PKRU: 55555554\n[ 23.575281] Call Trace:\n[ 23.577770] \n[ 23.579905] intel_engines_reset_default_submission+0x42/0x60\n[ 23.585695] __intel_gt_unset_wedged+0x191/0x200\n[ 23.590360] intel_gt_unset_wedged+0x20/0x40\n[ 23.594675] gt_sanitize+0x15e/0x170\n[ 23.598290] i915_gem_suspend_late+0x6b/0x180\n[ 23.602692] i915_drm_suspend_late+0x35/0xf0\n[ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10\n[ 23.611843] dpm_run_callback+0x78/0x1c0\n[ 23.615817] device_suspend_late+0xde/0x2e0\n[ 23.620037] async_suspend_late+0x18/0x30\n[ 23.624082] async_run_entry_fn+0x25/0xa0\n[ 23.628129] process_one_work+0x15b/0x380\n[ 23.632182] worker_thread+0x2a5/0x3c0\n[ 23.635973] ? __pfx_worker_thread+0x10/0x10\n[ 23.640279] kthread+0xf6/0x1f0\n[ 23.643464] ? __pfx_kthread+0x10/0x10\n[ 23.647263] ? __pfx_kthread+0x10/0x10\n[ 23.651045] ret_from_fork+0x131/0x190\n[ 23.654837] ? __pfx_kthread+0x10/0x10\n[ 23.658634] ret_from_fork_asm+0x1a/0x30\n[ 23.662597] \n[ 23.664826] Modules linked in:\n[ 23.667914] CR2: 0000000000000000\n[ 23.671271] ------------[ cut here ]------------\n\n(cherry picked from commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/i915/gt: Comprobar set_default_submission() antes de desreferenciar\n\nCuando los binarios del firmware del controlador i915 no están presentes, el puntero set_default_submission no se establece. Este puntero es desreferenciado durante la suspensión de todos modos.\n\nAñadir una comprobación para asegurar que esté establecido antes de desreferenciar.\n\n[ 23.289926] PM: entrada de suspensión (profunda)\n[ 23.293558] Sincronización de sistemas de archivos: 0.000 segundos\n[ 23.298010] Congelando procesos del espacio de usuario\n[ 23.302771] Congelación de procesos del espacio de usuario completada (transcurridos 0.000 segundos)\n[ 23.309766] OOM killer deshabilitado.\n[ 23.313027] Congelando tareas congelables restantes\n[ 23.318540] Congelación de tareas congelables restantes completada (transcurridos 0.001 segundos)\n[ 23.342038] serial 00:05: deshabilitado\n[ 23.345719] serial 00:02: deshabilitado\n[ 23.349342] serial 00:01: deshabilitado\n[ 23.353782] sd 0:0:0:0: [sda] Sincronizando caché SCSI\n[ 23.358993] sd 1:0:0:0: [sdb] Sincronizando caché SCSI\n[ 23.361635] ata1.00: Entrando en modo de energía de espera\n[ 23.368863] ata2.00: Entrando en modo de energía de espera\n[ 23.445187] ERROR: desreferencia de puntero NULL del kernel, dirección: 0000000000000000\n[ 23.452194] #PF: búsqueda de instrucción de supervisor en modo kernel\n[ 23.457896] #PF: error_code(0x 0010) - página no presente\n[ 23.463065] PGD 0 P4D 0\n[ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI\n[ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntario)\n[ 23.482512] Tainted: [S]=CPU_FUERA_DE_ESPECIFICACIÓN, [W]=ADVERTENCIA\n[ 23.496511] Cola de trabajo: async async_run_entry_fn\n[ 23.501087] RIP: 0010:0x0\n[ 23.503755] Código: No se pueden acceder a los bytes del código de operación en 0x ffffffffffffffd6.\n[ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246\n[ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f\n[ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000\n[ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff\n[ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8\n[ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68\n[ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000\n[ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0\n[ 23.572539] PKRU: 55555554\n[ 23.575281] Traza de llamada:\n[ 23.577770] [TAREA]\n[ 23.579905] intel_engines_reset_default_submission+0x42/0x60\n[ 23.585695] __intel_gt_unset_wedged+0x191/0x200\n[ 23.590360] intel_gt_unset_wedged+0x20/0x40\n[ 23.594675] gt_sanitize+0x15e/0x170\n[ 23.598290] i915_gem_suspend_late+0x6b/0x180\n[ 23.602692] i915_drm_suspend_late+0x35/0xf0\n[ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10\n[ 23.611843] dpm_run_callback+0x78/0x1c0\n[ 23.615817] device_suspend_late+0xde/0x2e0\n[ 23.620037] async_suspend_late+0x18/0x30\n[ 23.624082] async_run_entry_fn+0x25/0xa0\n[ 23.628129] process_one_work+0x15b/0x380\n[ 23.632182] worker_thread+0x2a5/0x3c0\n[ 23.635973] ? __pfx_worker_thread+0x10/0x10\n[ 23.640279] kthread+0xf6/0x1f0\n[ 23.643464] ? __pfx_kthread+0x10/0x10\n[ 23.647263] ? __pfx_kthread+0x10/0x10\n[ 23.651045] ret_from_fork+0x131/0x190\n[ 23.654837] ? __pfx_kthread+0x10/0x10\n[ 23.658634] ret_from_fork_asm+0x1a/0x30\n[ 23.662597] [/TAREA]\n[ 23.664826] Módulos enlazados:\n[ 23.667914] CR2: 0000000000000000\n[ 23.671271] - - - - - - - - - - - -[ cortar aquí ]- - - - - - - - - - - -\n\n(seleccionado de la confirmación daa199abc3d3d1740c9e3a2c3e9216ae5b447cad)"}],"id":"CVE-2026-31540","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31540","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:07.826588Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:27.957","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0162ab3220bac870e43e229e6e3024d1a21c3f26"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1a16150729db8d997e39519f9d58e6b435c4c087"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e20a886b443a71b573ceaed3ca7053d15380916"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cf4b224ffb9a58181be32b64130fc36cf59c3192"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/da6552d67012a1cf0585f2eb401d0c4abcf108c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/db8b1bebe81ffb410ddd746b6869f72e22420850"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df1f4a7d9cf689b4e96c95255228896505f44c31"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31541.json b/data/2026/CVE-2026-31541.json index a6c36e954a..a7355432d1 100644 --- a/data/2026/CVE-2026-31541.json +++ b/data/2026/CVE-2026-31541.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/trace/trace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"75668e58244e63ec3785098a02e1cdcff14a6c2e","status":"affected","version":"7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86","versionType":"git"},{"lessThan":"cc267e4b4302247dc67ef937a9ac587a696a43c1","status":"affected","version":"7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86","versionType":"git"},{"lessThan":"07183aac4a6828e474f00b37c9d795d0d99e18a7","status":"affected","version":"7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/trace/trace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1C570CE1-BC61-4BE6-9393-FD0CA8637367","versionEndExcluding":"6.18.20","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix trace_marker copy link list updates\n\nWhen the \"copy_trace_marker\" option is enabled for an instance, anything\nwritten into /sys/kernel/tracing/trace_marker is also copied into that\ninstances buffer. When the option is set, that instance's trace_array\ndescriptor is added to the marker_copies link list. This list is protected\nby RCU, as all iterations uses an RCU protected list traversal.\n\nWhen the instance is deleted, all the flags that were enabled are cleared.\nThis also clears the copy_trace_marker flag and removes the trace_array\ndescriptor from the list.\n\nThe issue is after the flags are called, a direct call to\nupdate_marker_trace() is performed to clear the flag. This function\nreturns true if the state of the flag changed and false otherwise. If it\nreturns true here, synchronize_rcu() is called to make sure all readers\nsee that its removed from the list.\n\nBut since the flag was already cleared, the state does not change and the\nsynchronization is never called, leaving a possible UAF bug.\n\nMove the clearing of all flags below the updating of the copy_trace_marker\noption which then makes sure the synchronization is performed.\n\nAlso use the flag for checking the state in update_marker_trace() instead\nof looking at if the list is empty."}],"id":"CVE-2026-31541","lastModified":"2026-06-17T10:33:56.547","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:28.117","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07183aac4a6828e474f00b37c9d795d0d99e18a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75668e58244e63ec3785098a02e1cdcff14a6c2e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc267e4b4302247dc67ef937a9ac587a696a43c1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/trace/trace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"75668e58244e63ec3785098a02e1cdcff14a6c2e","status":"affected","version":"7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86","versionType":"git"},{"lessThan":"cc267e4b4302247dc67ef937a9ac587a696a43c1","status":"affected","version":"7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86","versionType":"git"},{"lessThan":"07183aac4a6828e474f00b37c9d795d0d99e18a7","status":"affected","version":"7b382efd5e8af4c0c67e70ad3fb599dcd2dc0b86","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/trace/trace.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1C570CE1-BC61-4BE6-9393-FD0CA8637367","versionEndExcluding":"6.18.20","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix trace_marker copy link list updates\n\nWhen the \"copy_trace_marker\" option is enabled for an instance, anything\nwritten into /sys/kernel/tracing/trace_marker is also copied into that\ninstances buffer. When the option is set, that instance's trace_array\ndescriptor is added to the marker_copies link list. This list is protected\nby RCU, as all iterations uses an RCU protected list traversal.\n\nWhen the instance is deleted, all the flags that were enabled are cleared.\nThis also clears the copy_trace_marker flag and removes the trace_array\ndescriptor from the list.\n\nThe issue is after the flags are called, a direct call to\nupdate_marker_trace() is performed to clear the flag. This function\nreturns true if the state of the flag changed and false otherwise. If it\nreturns true here, synchronize_rcu() is called to make sure all readers\nsee that its removed from the list.\n\nBut since the flag was already cleared, the state does not change and the\nsynchronization is never called, leaving a possible UAF bug.\n\nMove the clearing of all flags below the updating of the copy_trace_marker\noption which then makes sure the synchronization is performed.\n\nAlso use the flag for checking the state in update_marker_trace() instead\nof looking at if the list is empty."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntracing: Solución a las actualizaciones de la lista enlazada de copia de trace_marker\n\nCuando la opción ’copy_trace_marker’ está habilitada para una instancia, cualquier cosa escrita en /sys/kernel/tracing/trace_marker también se copia en el búfer de esa instancia. Cuando la opción está configurada, el descriptor trace_array de esa instancia se añade a la lista enlazada marker_copies. Esta lista está protegida por RCU, ya que todas las iteraciones utilizan un recorrido de lista protegido por RCU.\n\nCuando la instancia es eliminada, todas las banderas que estaban habilitadas se borran. Esto también borra la bandera copy_trace_marker y elimina el descriptor trace_array de la lista.\n\nEl problema es que después de que se llaman las banderas, se realiza una llamada directa a update_marker_trace() para borrar la bandera. Esta función devuelve verdadero si el estado de la bandera cambió y falso en caso contrario. Si devuelve verdadero aquí, se llama a synchronize_rcu() para asegurarse de que todos los lectores vean que se ha eliminado de la lista.\n\nPero como la bandera ya estaba borrada, el estado no cambia y la sincronización nunca se llama, dejando un posible error UAF.\n\nMover el borrado de todas las banderas debajo de la actualización de la opción copy_trace_marker, lo que luego asegura que se realice la sincronización.\n\nTambién usar la bandera para verificar el estado en update_marker_trace() en lugar de mirar si la lista está vacía."}],"id":"CVE-2026-31541","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:28.117","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07183aac4a6828e474f00b37c9d795d0d99e18a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75668e58244e63ec3785098a02e1cdcff14a6c2e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc267e4b4302247dc67ef937a9ac587a696a43c1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31542.json b/data/2026/CVE-2026-31542.json index 5c38ae8824..988728a213 100644 --- a/data/2026/CVE-2026-31542.json +++ b/data/2026/CVE-2026-31542.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kernel/apic/x2apic_uv_x.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c51957601d32c0d195bce0b9345dfe93ef5728cc","status":"affected","version":"8a50c58519271dd24ba760bb282875f6ad66ee71","versionType":"git"},{"lessThan":"9956d4892e78812246336c7ea51f5aa62018049e","status":"affected","version":"8a50c58519271dd24ba760bb282875f6ad66ee71","versionType":"git"},{"lessThan":"79f0faf81d3bbbe5f07bf6892450d3740a1b290d","status":"affected","version":"8a50c58519271dd24ba760bb282875f6ad66ee71","versionType":"git"},{"lessThan":"c1cf2218d2fa40a49921a7460981e5faab26f04e","status":"affected","version":"8a50c58519271dd24ba760bb282875f6ad66ee71","versionType":"git"},{"lessThan":"1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3","status":"affected","version":"8a50c58519271dd24ba760bb282875f6ad66ee71","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kernel/apic/x2apic_uv_x.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.5"},{"lessThan":"6.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"424B60E1-5C36-40FF-9029-5E50093BEDA5","versionEndExcluding":"6.6.130","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/platform/uv: Handle deconfigured sockets\n\nWhen a socket is deconfigured, it's mapped to SOCK_EMPTY (0xffff). This causes\na panic while allocating UV hub info structures.\n\nFix this by using NUMA_NO_NODE, allowing UV hub info structures to be\nallocated on valid nodes."}],"id":"CVE-2026-31542","lastModified":"2026-11-05T22:18:39.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31542","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:14.430650Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:28.237","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/79f0faf81d3bbbe5f07bf6892450d3740a1b290d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9956d4892e78812246336c7ea51f5aa62018049e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c1cf2218d2fa40a49921a7460981e5faab26f04e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c51957601d32c0d195bce0b9345dfe93ef5728cc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kernel/apic/x2apic_uv_x.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c51957601d32c0d195bce0b9345dfe93ef5728cc","status":"affected","version":"8a50c58519271dd24ba760bb282875f6ad66ee71","versionType":"git"},{"lessThan":"9956d4892e78812246336c7ea51f5aa62018049e","status":"affected","version":"8a50c58519271dd24ba760bb282875f6ad66ee71","versionType":"git"},{"lessThan":"79f0faf81d3bbbe5f07bf6892450d3740a1b290d","status":"affected","version":"8a50c58519271dd24ba760bb282875f6ad66ee71","versionType":"git"},{"lessThan":"c1cf2218d2fa40a49921a7460981e5faab26f04e","status":"affected","version":"8a50c58519271dd24ba760bb282875f6ad66ee71","versionType":"git"},{"lessThan":"1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3","status":"affected","version":"8a50c58519271dd24ba760bb282875f6ad66ee71","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kernel/apic/x2apic_uv_x.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.5"},{"lessThan":"6.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"424B60E1-5C36-40FF-9029-5E50093BEDA5","versionEndExcluding":"6.6.130","versionStartIncluding":"6.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/platform/uv: Handle deconfigured sockets\n\nWhen a socket is deconfigured, it's mapped to SOCK_EMPTY (0xffff). This causes\na panic while allocating UV hub info structures.\n\nFix this by using NUMA_NO_NODE, allowing UV hub info structures to be\nallocated on valid nodes."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nx86/platform/uv: Manejar sockets desconfigurados\n\nCuando un socket es desconfigurado, es mapeado a SOCK_EMPTY (0x ffff). Esto causa\nun pánico al asignar estructuras de información del hub UV.\n\nSoluciona esto usando NUMA_NO_NODE, permitiendo que las estructuras de información del hub UV sean\nasignadas en nodos válidos."}],"id":"CVE-2026-31542","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31542","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:14.430650Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:28.237","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1f6aa5bbf1d0f81a8a2aafc16136e7dd9a609ff3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/79f0faf81d3bbbe5f07bf6892450d3740a1b290d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9956d4892e78812246336c7ea51f5aa62018049e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c1cf2218d2fa40a49921a7460981e5faab26f04e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c51957601d32c0d195bce0b9345dfe93ef5728cc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31543.json b/data/2026/CVE-2026-31543.json index 50484af85e..df0bd24001 100644 --- a/data/2026/CVE-2026-31543.json +++ b/data/2026/CVE-2026-31543.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/crash_dump_dm_crypt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4897bd307ba8757c31a3325ba6730961be606016","status":"affected","version":"479e58549b0fa7e80f1e0b9e69e0a2a8e6711132","versionType":"git"},{"lessThan":"ed8d91f469845d62d44c565a55d2ab1767969357","status":"affected","version":"479e58549b0fa7e80f1e0b9e69e0a2a8e6711132","versionType":"git"},{"lessThan":"36f46b0e36892eba08978eef7502ff3c94ddba77","status":"affected","version":"479e58549b0fa7e80f1e0b9e69e0a2a8e6711132","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/crash_dump_dm_crypt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1C570CE1-BC61-4BE6-9393-FD0CA8637367","versionEndExcluding":"6.18.20","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrash_dump: don't log dm-crypt key bytes in read_key_from_user_keying\n\nWhen debug logging is enabled, read_key_from_user_keying() logs the first\n8 bytes of the key payload and partially exposes the dm-crypt key. Stop\nlogging any key bytes."}],"id":"CVE-2026-31543","lastModified":"2026-11-05T22:18:39.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:21.530520Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:28.350","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36f46b0e36892eba08978eef7502ff3c94ddba77"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4897bd307ba8757c31a3325ba6730961be606016"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ed8d91f469845d62d44c565a55d2ab1767969357"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/crash_dump_dm_crypt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4897bd307ba8757c31a3325ba6730961be606016","status":"affected","version":"479e58549b0fa7e80f1e0b9e69e0a2a8e6711132","versionType":"git"},{"lessThan":"ed8d91f469845d62d44c565a55d2ab1767969357","status":"affected","version":"479e58549b0fa7e80f1e0b9e69e0a2a8e6711132","versionType":"git"},{"lessThan":"36f46b0e36892eba08978eef7502ff3c94ddba77","status":"affected","version":"479e58549b0fa7e80f1e0b9e69e0a2a8e6711132","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/crash_dump_dm_crypt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1C570CE1-BC61-4BE6-9393-FD0CA8637367","versionEndExcluding":"6.18.20","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrash_dump: don't log dm-crypt key bytes in read_key_from_user_keying\n\nWhen debug logging is enabled, read_key_from_user_keying() logs the first\n8 bytes of the key payload and partially exposes the dm-crypt key. Stop\nlogging any key bytes."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrash_dump: no registrar bytes de clave dm-crypt en read_key_from_user_keying\n\nCuando el registro de depuración está habilitado, read_key_from_user_keying() registra los primeros 8 bytes de la carga útil de la clave y expone parcialmente la clave dm-crypt. Dejar de registrar cualquier byte de clave."}],"id":"CVE-2026-31543","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:21.530520Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:28.350","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36f46b0e36892eba08978eef7502ff3c94ddba77"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4897bd307ba8757c31a3325ba6730961be606016"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ed8d91f469845d62d44c565a55d2ab1767969357"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31544.json b/data/2026/CVE-2026-31544.json index afa4964470..918a577387 100644 --- a/data/2026/CVE-2026-31544.json +++ b/data/2026/CVE-2026-31544.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/firmware/arm_scmi/notify.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"70d9bd9a2e683afe6200b0c20af22f06f1a199a4","status":"affected","version":"b5daf93b809d13a194f8a8eeacfab1cfa241bbc3","versionType":"git"},{"lessThan":"8414d2800c34528467df23ce6192c254a73e4459","status":"affected","version":"b5daf93b809d13a194f8a8eeacfab1cfa241bbc3","versionType":"git"},{"lessThan":"555317d6100164748f7d09f80142739bd29f0cda","status":"affected","version":"b5daf93b809d13a194f8a8eeacfab1cfa241bbc3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/firmware/arm_scmi/notify.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0ED92ABC-9C7F-46BE-B94C-365F0BD854A8","versionEndExcluding":"6.18.20","versionStartIncluding":"6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix NULL dereference on notify error path\n\nSince commit b5daf93b809d1 (\"firmware: arm_scmi: Avoid notifier\nregistration for unsupported events\") the call chains leading to the helper\n__scmi_event_handler_get_ops expect an ERR_PTR to be returned on failure to\nget an handler for the requested event key, while the current helper can\nstill return a NULL when no handler could be found or created.\n\nFix by forcing an ERR_PTR return value when the handler reference is NULL."}],"id":"CVE-2026-31544","lastModified":"2026-06-17T10:33:56.850","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:28.457","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/555317d6100164748f7d09f80142739bd29f0cda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70d9bd9a2e683afe6200b0c20af22f06f1a199a4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8414d2800c34528467df23ce6192c254a73e4459"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/firmware/arm_scmi/notify.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"70d9bd9a2e683afe6200b0c20af22f06f1a199a4","status":"affected","version":"b5daf93b809d13a194f8a8eeacfab1cfa241bbc3","versionType":"git"},{"lessThan":"8414d2800c34528467df23ce6192c254a73e4459","status":"affected","version":"b5daf93b809d13a194f8a8eeacfab1cfa241bbc3","versionType":"git"},{"lessThan":"555317d6100164748f7d09f80142739bd29f0cda","status":"affected","version":"b5daf93b809d13a194f8a8eeacfab1cfa241bbc3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/firmware/arm_scmi/notify.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0ED92ABC-9C7F-46BE-B94C-365F0BD854A8","versionEndExcluding":"6.18.20","versionStartIncluding":"6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix NULL dereference on notify error path\n\nSince commit b5daf93b809d1 (\"firmware: arm_scmi: Avoid notifier\nregistration for unsupported events\") the call chains leading to the helper\n__scmi_event_handler_get_ops expect an ERR_PTR to be returned on failure to\nget an handler for the requested event key, while the current helper can\nstill return a NULL when no handler could be found or created.\n\nFix by forcing an ERR_PTR return value when the handler reference is NULL."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfirmware: arm_scmi: Corrección de desreferencia NULL en la ruta de error de notificación\n\nDesde el commit b5daf93b809d1 (’firmware: arm_scmi: Evitar el registro de notificador para eventos no soportados’), las cadenas de llamadas que conducen al ayudante __scmi_event_handler_get_ops esperan que se devuelva un ERR_PTR al fallar en obtener un gestor para la clave de evento solicitada, mientras que el ayudante actual aún puede devolver un NULL cuando no se pudo encontrar o crear ningún gestor.\n\nSolución forzando un valor de retorno ERR_PTR cuando la referencia del gestor es NULL."}],"id":"CVE-2026-31544","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:28.457","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/555317d6100164748f7d09f80142739bd29f0cda"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70d9bd9a2e683afe6200b0c20af22f06f1a199a4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8414d2800c34528467df23ce6192c254a73e4459"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31545.json b/data/2026/CVE-2026-31545.json index 7b4d6febf3..2a79d06d9c 100644 --- a/data/2026/CVE-2026-31545.json +++ b/data/2026/CVE-2026-31545.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nfc/nxp-nci/i2c.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0c2320c3c860d281cbc2f49fc574c1947a6b9e2a","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"2a175bc3c338c6b2bc55004e93dd35a2467bdca2","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"c24dcac1a9d1b4fd164898df0c2f5b0adbf81a78","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"70662874f646871c2f08ef1cf2544ba9a5f71b96","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"548a1bfe591364e63bce4af7c5802bb434efdaf8","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"4de9ed2ea22d611b4149969266b45a86ea8daf35","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"783f05e560d761dee7ff602b97edb0e54f2e9727","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"55dc632ab2ac2889b15995a9eef56c753d48ebc7","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nfc/nxp-nci/i2c.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.4"},{"lessThan":"5.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E191A4B-28D2-4CEE-9395-5C0A3C2BB6D9","versionEndExcluding":"5.10.253","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nxp-nci: allow GPIOs to sleep\n\nAllow the firmware and enable GPIOs to sleep.\n\nThis fixes a `WARN_ON' and allows the driver to operate GPIOs which are\nconnected to I2C GPIO expanders.\n\n-- >8 --\nkernel: WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98\n-- >8 --"}],"id":"CVE-2026-31545","lastModified":"2026-06-17T10:33:56.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:28.560","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c2320c3c860d281cbc2f49fc574c1947a6b9e2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2a175bc3c338c6b2bc55004e93dd35a2467bdca2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4de9ed2ea22d611b4149969266b45a86ea8daf35"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/548a1bfe591364e63bce4af7c5802bb434efdaf8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/55dc632ab2ac2889b15995a9eef56c753d48ebc7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70662874f646871c2f08ef1cf2544ba9a5f71b96"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/783f05e560d761dee7ff602b97edb0e54f2e9727"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c24dcac1a9d1b4fd164898df0c2f5b0adbf81a78"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nfc/nxp-nci/i2c.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0c2320c3c860d281cbc2f49fc574c1947a6b9e2a","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"2a175bc3c338c6b2bc55004e93dd35a2467bdca2","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"c24dcac1a9d1b4fd164898df0c2f5b0adbf81a78","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"70662874f646871c2f08ef1cf2544ba9a5f71b96","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"548a1bfe591364e63bce4af7c5802bb434efdaf8","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"4de9ed2ea22d611b4149969266b45a86ea8daf35","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"783f05e560d761dee7ff602b97edb0e54f2e9727","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"},{"lessThan":"55dc632ab2ac2889b15995a9eef56c753d48ebc7","status":"affected","version":"43201767b44cbd873c60dbd2acd370147588cb18","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nfc/nxp-nci/i2c.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.4"},{"lessThan":"5.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8E191A4B-28D2-4CEE-9395-5C0A3C2BB6D9","versionEndExcluding":"5.10.253","versionStartIncluding":"5.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nxp-nci: allow GPIOs to sleep\n\nAllow the firmware and enable GPIOs to sleep.\n\nThis fixes a `WARN_ON' and allows the driver to operate GPIOs which are\nconnected to I2C GPIO expanders.\n\n-- >8 --\nkernel: WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98\n-- >8 --"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad se ha resuelto: NFC: nxp-nci: permitir que los GPIOs entren en modo de suspensión Permitir que el firmware y habilitar que los GPIOs entren en modo de suspensión. Esto corrige un ’WARN_ON’ y permite al controlador operar los GPIOs que están\nconectados a expansores de GPIO I2C. - - mayor que 8 - -\nkernel: WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98\n- - mayor que 8 - -"}],"id":"CVE-2026-31545","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:28.560","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c2320c3c860d281cbc2f49fc574c1947a6b9e2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2a175bc3c338c6b2bc55004e93dd35a2467bdca2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4de9ed2ea22d611b4149969266b45a86ea8daf35"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/548a1bfe591364e63bce4af7c5802bb434efdaf8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/55dc632ab2ac2889b15995a9eef56c753d48ebc7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70662874f646871c2f08ef1cf2544ba9a5f71b96"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/783f05e560d761dee7ff602b97edb0e54f2e9727"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c24dcac1a9d1b4fd164898df0c2f5b0adbf81a78"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31546.json b/data/2026/CVE-2026-31546.json index 6f50e6380a..310deb5b98 100644 --- a/data/2026/CVE-2026-31546.json +++ b/data/2026/CVE-2026-31546.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/bonding/bond_debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"19f0fd87df0e5746b24f5caa465a66a8c6e6e241","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"edacf1613f7b26423ebfa8b2892e7453c4235354","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"2ec2c777f357a83c3d503d8d9370c90b60f0ae63","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"0a3f8cd3f370247ded14d38d216b49dd30eade76","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"6a3bb74e25d79cbb15f67ef80f71e2b2bfe27ff4","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"017d674cf6930e9586a29ee808c7ca09d1396d07","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"ec9762f0df2f9fbe3f40a3bfa8aab8b2f721466c","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"605b52497bf89b3b154674deb135da98f916e390","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/bonding/bond_debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.38"},{"lessThan":"2.6.38","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"04177CA2-7B3E-475B-ABB0-BBE8D2851FED","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.38.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.38:-:*:*:*:*:*:*","matchCriteriaId":"985DC743-744A-429F-8098-EFCC91DFB6F7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix NULL deref in bond_debug_rlb_hash_show\n\nrlb_clear_slave intentionally keeps RLB hash-table entries on\nthe rx_hashtbl_used_head list with slave set to NULL when no\nreplacement slave is available. However, bond_debug_rlb_hash_show\nvisites client_info->slave without checking if it's NULL.\n\nOther used-list iterators in bond_alb.c already handle this NULL-slave\nstate safely:\n\n- rlb_update_client returns early on !client_info->slave\n- rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance\ncompare slave values before visiting\n- lb_req_update_subnet_clients continues if slave is NULL\n\nThe following NULL deref crash can be trigger in\nbond_debug_rlb_hash_show:\n\n[ 1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41)\n[ 1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286\n[ 1.293333] RAX: 0000000000000000 RBX: ffff888102b48200 RCX: ffff888102b48204\n[ 1.293631] RDX: ffff888102b48200 RSI: ffffffff839daad5 RDI: ffff888102815078\n[ 1.293924] RBP: ffff888102815078 R08: ffff888102b4820e R09: 0000000000000000\n[ 1.294267] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100f929c0\n[ 1.294564] R13: ffff888100f92a00 R14: 0000000000000001 R15: ffffc900004a7ed8\n[ 1.294864] FS: 0000000001395380(0000) GS:ffff888196e75000(0000) knlGS:0000000000000000\n[ 1.295239] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1.295480] CR2: 0000000000000000 CR3: 0000000102adc004 CR4: 0000000000772ef0\n[ 1.295897] Call Trace:\n[ 1.296134] seq_read_iter (fs/seq_file.c:231)\n[ 1.296341] seq_read (fs/seq_file.c:164)\n[ 1.296493] full_proxy_read (fs/debugfs/file.c:378 (discriminator 1))\n[ 1.296658] vfs_read (fs/read_write.c:572)\n[ 1.296981] ksys_read (fs/read_write.c:717)\n[ 1.297132] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n[ 1.297325] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd a NULL check and print \"(none)\" for entries with no assigned slave."}],"id":"CVE-2026-31546","lastModified":"2026-11-10T13:18:59.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31546","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:27.031828Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:28.690","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/017d674cf6930e9586a29ee808c7ca09d1396d07"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a3f8cd3f370247ded14d38d216b49dd30eade76"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/19f0fd87df0e5746b24f5caa465a66a8c6e6e241"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ec2c777f357a83c3d503d8d9370c90b60f0ae63"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/605b52497bf89b3b154674deb135da98f916e390"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6a3bb74e25d79cbb15f67ef80f71e2b2bfe27ff4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ec9762f0df2f9fbe3f40a3bfa8aab8b2f721466c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/edacf1613f7b26423ebfa8b2892e7453c4235354"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/bonding/bond_debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"19f0fd87df0e5746b24f5caa465a66a8c6e6e241","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"edacf1613f7b26423ebfa8b2892e7453c4235354","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"2ec2c777f357a83c3d503d8d9370c90b60f0ae63","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"0a3f8cd3f370247ded14d38d216b49dd30eade76","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"6a3bb74e25d79cbb15f67ef80f71e2b2bfe27ff4","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"017d674cf6930e9586a29ee808c7ca09d1396d07","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"ec9762f0df2f9fbe3f40a3bfa8aab8b2f721466c","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"},{"lessThan":"605b52497bf89b3b154674deb135da98f916e390","status":"affected","version":"caafa84251b886feb6cdf23d50e2cc99dcdaaaf3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/bonding/bond_debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.38"},{"lessThan":"2.6.38","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"04177CA2-7B3E-475B-ABB0-BBE8D2851FED","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.38.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.38:-:*:*:*:*:*:*","matchCriteriaId":"985DC743-744A-429F-8098-EFCC91DFB6F7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix NULL deref in bond_debug_rlb_hash_show\n\nrlb_clear_slave intentionally keeps RLB hash-table entries on\nthe rx_hashtbl_used_head list with slave set to NULL when no\nreplacement slave is available. However, bond_debug_rlb_hash_show\nvisites client_info->slave without checking if it's NULL.\n\nOther used-list iterators in bond_alb.c already handle this NULL-slave\nstate safely:\n\n- rlb_update_client returns early on !client_info->slave\n- rlb_req_update_slave_clients, rlb_clear_slave, and rlb_rebalance\ncompare slave values before visiting\n- lb_req_update_subnet_clients continues if slave is NULL\n\nThe following NULL deref crash can be trigger in\nbond_debug_rlb_hash_show:\n\n[ 1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41)\n[ 1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286\n[ 1.293333] RAX: 0000000000000000 RBX: ffff888102b48200 RCX: ffff888102b48204\n[ 1.293631] RDX: ffff888102b48200 RSI: ffffffff839daad5 RDI: ffff888102815078\n[ 1.293924] RBP: ffff888102815078 R08: ffff888102b4820e R09: 0000000000000000\n[ 1.294267] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100f929c0\n[ 1.294564] R13: ffff888100f92a00 R14: 0000000000000001 R15: ffffc900004a7ed8\n[ 1.294864] FS: 0000000001395380(0000) GS:ffff888196e75000(0000) knlGS:0000000000000000\n[ 1.295239] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1.295480] CR2: 0000000000000000 CR3: 0000000102adc004 CR4: 0000000000772ef0\n[ 1.295897] Call Trace:\n[ 1.296134] seq_read_iter (fs/seq_file.c:231)\n[ 1.296341] seq_read (fs/seq_file.c:164)\n[ 1.296493] full_proxy_read (fs/debugfs/file.c:378 (discriminator 1))\n[ 1.296658] vfs_read (fs/read_write.c:572)\n[ 1.296981] ksys_read (fs/read_write.c:717)\n[ 1.297132] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n[ 1.297325] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd a NULL check and print \"(none)\" for entries with no assigned slave."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: bonding: corregir desreferencia NULL en bond_debug_rlb_hash_show\n\nrlb_clear_slave mantiene intencionalmente las entradas de la tabla hash RLB en la lista rx_hashtbl_used_head con el esclavo establecido en NULL cuando no hay un esclavo de reemplazo disponible. Sin embargo, bond_debug_rlb_hash_show visites client_info -> slave sin verificar si es NULL.\n\nOtros iteradores de lista de usados en bond_alb.c ya manejan este estado de esclavo NULL de forma segura:\n\n- rlb_update_client retorna temprano si !client_info -> slave\n- rlb_req_update_slave_clients, rlb_clear_slave y rlb_rebalance comparan los valores de esclavo antes de visitar\n- lb_req_update_subnet_clients continúa si el esclavo es NULL\n\nEl siguiente fallo de desreferencia NULL puede ser activado en bond_debug_rlb_hash_show:\n\n[ 1.289791] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 1.292058] RIP: 0010:bond_debug_rlb_hash_show (drivers/net/bonding/bond_debugfs.c:41)\n[ 1.293101] RSP: 0018:ffffc900004a7d00 EFLAGS: 00010286\n[ 1.293333] RAX: 0000000000000000 RBX: ffff888102b48200 RCX: ffff888102b48204\n[ 1.293631] RDX: ffff888102b48200 RSI: ffffffff839daad5 RDI: ffff888102815078\n[ 1.293924] RBP: ffff888102815078 R08: ffff888102b4820e R09: 0000000000000000\n[ 1.294267] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888100f929c0\n[ 1.294564] R13: ffff888100f92a00 R14: 0000000000000001 R15: ffffc900004a7ed8\n[ 1.294864] FS: 0000000001395380(0000) GS:ffff888196e75000(0000) knlGS:0000000000000000\n[ 1.295239] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 1.295480] CR2: 0000000000000000 CR3: 0000000102adc004 CR4: 0000000000772ef0\n[ 1.295897] Call Trace:\n[ 1.296134] seq_read_iter (fs/seq_file.c:231)\n[ 1.296341] seq_read (fs/seq_file.c:164)\n[ 1.296493] full_proxy_read (fs/debugfs/file.c:378 (discriminator 1))\n[ 1.296658] vfs_read (fs/read_write.c:572)\n[ 1.296981] ksys_read (fs/read_write.c:717)\n[ 1.297132] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\n[ 1.297325] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAñadir una verificación de NULL y mostrar ’(none)’ para entradas sin esclavo asignado."}],"id":"CVE-2026-31546","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31546","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:27.031828Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:28.690","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/017d674cf6930e9586a29ee808c7ca09d1396d07"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a3f8cd3f370247ded14d38d216b49dd30eade76"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/19f0fd87df0e5746b24f5caa465a66a8c6e6e241"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ec2c777f357a83c3d503d8d9370c90b60f0ae63"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/605b52497bf89b3b154674deb135da98f916e390"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6a3bb74e25d79cbb15f67ef80f71e2b2bfe27ff4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ec9762f0df2f9fbe3f40a3bfa8aab8b2f721466c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/edacf1613f7b26423ebfa8b2892e7453c4235354"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31547.json b/data/2026/CVE-2026-31547.json index 6cf74feaee..dfa1def7e5 100644 --- a/data/2026/CVE-2026-31547.json +++ b/data/2026/CVE-2026-31547.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_gt_ccs_mode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c409ecce9adcf815e86bc2f68834982e5a9c4e76","status":"affected","version":"480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4","versionType":"git"},{"lessThan":"65d046b2d8e0d6d855379a981869005fd6b6a41b","status":"affected","version":"480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_gt_ccs_mode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D70DEFFE-AC47-4F3A-A2B2-2D67AB4CF3C8","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix missing runtime PM reference in ccs_mode_store\n\nccs_mode_store() calls xe_gt_reset() which internally invokes\nxe_pm_runtime_get_noresume(). That function requires the caller\nto already hold an outer runtime PM reference and warns if none\nis held:\n\n [46.891177] xe 0000:03:00.0: [drm] Missing outer runtime PM protection\n [46.891178] WARNING: drivers/gpu/drm/xe/xe_pm.c:885 at\n xe_pm_runtime_get_noresume+0x8b/0xc0\n\nFix this by protecting xe_gt_reset() with the scope-based\nguard(xe_pm_runtime)(xe), which is the preferred form when\nthe reference lifetime matches a single scope.\n\nv2:\n- Use scope-based guard(xe_pm_runtime)(xe) (Shuicheng)\n- Update commit message accordingly\n\n(cherry picked from commit 7937ea733f79b3f25e802a0c8360bf7423856f36)"}],"id":"CVE-2026-31547","lastModified":"2026-06-17T10:33:57.213","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:28.830","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65d046b2d8e0d6d855379a981869005fd6b6a41b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c409ecce9adcf815e86bc2f68834982e5a9c4e76"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_gt_ccs_mode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c409ecce9adcf815e86bc2f68834982e5a9c4e76","status":"affected","version":"480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4","versionType":"git"},{"lessThan":"65d046b2d8e0d6d855379a981869005fd6b6a41b","status":"affected","version":"480b358e7d8ef69fd8f1b0cad6e07c7d70a36ee4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_gt_ccs_mode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D70DEFFE-AC47-4F3A-A2B2-2D67AB4CF3C8","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix missing runtime PM reference in ccs_mode_store\n\nccs_mode_store() calls xe_gt_reset() which internally invokes\nxe_pm_runtime_get_noresume(). That function requires the caller\nto already hold an outer runtime PM reference and warns if none\nis held:\n\n [46.891177] xe 0000:03:00.0: [drm] Missing outer runtime PM protection\n [46.891178] WARNING: drivers/gpu/drm/xe/xe_pm.c:885 at\n xe_pm_runtime_get_noresume+0x8b/0xc0\n\nFix this by protecting xe_gt_reset() with the scope-based\nguard(xe_pm_runtime)(xe), which is the preferred form when\nthe reference lifetime matches a single scope.\n\nv2:\n- Use scope-based guard(xe_pm_runtime)(xe) (Shuicheng)\n- Update commit message accordingly\n\n(cherry picked from commit 7937ea733f79b3f25e802a0c8360bf7423856f36)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe: Corrige la referencia PM de tiempo de ejecución faltante en ccs_mode_store\n\nccs_mode_store() llama a xe_gt_reset() que invoca internamente a xe_pm_runtime_get_noresume(). Esa función requiere que el llamador ya mantenga una referencia PM de tiempo de ejecución externa y advierte si no se mantiene ninguna:\n\n [46.891177] xe 0000:03:00.0: [drm] Protección PM de tiempo de ejecución externa faltante\n [46.891178] ADVERTENCIA: drivers/gpu/drm/xe/xe_pm.c:885 en\n xe_pm_runtime_get_noresume+0x8b/0xc0\n\nSoluciona esto protegiendo xe_gt_reset() con el guard(xe_pm_runtime)(xe) basado en el ámbito, que es la forma preferida cuando la vida útil de la referencia coincide con un único ámbito.\n\nv2:\n- Usa guard(xe_pm_runtime)(xe) basado en el ámbito (Shuicheng)\n- Actualiza el mensaje de commit en consecuencia\n\n(seleccionado de commit 7937ea733f79b3f25e802a0c8360bf7423856f36)"}],"id":"CVE-2026-31547","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:28.830","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65d046b2d8e0d6d855379a981869005fd6b6a41b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c409ecce9adcf815e86bc2f68834982e5a9c4e76"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31548.json b/data/2026/CVE-2026-31548.json index 47b06e19c4..9a8d61ec2d 100644 --- a/data/2026/CVE-2026-31548.json +++ b/data/2026/CVE-2026-31548.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/wireless/pmsr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"28d3551f8d8cb3aec7497894d94150fe84d20e5e","status":"affected","version":"9bb7e0f24e7e7d00daa1219b14539e2e602649b2","versionType":"git"},{"lessThan":"37e776e2e0a523731e2470dce6d563f0e8632a40","status":"affected","version":"9bb7e0f24e7e7d00daa1219b14539e2e602649b2","versionType":"git"},{"lessThan":"d32c07ef1880fe20cf4ab223dbfedc9c0b2816aa","status":"affected","version":"9bb7e0f24e7e7d00daa1219b14539e2e602649b2","versionType":"git"},{"lessThan":"a1b7a843f12a0c3e9d3a2ca607ce451916ef42cf","status":"affected","version":"9bb7e0f24e7e7d00daa1219b14539e2e602649b2","versionType":"git"},{"lessThan":"72b7ea786b8e570ae11149e9089859a4a8634a13","status":"affected","version":"9bb7e0f24e7e7d00daa1219b14539e2e602649b2","versionType":"git"},{"lessThan":"6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09","status":"affected","version":"9bb7e0f24e7e7d00daa1219b14539e2e602649b2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/wireless/pmsr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.0"},{"lessThan":"5.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FB7DC217-C210-4A39-8D38-FCF2DE73A855","versionEndExcluding":"6.1.167","versionStartIncluding":"5.0.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:*","matchCriteriaId":"1D0FE595-0CFE-4491-808B-CEF691CE7B0A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down\n\nWhen the nl80211 socket that originated a PMSR request is\nclosed, cfg80211_release_pmsr() sets the request's nl_portid\nto zero and schedules pmsr_free_wk to process the abort\nasynchronously. If the interface is concurrently torn down\nbefore that work runs, cfg80211_pmsr_wdev_down() calls\ncfg80211_pmsr_process_abort() directly. However, the already-\nscheduled pmsr_free_wk work item remains pending and may run\nafter the interface has been removed from the driver. This\ncould cause the driver's abort_pmsr callback to operate on a\ntorn-down interface, leading to undefined behavior and\npotential crashes.\n\nCancel pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down()\nbefore calling cfg80211_pmsr_process_abort(). This ensures any\npending or in-progress work is drained before interface teardown\nproceeds, preventing the work from invoking the driver abort\ncallback after the interface is gone."}],"id":"CVE-2026-31548","lastModified":"2026-10-19T19:17:59.617","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:48.891822Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:28.930","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/28d3551f8d8cb3aec7497894d94150fe84d20e5e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/37e776e2e0a523731e2470dce6d563f0e8632a40"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/72b7ea786b8e570ae11149e9089859a4a8634a13"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a1b7a843f12a0c3e9d3a2ca607ce451916ef42cf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d32c07ef1880fe20cf4ab223dbfedc9c0b2816aa"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/wireless/pmsr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"28d3551f8d8cb3aec7497894d94150fe84d20e5e","status":"affected","version":"9bb7e0f24e7e7d00daa1219b14539e2e602649b2","versionType":"git"},{"lessThan":"37e776e2e0a523731e2470dce6d563f0e8632a40","status":"affected","version":"9bb7e0f24e7e7d00daa1219b14539e2e602649b2","versionType":"git"},{"lessThan":"d32c07ef1880fe20cf4ab223dbfedc9c0b2816aa","status":"affected","version":"9bb7e0f24e7e7d00daa1219b14539e2e602649b2","versionType":"git"},{"lessThan":"a1b7a843f12a0c3e9d3a2ca607ce451916ef42cf","status":"affected","version":"9bb7e0f24e7e7d00daa1219b14539e2e602649b2","versionType":"git"},{"lessThan":"72b7ea786b8e570ae11149e9089859a4a8634a13","status":"affected","version":"9bb7e0f24e7e7d00daa1219b14539e2e602649b2","versionType":"git"},{"lessThan":"6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09","status":"affected","version":"9bb7e0f24e7e7d00daa1219b14539e2e602649b2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/wireless/pmsr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.0"},{"lessThan":"5.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FB7DC217-C210-4A39-8D38-FCF2DE73A855","versionEndExcluding":"6.1.167","versionStartIncluding":"5.0.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.0:-:*:*:*:*:*:*","matchCriteriaId":"1D0FE595-0CFE-4491-808B-CEF691CE7B0A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down\n\nWhen the nl80211 socket that originated a PMSR request is\nclosed, cfg80211_release_pmsr() sets the request's nl_portid\nto zero and schedules pmsr_free_wk to process the abort\nasynchronously. If the interface is concurrently torn down\nbefore that work runs, cfg80211_pmsr_wdev_down() calls\ncfg80211_pmsr_process_abort() directly. However, the already-\nscheduled pmsr_free_wk work item remains pending and may run\nafter the interface has been removed from the driver. This\ncould cause the driver's abort_pmsr callback to operate on a\ntorn-down interface, leading to undefined behavior and\npotential crashes.\n\nCancel pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down()\nbefore calling cfg80211_pmsr_process_abort(). This ensures any\npending or in-progress work is drained before interface teardown\nproceeds, preventing the work from invoking the driver abort\ncallback after the interface is gone."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: cfg80211: cancelar pmsr_free_wk en cfg80211_pmsr_wdev_down\n\nCuando el socket nl80211 que originó una solicitud PMSR se cierra, cfg80211_release_pmsr() establece el nl_portid de la solicitud a cero y programa pmsr_free_wk para procesar la anulación de forma asíncrona. Si la interfaz se desactiva concurrentemente antes de que se ejecute ese trabajo, cfg80211_pmsr_wdev_down() llama a cfg80211_pmsr_process_abort() directamente. Sin embargo, el elemento de trabajo pmsr_free_wk ya programado permanece pendiente y puede ejecutarse después de que la interfaz haya sido eliminada del controlador. Esto podría causar que la devolución de llamada abort_pmsr del controlador opere en una interfaz desactivada, lo que lleva a un comportamiento indefinido y posibles fallos.\n\nCancelar pmsr_free_wk de forma síncrona en cfg80211_pmsr_wdev_down() antes de llamar a cfg80211_pmsr_process_abort(). Esto asegura que cualquier trabajo pendiente o en curso se agote antes de que proceda la desactivación de la interfaz, evitando que el trabajo invoque la devolución de llamada de anulación del controlador después de que la interfaz haya desaparecido."}],"id":"CVE-2026-31548","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:48.891822Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:28.930","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/28d3551f8d8cb3aec7497894d94150fe84d20e5e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/37e776e2e0a523731e2470dce6d563f0e8632a40"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/72b7ea786b8e570ae11149e9089859a4a8634a13"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a1b7a843f12a0c3e9d3a2ca607ce451916ef42cf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d32c07ef1880fe20cf4ab223dbfedc9c0b2816aa"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31549.json b/data/2026/CVE-2026-31549.json index 74b64f009d..b3500b1270 100644 --- a/data/2026/CVE-2026-31549.json +++ b/data/2026/CVE-2026-31549.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/i2c/busses/i2c-cp2615.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e68c267787778bcdf3d91b06f794faaba7f0d1d1","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"},{"lessThan":"4a22af879172336370ae3e81e7f65fb2f69472ee","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"},{"lessThan":"69aece634a7eebafd9a596e5494d52facf6f26ec","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"},{"lessThan":"13ccf9b106bba121728f1625c4375a1bd8f5c5a3","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"},{"lessThan":"a9778298f47036866ea15eeb17242e8a4612580f","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"},{"lessThan":"efe996bcfe50c2dcc6cf65c574285713b722ced7","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"},{"lessThan":"aa79f996eb41e95aed85a1bd7f56bcd6a3842008","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/i2c/busses/i2c-cp2615.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CC3F58C6-09EC-41E6-8E82-613F5965C0DB","versionEndExcluding":"5.15.203","versionStartIncluding":"5.13.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.13:-:*:*:*:*:*:*","matchCriteriaId":"8F0E7012-0BA3-4E6A-ADE9-57973CBDEE28","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: cp2615: fix serial string NULL-deref at probe\n\nThe cp2615 driver uses the USB device serial string as the i2c adapter\nname but does not make sure that the string exists.\n\nVerify that the device has a serial number before accessing it to avoid\ntriggering a NULL-pointer dereference (e.g. with malicious devices)."}],"id":"CVE-2026-31549","lastModified":"2026-06-17T10:33:57.447","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:29.060","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/13ccf9b106bba121728f1625c4375a1bd8f5c5a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4a22af879172336370ae3e81e7f65fb2f69472ee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/69aece634a7eebafd9a596e5494d52facf6f26ec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a9778298f47036866ea15eeb17242e8a4612580f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aa79f996eb41e95aed85a1bd7f56bcd6a3842008"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e68c267787778bcdf3d91b06f794faaba7f0d1d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/efe996bcfe50c2dcc6cf65c574285713b722ced7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/i2c/busses/i2c-cp2615.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e68c267787778bcdf3d91b06f794faaba7f0d1d1","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"},{"lessThan":"4a22af879172336370ae3e81e7f65fb2f69472ee","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"},{"lessThan":"69aece634a7eebafd9a596e5494d52facf6f26ec","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"},{"lessThan":"13ccf9b106bba121728f1625c4375a1bd8f5c5a3","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"},{"lessThan":"a9778298f47036866ea15eeb17242e8a4612580f","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"},{"lessThan":"efe996bcfe50c2dcc6cf65c574285713b722ced7","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"},{"lessThan":"aa79f996eb41e95aed85a1bd7f56bcd6a3842008","status":"affected","version":"4a7695429eade517b07ea72f9ec366130e81a076","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/i2c/busses/i2c-cp2615.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CC3F58C6-09EC-41E6-8E82-613F5965C0DB","versionEndExcluding":"5.15.203","versionStartIncluding":"5.13.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.13:-:*:*:*:*:*:*","matchCriteriaId":"8F0E7012-0BA3-4E6A-ADE9-57973CBDEE28","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: cp2615: fix serial string NULL-deref at probe\n\nThe cp2615 driver uses the USB device serial string as the i2c adapter\nname but does not make sure that the string exists.\n\nVerify that the device has a serial number before accessing it to avoid\ntriggering a NULL-pointer dereference (e.g. with malicious devices)."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ni2c: cp2615: corrige desreferencia NULL de cadena serial en la sonda\n\nEl controlador cp2615 utiliza la cadena serial del dispositivo USB como nombre del adaptador i2c, pero no se asegura de que la cadena exista.\n\nVerificar que el dispositivo tenga un número de serie antes de acceder a él para evitar activar una desreferencia de puntero NULL (p. ej., con dispositivos maliciosos)."}],"id":"CVE-2026-31549","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:29.060","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/13ccf9b106bba121728f1625c4375a1bd8f5c5a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4a22af879172336370ae3e81e7f65fb2f69472ee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/69aece634a7eebafd9a596e5494d52facf6f26ec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a9778298f47036866ea15eeb17242e8a4612580f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aa79f996eb41e95aed85a1bd7f56bcd6a3842008"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e68c267787778bcdf3d91b06f794faaba7f0d1d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/efe996bcfe50c2dcc6cf65c574285713b722ced7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31550.json b/data/2026/CVE-2026-31550.json index 9d0fd32e01..da9b3412d9 100644 --- a/data/2026/CVE-2026-31550.json +++ b/data/2026/CVE-2026-31550.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pmdomain/bcm/bcm2835-power.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0e84e74849d2d7e9b23a09c2d5e0d9357db1ca59","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"c5e734f6a0740dce92e7c919e632cb43fa5d4e53","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"622ab02e955c35c125ff2b65d8327b2c52db8758","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"9443202d91388026dbf7312972a74fbfd27ee82f","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"ea4fa54b83bb2e4a21e9026824bfe271b1a6ee1e","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"18605b1b936b66b1f34dcf8e9ad4f1fbcf7a7c13","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"572f17180f26619809b8e0593d926762aa8660ff","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"b826d2c0b0ecb844c84431ba6b502e744f5d919a","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pmdomain/bcm/bcm2835-power.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.1"},{"lessThan":"5.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7A7963C2-E27E-41F4-A575-6430E58CBEED","versionEndExcluding":"5.10.253","versionStartIncluding":"5.1.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.1:-:*:*:*:*:*:*","matchCriteriaId":"D89FA266-EDB9-412A-B18E-1B5A0FCC3C0D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: bcm: bcm2835-power: Increase ASB control timeout\n\nThe bcm2835_asb_control() function uses a tight polling loop to wait\nfor the ASB bridge to acknowledge a request. During intensive workloads,\nthis handshake intermittently fails for V3D's master ASB on BCM2711,\nresulting in \"Failed to disable ASB master for v3d\" errors during\nruntime PM suspend. As a consequence, the failed power-off leaves V3D in\na broken state, leading to bus faults or system hangs on later accesses.\n\nAs the timeout is insufficient in some scenarios, increase the polling\ntimeout from 1us to 5us, which is still negligible in the context of a\npower domain transition. Also, replace the open-coded ktime_get_ns()/\ncpu_relax() polling loop with readl_poll_timeout_atomic()."}],"id":"CVE-2026-31550","lastModified":"2026-06-17T10:33:57.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:29.207","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e84e74849d2d7e9b23a09c2d5e0d9357db1ca59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/18605b1b936b66b1f34dcf8e9ad4f1fbcf7a7c13"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/572f17180f26619809b8e0593d926762aa8660ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/622ab02e955c35c125ff2b65d8327b2c52db8758"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9443202d91388026dbf7312972a74fbfd27ee82f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b826d2c0b0ecb844c84431ba6b502e744f5d919a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c5e734f6a0740dce92e7c919e632cb43fa5d4e53"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea4fa54b83bb2e4a21e9026824bfe271b1a6ee1e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pmdomain/bcm/bcm2835-power.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0e84e74849d2d7e9b23a09c2d5e0d9357db1ca59","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"c5e734f6a0740dce92e7c919e632cb43fa5d4e53","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"622ab02e955c35c125ff2b65d8327b2c52db8758","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"9443202d91388026dbf7312972a74fbfd27ee82f","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"ea4fa54b83bb2e4a21e9026824bfe271b1a6ee1e","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"18605b1b936b66b1f34dcf8e9ad4f1fbcf7a7c13","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"572f17180f26619809b8e0593d926762aa8660ff","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"},{"lessThan":"b826d2c0b0ecb844c84431ba6b502e744f5d919a","status":"affected","version":"670c672608a1ffcbc7ac0f872734843593bb8b15","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pmdomain/bcm/bcm2835-power.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.1"},{"lessThan":"5.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7A7963C2-E27E-41F4-A575-6430E58CBEED","versionEndExcluding":"5.10.253","versionStartIncluding":"5.1.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.1:-:*:*:*:*:*:*","matchCriteriaId":"D89FA266-EDB9-412A-B18E-1B5A0FCC3C0D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: bcm: bcm2835-power: Increase ASB control timeout\n\nThe bcm2835_asb_control() function uses a tight polling loop to wait\nfor the ASB bridge to acknowledge a request. During intensive workloads,\nthis handshake intermittently fails for V3D's master ASB on BCM2711,\nresulting in \"Failed to disable ASB master for v3d\" errors during\nruntime PM suspend. As a consequence, the failed power-off leaves V3D in\na broken state, leading to bus faults or system hangs on later accesses.\n\nAs the timeout is insufficient in some scenarios, increase the polling\ntimeout from 1us to 5us, which is still negligible in the context of a\npower domain transition. Also, replace the open-coded ktime_get_ns()/\ncpu_relax() polling loop with readl_poll_timeout_atomic()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\npmdomain: bcm: bcm2835-power: Aumentar el tiempo de espera del control ASB\n\nLa función bcm2835_asb_control() utiliza un bucle de sondeo ajustado para esperar a que el puente ASB reconozca una solicitud. Durante cargas de trabajo intensivas, este ’handshake’ falla intermitentemente para el ASB maestro de V3D en BCM2711, lo que resulta en errores ’Failed to disable ASB master for v3d’ durante la suspensión de PM en tiempo de ejecución. Como consecuencia, el apagado fallido deja a V3D en un estado defectuoso, lo que lleva a fallos de bus o cuelgues del sistema en accesos posteriores.\n\nDado que el tiempo de espera es insuficiente en algunos escenarios, se aumenta el tiempo de espera del sondeo de 1us a 5us, lo cual sigue siendo insignificante en el contexto de una transición de dominio de energía. Además, se reemplaza el bucle de sondeo ’open-coded’ ktime_get_ns()/cpu_relax() con readl_poll_timeout_atomic()."}],"id":"CVE-2026-31550","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:29.207","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e84e74849d2d7e9b23a09c2d5e0d9357db1ca59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/18605b1b936b66b1f34dcf8e9ad4f1fbcf7a7c13"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/572f17180f26619809b8e0593d926762aa8660ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/622ab02e955c35c125ff2b65d8327b2c52db8758"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9443202d91388026dbf7312972a74fbfd27ee82f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b826d2c0b0ecb844c84431ba6b502e744f5d919a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c5e734f6a0740dce92e7c919e632cb43fa5d4e53"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea4fa54b83bb2e4a21e9026824bfe271b1a6ee1e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31551.json b/data/2026/CVE-2026-31551.json index 5bd0fb4bbc..3b140df52e 100644 --- a/data/2026/CVE-2026-31551.json +++ b/data/2026/CVE-2026-31551.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/mac80211/debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"787152497ac763deab16f6f4b7ce79aaeb3eb7e8","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"8bb90ff77326c34e75b573b1febdd9586fec5aba","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"256f7d4c11235d0569f78413c41dc89d2dc1557c","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"29a1a350afcd28a2150bd73b8bd83eac3480f13e","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"5ba05436f15d16ae7ab04b880e8bf8d440be892b","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"b24763d32d5b4ada766deca4b42d6766272fef0c","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"b94ae8e0d5fe1bdbbfdc3854ff6ce98f6876a828","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/mac80211/debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AA3D6441-4F2E-41AB-A26D-388B03A5932F","versionEndExcluding":"5.15.203","versionStartIncluding":"5.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:*","matchCriteriaId":"75EB504D-4A83-4C67-9C8D-FD9C6C8EB4CD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Fix static_branch_dec() underflow for aql_disable.\n\nsyzbot reported static_branch_dec() underflow in aql_enable_write(). [0]\n\nThe problem is that aql_enable_write() does not serialise concurrent\nwrite()s to the debugfs.\n\naql_enable_write() checks static_key_false(&aql_disable.key) and\nlater calls static_branch_inc() or static_branch_dec(), but the\nstate may change between the two calls.\n\naql_disable does not need to track inc/dec.\n\nLet's use static_branch_enable() and static_branch_disable().\n\n[0]:\nval == 0\nWARNING: kernel/jump_label.c:311 at __static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311, CPU#0: syz.1.3155/20288\nModules linked in:\nCPU: 0 UID: 0 PID: 20288 Comm: syz.1.3155 Tainted: G U L syzkaller #0 PREEMPT(full)\nTainted: [U]=USER, [L]=SOFTLOCKUP\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026\nRIP: 0010:__static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311\nCode: f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 <0f> 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00\nRSP: 0018:ffffc9000b9f7c10 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffffff9b3e5d40 RCX: ffffffff823c57b4\nRDX: ffff8880285a0000 RSI: ffffffff823c5846 RDI: ffff8880285a0000\nRBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a\nR13: 1ffff9200173ef88 R14: 0000000000000001 R15: ffffc9000b9f7e98\nFS: 00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000001140 CR3: 000000007cc4a000 CR4: 00000000003526f0\nCall Trace:\n \n __static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline]\n __static_key_slow_dec kernel/jump_label.c:321 [inline]\n static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336\n aql_enable_write+0x2b2/0x310 net/mac80211/debugfs.c:343\n short_proxy_write+0x133/0x1a0 fs/debugfs/file.c:383\n vfs_write+0x2aa/0x1070 fs/read_write.c:684\n ksys_pwrite64 fs/read_write.c:793 [inline]\n __do_sys_pwrite64 fs/read_write.c:801 [inline]\n __se_sys_pwrite64 fs/read_write.c:798 [inline]\n __x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:798\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f530cf9aeb9\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f530dd72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012\nRAX: ffffffffffffffda RBX: 00007f530d215fa0 RCX: 00007f530cf9aeb9\nRDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010\nRBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000\nR10: 4200000000000005 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978\n "}],"id":"CVE-2026-31551","lastModified":"2026-11-05T22:18:39.900","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31551","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:34.190665Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:29.350","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/256f7d4c11235d0569f78413c41dc89d2dc1557c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29a1a350afcd28a2150bd73b8bd83eac3480f13e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5ba05436f15d16ae7ab04b880e8bf8d440be892b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/787152497ac763deab16f6f4b7ce79aaeb3eb7e8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8bb90ff77326c34e75b573b1febdd9586fec5aba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b24763d32d5b4ada766deca4b42d6766272fef0c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b94ae8e0d5fe1bdbbfdc3854ff6ce98f6876a828"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/mac80211/debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"787152497ac763deab16f6f4b7ce79aaeb3eb7e8","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"8bb90ff77326c34e75b573b1febdd9586fec5aba","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"256f7d4c11235d0569f78413c41dc89d2dc1557c","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"29a1a350afcd28a2150bd73b8bd83eac3480f13e","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"5ba05436f15d16ae7ab04b880e8bf8d440be892b","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"b24763d32d5b4ada766deca4b42d6766272fef0c","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"},{"lessThan":"b94ae8e0d5fe1bdbbfdc3854ff6ce98f6876a828","status":"affected","version":"e908435e402aff23c9b0b3c59c7cd12b08b681b0","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/mac80211/debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AA3D6441-4F2E-41AB-A26D-388B03A5932F","versionEndExcluding":"5.15.203","versionStartIncluding":"5.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:*","matchCriteriaId":"75EB504D-4A83-4C67-9C8D-FD9C6C8EB4CD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Fix static_branch_dec() underflow for aql_disable.\n\nsyzbot reported static_branch_dec() underflow in aql_enable_write(). [0]\n\nThe problem is that aql_enable_write() does not serialise concurrent\nwrite()s to the debugfs.\n\naql_enable_write() checks static_key_false(&aql_disable.key) and\nlater calls static_branch_inc() or static_branch_dec(), but the\nstate may change between the two calls.\n\naql_disable does not need to track inc/dec.\n\nLet's use static_branch_enable() and static_branch_disable().\n\n[0]:\nval == 0\nWARNING: kernel/jump_label.c:311 at __static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311, CPU#0: syz.1.3155/20288\nModules linked in:\nCPU: 0 UID: 0 PID: 20288 Comm: syz.1.3155 Tainted: G U L syzkaller #0 PREEMPT(full)\nTainted: [U]=USER, [L]=SOFTLOCKUP\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026\nRIP: 0010:__static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311\nCode: f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 <0f> 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00\nRSP: 0018:ffffc9000b9f7c10 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffffff9b3e5d40 RCX: ffffffff823c57b4\nRDX: ffff8880285a0000 RSI: ffffffff823c5846 RDI: ffff8880285a0000\nRBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a\nR13: 1ffff9200173ef88 R14: 0000000000000001 R15: ffffc9000b9f7e98\nFS: 00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000001140 CR3: 000000007cc4a000 CR4: 00000000003526f0\nCall Trace:\n \n __static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline]\n __static_key_slow_dec kernel/jump_label.c:321 [inline]\n static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336\n aql_enable_write+0x2b2/0x310 net/mac80211/debugfs.c:343\n short_proxy_write+0x133/0x1a0 fs/debugfs/file.c:383\n vfs_write+0x2aa/0x1070 fs/read_write.c:684\n ksys_pwrite64 fs/read_write.c:793 [inline]\n __do_sys_pwrite64 fs/read_write.c:801 [inline]\n __se_sys_pwrite64 fs/read_write.c:798 [inline]\n __x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:798\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f530cf9aeb9\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f530dd72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012\nRAX: ffffffffffffffda RBX: 00007f530d215fa0 RCX: 00007f530cf9aeb9\nRDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010\nRBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000\nR10: 4200000000000005 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978\n "},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: wifi: mac80211: Solución para el desbordamiento negativo (underflow) de static_branch_dec() para aql_disable. syzbot informó un desbordamiento negativo (underflow) de static_branch_dec() en aql_enable_write(). [0] El problema es que aql_enable_write() no serializa las escrituras concurrentes (write()s) al debugfs. aql_enable_write() comprueba static_key_false( y aql_disable.key) y luego llama a static_branch_inc() o static_branch_dec(), pero el estado puede cambiar entre las dos llamadas. aql_disable no necesita rastrear inc/dec. Usemos static_branch_enable() y static_branch_disable(). [0]:\nval == 0\nADVERTENCIA: kernel/jump_label.c:311 en __static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311, CPU#0: syz.1.3155/20288\nMódulos enlazados:\nCPU: 0 UID: 0 PID: 20288 Comm: syz.1.3155 Tainted: G U L syzkaller #0 PREEMPT(full)\nTainted: [U]=USER, [L]=SOFTLOCKUP\nNombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026\nRIP: 0010:__static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311\nCode: f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 menor que 0fmayor que 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00\nRSP: 0018:ffffc9000b9f7c10 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffffff9b3e5d40 RCX: ffffffff823c57b4\nRDX: ffff8880285a0000 RSI: ffffffff823c5846 RDI: ffff8880285a0000\nRBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a\nR13: 1ffff9200173ef88 R14: 0000000000000001 R15: ffffc9000b9f7e98\nFS: 00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000001140 CR3: 000000007cc4a000 CR4: 00000000003526f0\nRastro de Llamadas: [TASK] __static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline] __static_key_slow_dec kernel/jump_label.c:321 [inline] static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336 aql_enable_write+0x2b2/0x310 net/mac80211/debugfs.c:343 short_proxy_write+0x133/0x1a0 fs/debugfs/file.c:383 vfs_write+0x2aa/0x 1070 fs/read_write.c:684 ksys_pwrite64 fs/read_write.c:793 [inline] __do_sys_pwrite64 fs/read_write.c:801 [inline] __se_sys_pwrite64 fs/read_write.c:798 [inline] __x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:798 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x 7f530cf9aeb9\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 menor que 48mayor que 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f530dd72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012\nRAX: ffffffffffffffda RBX: 00007f530d215fa0 RCX: 00007f530cf9aeb9\nRDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010\nRBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000\nR10: 4200000000000005 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978 [/TASK]"}],"id":"CVE-2026-31551","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31551","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:34.190665Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:29.350","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/256f7d4c11235d0569f78413c41dc89d2dc1557c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29a1a350afcd28a2150bd73b8bd83eac3480f13e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5ba05436f15d16ae7ab04b880e8bf8d440be892b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/787152497ac763deab16f6f4b7ce79aaeb3eb7e8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8bb90ff77326c34e75b573b1febdd9586fec5aba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b24763d32d5b4ada766deca4b42d6766272fef0c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b94ae8e0d5fe1bdbbfdc3854ff6ce98f6876a828"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31552.json b/data/2026/CVE-2026-31552.json index d810f01827..b0ddba17d6 100644 --- a/data/2026/CVE-2026-31552.json +++ b/data/2026/CVE-2026-31552.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/ti/wlcore/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"980f793645540ca7a6318165cc12f49d5febeb99","status":"affected","version":"88295a55fefe5414e64293638b6f7549646e58ed","versionType":"git"},{"lessThan":"12f9eef39e49716c763714bfda835a733d5f6dea","status":"affected","version":"cd89a4656c03f8db0c57350aaec69cd3cfaa3522","versionType":"git"},{"lessThan":"ceb46b40b021d21911ff8608ce4ed33c1264ad2f","status":"affected","version":"745a0810dbc96a0471e5f5e627ba1e978c3116d4","versionType":"git"},{"lessThan":"a6dc74209462c4fe5a88718d2f3a5286886081c8","status":"affected","version":"b167312390fdd461c81ead516f2b0b44e83a9edb","versionType":"git"},{"lessThan":"cfa64e2b3717be1da7c4c1aff7268a009e8c1610","status":"affected","version":"71de0b6e04bbee5575caf9a1e4d424e7dcc50018","versionType":"git"},{"lessThan":"46c670ff1ff466e5eccb3940f726586473dc053c","status":"affected","version":"689a7980e4788e13e766763d53569fb78dea2513","versionType":"git"},{"lessThan":"f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c","status":"affected","version":"e75665dd096819b1184087ba5718bd93beafff51","versionType":"git"},{"lessThan":"deb353d9bb009638b7762cae2d0b6e8fdbb41a69","status":"affected","version":"e75665dd096819b1184087ba5718bd93beafff51","versionType":"git"},{"lessThan":"5.10.253","status":"affected","version":"5.10.250","versionType":"semver"},{"lessThan":"5.15.203","status":"affected","version":"5.15.200","versionType":"semver"},{"lessThan":"6.1.167","status":"affected","version":"6.1.163","versionType":"semver"},{"lessThan":"6.6.130","status":"affected","version":"6.6.124","versionType":"semver"},{"lessThan":"6.12.78","status":"affected","version":"6.12.70","versionType":"semver"},{"lessThan":"6.18.20","status":"affected","version":"6.18.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/ti/wlcore/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"66E4302C-5EB9-4984-983B-20CA9FFA4B97","versionEndExcluding":"5.10.253","versionStartIncluding":"5.10.250","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"63DFD51E-A9F5-4387-ABA4-525154CD3972","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.200","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"73CD421D-F2A3-4142-A9A2-47683BB9ABD4","versionEndExcluding":"6.1.167","versionStartIncluding":"6.1.163","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C1C9B72D-1F0E-488D-AE95-ADE16C092AF0","versionEndExcluding":"6.6.130","versionStartIncluding":"6.6.124","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0126FC39-C23D-40D2-BC7F-4692652C4520","versionEndExcluding":"6.12.78","versionStartIncluding":"6.12.70","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E3BAA8AC-B2CC-40BC-AFBE-379025E7EF3D","versionEndExcluding":"6.18.20","versionStartIncluding":"6.18.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D70DEFFE-AC47-4F3A-A2B2-2D67AB4CF3C8","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom\n\nSince upstream commit e75665dd0968 (\"wifi: wlcore: ensure skb headroom\nbefore skb_push\"), wl1271_tx_allocate() and with it\nwl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.\nHowever, in wlcore_tx_work_locked(), a return value of -EAGAIN from\nwl1271_prepare_tx_frame() is interpreted as the aggregation buffer being\nfull. This causes the code to flush the buffer, put the skb back at the\nhead of the queue, and immediately retry the same skb in a tight while\nloop.\n\nBecause wlcore_tx_work_locked() holds wl->mutex, and the retry happens\nimmediately with GFP_ATOMIC, this will result in an infinite loop and a\nCPU soft lockup. Return -ENOMEM instead so the packet is dropped and\nthe loop terminates.\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y."}],"id":"CVE-2026-31552","lastModified":"2026-06-17T10:33:57.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:29.497","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cfa64e2b3717be1da7c4c1aff7268a009e8c1610"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/deb353d9bb009638b7762cae2d0b6e8fdbb41a69"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/ti/wlcore/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"980f793645540ca7a6318165cc12f49d5febeb99","status":"affected","version":"88295a55fefe5414e64293638b6f7549646e58ed","versionType":"git"},{"lessThan":"12f9eef39e49716c763714bfda835a733d5f6dea","status":"affected","version":"cd89a4656c03f8db0c57350aaec69cd3cfaa3522","versionType":"git"},{"lessThan":"ceb46b40b021d21911ff8608ce4ed33c1264ad2f","status":"affected","version":"745a0810dbc96a0471e5f5e627ba1e978c3116d4","versionType":"git"},{"lessThan":"a6dc74209462c4fe5a88718d2f3a5286886081c8","status":"affected","version":"b167312390fdd461c81ead516f2b0b44e83a9edb","versionType":"git"},{"lessThan":"cfa64e2b3717be1da7c4c1aff7268a009e8c1610","status":"affected","version":"71de0b6e04bbee5575caf9a1e4d424e7dcc50018","versionType":"git"},{"lessThan":"46c670ff1ff466e5eccb3940f726586473dc053c","status":"affected","version":"689a7980e4788e13e766763d53569fb78dea2513","versionType":"git"},{"lessThan":"f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c","status":"affected","version":"e75665dd096819b1184087ba5718bd93beafff51","versionType":"git"},{"lessThan":"deb353d9bb009638b7762cae2d0b6e8fdbb41a69","status":"affected","version":"e75665dd096819b1184087ba5718bd93beafff51","versionType":"git"},{"lessThan":"5.10.253","status":"affected","version":"5.10.250","versionType":"semver"},{"lessThan":"5.15.203","status":"affected","version":"5.15.200","versionType":"semver"},{"lessThan":"6.1.167","status":"affected","version":"6.1.163","versionType":"semver"},{"lessThan":"6.6.130","status":"affected","version":"6.6.124","versionType":"semver"},{"lessThan":"6.12.78","status":"affected","version":"6.12.70","versionType":"semver"},{"lessThan":"6.18.20","status":"affected","version":"6.18.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/ti/wlcore/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"66E4302C-5EB9-4984-983B-20CA9FFA4B97","versionEndExcluding":"5.10.253","versionStartIncluding":"5.10.250","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"63DFD51E-A9F5-4387-ABA4-525154CD3972","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.200","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"73CD421D-F2A3-4142-A9A2-47683BB9ABD4","versionEndExcluding":"6.1.167","versionStartIncluding":"6.1.163","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C1C9B72D-1F0E-488D-AE95-ADE16C092AF0","versionEndExcluding":"6.6.130","versionStartIncluding":"6.6.124","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0126FC39-C23D-40D2-BC7F-4692652C4520","versionEndExcluding":"6.12.78","versionStartIncluding":"6.12.70","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E3BAA8AC-B2CC-40BC-AFBE-379025E7EF3D","versionEndExcluding":"6.18.20","versionStartIncluding":"6.18.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D70DEFFE-AC47-4F3A-A2B2-2D67AB4CF3C8","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom\n\nSince upstream commit e75665dd0968 (\"wifi: wlcore: ensure skb headroom\nbefore skb_push\"), wl1271_tx_allocate() and with it\nwl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.\nHowever, in wlcore_tx_work_locked(), a return value of -EAGAIN from\nwl1271_prepare_tx_frame() is interpreted as the aggregation buffer being\nfull. This causes the code to flush the buffer, put the skb back at the\nhead of the queue, and immediately retry the same skb in a tight while\nloop.\n\nBecause wlcore_tx_work_locked() holds wl->mutex, and the retry happens\nimmediately with GFP_ATOMIC, this will result in an infinite loop and a\nCPU soft lockup. Return -ENOMEM instead so the packet is dropped and\nthe loop terminates.\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nwifi: wlcore: Devolver -ENOMEM en lugar de -EAGAIN si no hay suficiente espacio de cabecera (headroom)\n\nDesde el commit upstream e75665dd0968 (’wifi: wlcore: ensure skb headroom before skb_push’), wl1271_tx_allocate() y con ello wl1271_prepare_tx_frame() devuelven -EAGAIN si pskb_expand_head() falla. Sin embargo, en wlcore_tx_work_locked(), un valor de retorno de -EAGAIN de wl1271_prepare_tx_frame() se interpreta como que el búfer de agregación está lleno. Esto hace que el código vacíe el búfer, coloque el skb de nuevo al principio de la cola e intente inmediatamente el mismo skb en un bucle ’while’ ajustado.\n\nDebido a que wlcore_tx_work_locked() mantiene wl -> mutex, y el reintento ocurre inmediatamente con GFP_ATOMIC, esto resultará en un bucle infinito y un bloqueo suave de la CPU (CPU soft lockup). Devolver -ENOMEM en su lugar para que el paquete se descarte y el bucle termine.\n\nEl problema fue encontrado por un agente experimental de revisión de código basado en gemini-3.1-pro mientras revisaba backports en v6.18.y."}],"id":"CVE-2026-31552","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:29.497","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cfa64e2b3717be1da7c4c1aff7268a009e8c1610"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/deb353d9bb009638b7762cae2d0b6e8fdbb41a69"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31553.json b/data/2026/CVE-2026-31553.json index 30dab58fbd..73dbd77737 100644 --- a/data/2026/CVE-2026-31553.json +++ b/data/2026/CVE-2026-31553.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/arm64/kvm/at.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4307e05e568782fc92eff651b09ee5dee88a058d","status":"affected","version":"f6927b41d57390c597a126063e2e518911976878","versionType":"git"},{"lessThan":"0496acc42fb51eee040b5170cec05cec41385540","status":"affected","version":"f6927b41d57390c597a126063e2e518911976878","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/arm64/kvm/at.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5054C854-C253-4020-BD2E-2BDA121E424C","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()\n\nUsing \"(u64 __user *)hva + offset\" to get the virtual addresses of S1/S2\ndescriptors looks really wrong, if offset is not zero. What we want to get\nfor swapping is hva + offset, not hva + offset*8. ;-)\n\nFix it."}],"id":"CVE-2026-31553","lastModified":"2026-06-17T10:33:57.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:29.633","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0496acc42fb51eee040b5170cec05cec41385540"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4307e05e568782fc92eff651b09ee5dee88a058d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/arm64/kvm/at.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4307e05e568782fc92eff651b09ee5dee88a058d","status":"affected","version":"f6927b41d57390c597a126063e2e518911976878","versionType":"git"},{"lessThan":"0496acc42fb51eee040b5170cec05cec41385540","status":"affected","version":"f6927b41d57390c597a126063e2e518911976878","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/arm64/kvm/at.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5054C854-C253-4020-BD2E-2BDA121E424C","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()\n\nUsing \"(u64 __user *)hva + offset\" to get the virtual addresses of S1/S2\ndescriptors looks really wrong, if offset is not zero. What we want to get\nfor swapping is hva + offset, not hva + offset*8. ;-)\n\nFix it."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nKVM: arm64: Corrige la dirección del descriptor en __kvm_at_swap_desc()\n\nUsar ’(u64 __user *)hva + offset’ para obtener las direcciones virtuales de los descriptores S1/S2 parece realmente incorrecto, si offset no es cero. Lo que queremos obtener para el intercambio es hva + offset, no hva + offset8. ;-)\n\nCorregido."}],"id":"CVE-2026-31553","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:29.633","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0496acc42fb51eee040b5170cec05cec41385540"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4307e05e568782fc92eff651b09ee5dee88a058d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31554.json b/data/2026/CVE-2026-31554.json index ff63021841..80547de0eb 100644 --- a/data/2026/CVE-2026-31554.json +++ b/data/2026/CVE-2026-31554.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/futex/syscalls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"027145ace09fad4c7cbcd6c61fe9b429c63eb0e5","status":"affected","version":"0f4b5f972216782a4acb1ae00dcb55173847c2ff","versionType":"git"},{"lessThan":"18b7d09c2b794c71d4252f3ea2cf84ad12b73d6a","status":"affected","version":"0f4b5f972216782a4acb1ae00dcb55173847c2ff","versionType":"git"},{"lessThan":"e2f78c7ec1655fedd945366151ba54fcb9580508","status":"affected","version":"0f4b5f972216782a4acb1ae00dcb55173847c2ff","versionType":"git"},{"lessThan":"19f94b39058681dec64a10ebeb6f23fe7fc3f77a","status":"affected","version":"0f4b5f972216782a4acb1ae00dcb55173847c2ff","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/futex/syscalls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"92943666-715A-42F1-AF8E-6D1419BD7D3E","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.7:-:*:*:*:*:*:*","matchCriteriaId":"62B55B1B-7D3E-499B-9C42-E9F1EF05A54A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Require sys_futex_requeue() to have identical flags\n\nNicholas reported that his LLM found it was possible to create a UaF\nwhen sys_futex_requeue() is used with different flags. The initial\nmotivation for allowing different flags was the variable sized futex,\nbut since that hasn't been merged (yet), simply mandate the flags are\nidentical, as is the case for the old style sys_futex() requeue\noperations."}],"id":"CVE-2026-31554","lastModified":"2026-10-19T19:17:59.780","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31554","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:51.086249Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:29.730","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/027145ace09fad4c7cbcd6c61fe9b429c63eb0e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/18b7d09c2b794c71d4252f3ea2cf84ad12b73d6a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/19f94b39058681dec64a10ebeb6f23fe7fc3f77a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2f78c7ec1655fedd945366151ba54fcb9580508"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/futex/syscalls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"027145ace09fad4c7cbcd6c61fe9b429c63eb0e5","status":"affected","version":"0f4b5f972216782a4acb1ae00dcb55173847c2ff","versionType":"git"},{"lessThan":"18b7d09c2b794c71d4252f3ea2cf84ad12b73d6a","status":"affected","version":"0f4b5f972216782a4acb1ae00dcb55173847c2ff","versionType":"git"},{"lessThan":"e2f78c7ec1655fedd945366151ba54fcb9580508","status":"affected","version":"0f4b5f972216782a4acb1ae00dcb55173847c2ff","versionType":"git"},{"lessThan":"19f94b39058681dec64a10ebeb6f23fe7fc3f77a","status":"affected","version":"0f4b5f972216782a4acb1ae00dcb55173847c2ff","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/futex/syscalls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"92943666-715A-42F1-AF8E-6D1419BD7D3E","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.7:-:*:*:*:*:*:*","matchCriteriaId":"62B55B1B-7D3E-499B-9C42-E9F1EF05A54A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Require sys_futex_requeue() to have identical flags\n\nNicholas reported that his LLM found it was possible to create a UaF\nwhen sys_futex_requeue() is used with different flags. The initial\nmotivation for allowing different flags was the variable sized futex,\nbut since that hasn't been merged (yet), simply mandate the flags are\nidentical, as is the case for the old style sys_futex() requeue\noperations."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfutex: Requerir que sys_futex_requeue() tenga flags idénticos\n\nNicholas informó que su LLM encontró que era posible crear un UaF cuando se usa sys_futex_requeue() con flags diferentes. La motivación inicial para permitir flags diferentes era el futex de tamaño variable, pero dado que eso no se ha fusionado (aún), simplemente se exige que los flags sean idénticos, como es el caso para las operaciones de requeue de estilo antiguo de sys_futex()."}],"id":"CVE-2026-31554","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31554","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:51.086249Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:29.730","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/027145ace09fad4c7cbcd6c61fe9b429c63eb0e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/18b7d09c2b794c71d4252f3ea2cf84ad12b73d6a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/19f94b39058681dec64a10ebeb6f23fe7fc3f77a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2f78c7ec1655fedd945366151ba54fcb9580508"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31555.json b/data/2026/CVE-2026-31555.json index 126c35306c..a89bc5b77b 100644 --- a/data/2026/CVE-2026-31555.json +++ b/data/2026/CVE-2026-31555.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/futex/pi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"e7824ec168d2ac883a213cd1f4d6cc0816002a85","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"5e8e06bf8909e79b4acd950cf578cfc2f10bbefa","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"de7c0c04ad868f2cee6671b11c0a6d20421af1da","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"7475dfad10a05a5bfadebf5f2499bd61b19ed293","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"92e47ad03e03dbb5515bdf06444bf6b1e147310d","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"71112e62807d1925dc3ae6188b11f8cfc85aec23","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"210d36d892de5195e6766c45519dfb1e65f3eb83","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"status":"affected","version":"f2a9957e5c08b1b1caacd18a3dc4c0a1bdb7b463","versionType":"git"},{"status":"affected","version":"cf16e42709aa86aa3e37f3acc3d13d5715d90096","versionType":"git"},{"status":"affected","version":"61fa9f167caaa73d0a7c88f498eceeb12c6fa3db","versionType":"git"},{"status":"affected","version":"7874eee0130adf9bee28e8720bb5dd051089def3","versionType":"git"},{"status":"affected","version":"fc3b55ef2c840bb2746b2d8121a0788de84f7fac","versionType":"git"},{"lessThan":"4.5","status":"affected","version":"4.4.255","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.255","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.158","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.172","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.1","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/futex/pi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"39A57944-7654-4465-9F2B-4DC1CB18ADFB","versionEndExcluding":"4.5","versionStartIncluding":"4.4.255","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F932A542-7872-4F86-AD1E-00CCC240C25D","versionEndExcluding":"4.10","versionStartIncluding":"4.9.255","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C62F59A2-9EFC-4E7F-B9E7-3DFF4E885406","versionEndExcluding":"4.15","versionStartIncluding":"4.14.158","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"235BE773-4E0B-4AD6-9314-D176A65C4B73","versionEndExcluding":"4.20","versionStartIncluding":"4.19.172","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"025DC0BA-08A8-4703-AE9F-7C3D8E346A45","versionEndExcluding":"5.5","versionStartIncluding":"5.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"45E871E1-B00E-4E88-83A3-60B38EAF2B8A","versionEndExcluding":"5.10.253","versionStartIncluding":"5.5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:*","matchCriteriaId":"EE98F46A-F7D9-4609-B6A0-882E7F0D378C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Clear stale exiting pointer in futex_lock_pi() retry path\n\nFuzzying/stressing futexes triggered:\n\n WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524\n\nWhen futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY\nand stores a refcounted task pointer in 'exiting'.\n\nAfter wait_for_owner_exiting() consumes that reference, the local pointer\nis never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a\ndifferent error, the bogus pointer is passed to wait_for_owner_exiting().\n\n CPU0\t\t\t CPU1\t\t CPU2\n futex_lock_pi(uaddr)\n // acquires the PI futex\n exit()\n futex_cleanup_begin()\n futex_state = EXITING;\n\t\t\t futex_lock_pi(uaddr)\n\t\t\t futex_lock_pi_atomic()\n\t\t\t\t attach_to_pi_owner()\n\t\t\t\t // observes EXITING\n\t\t\t\t *exiting = owner; // takes ref\n\t\t\t\t return -EBUSY\n\t\t\t wait_for_owner_exiting(-EBUSY, owner)\n\t\t\t\t put_task_struct(); // drops ref\n\t\t\t // exiting still points to owner\n\t\t\t goto retry;\n\t\t\t futex_lock_pi_atomic()\n\t\t\t\t lock_pi_update_atomic()\n\t\t\t\t cmpxchg(uaddr)\n\t\t\t\t\t*uaddr ^= WAITERS // whatever\n\t\t\t\t // value changed\n\t\t\t\t return -EAGAIN;\n\t\t\t wait_for_owner_exiting(-EAGAIN, exiting) // stale\n\t\t\t\t WARN_ON_ONCE(exiting)\n\nFix this by resetting upon retry, essentially aligning it with requeue_pi."}],"id":"CVE-2026-31555","lastModified":"2026-11-10T13:18:59.343","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31555","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:41.447334Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:29.837","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/210d36d892de5195e6766c45519dfb1e65f3eb83"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e8e06bf8909e79b4acd950cf578cfc2f10bbefa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/71112e62807d1925dc3ae6188b11f8cfc85aec23"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7475dfad10a05a5bfadebf5f2499bd61b19ed293"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/92e47ad03e03dbb5515bdf06444bf6b1e147310d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de7c0c04ad868f2cee6671b11c0a6d20421af1da"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e7824ec168d2ac883a213cd1f4d6cc0816002a85"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/futex/pi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"e7824ec168d2ac883a213cd1f4d6cc0816002a85","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"5e8e06bf8909e79b4acd950cf578cfc2f10bbefa","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"de7c0c04ad868f2cee6671b11c0a6d20421af1da","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"7475dfad10a05a5bfadebf5f2499bd61b19ed293","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"92e47ad03e03dbb5515bdf06444bf6b1e147310d","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"71112e62807d1925dc3ae6188b11f8cfc85aec23","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"lessThan":"210d36d892de5195e6766c45519dfb1e65f3eb83","status":"affected","version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","versionType":"git"},{"status":"affected","version":"f2a9957e5c08b1b1caacd18a3dc4c0a1bdb7b463","versionType":"git"},{"status":"affected","version":"cf16e42709aa86aa3e37f3acc3d13d5715d90096","versionType":"git"},{"status":"affected","version":"61fa9f167caaa73d0a7c88f498eceeb12c6fa3db","versionType":"git"},{"status":"affected","version":"7874eee0130adf9bee28e8720bb5dd051089def3","versionType":"git"},{"status":"affected","version":"fc3b55ef2c840bb2746b2d8121a0788de84f7fac","versionType":"git"},{"lessThan":"4.5","status":"affected","version":"4.4.255","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.255","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.158","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.172","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.1","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/futex/pi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"39A57944-7654-4465-9F2B-4DC1CB18ADFB","versionEndExcluding":"4.5","versionStartIncluding":"4.4.255","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F932A542-7872-4F86-AD1E-00CCC240C25D","versionEndExcluding":"4.10","versionStartIncluding":"4.9.255","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C62F59A2-9EFC-4E7F-B9E7-3DFF4E885406","versionEndExcluding":"4.15","versionStartIncluding":"4.14.158","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"235BE773-4E0B-4AD6-9314-D176A65C4B73","versionEndExcluding":"4.20","versionStartIncluding":"4.19.172","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"025DC0BA-08A8-4703-AE9F-7C3D8E346A45","versionEndExcluding":"5.5","versionStartIncluding":"5.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"45E871E1-B00E-4E88-83A3-60B38EAF2B8A","versionEndExcluding":"5.10.253","versionStartIncluding":"5.5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:*","matchCriteriaId":"EE98F46A-F7D9-4609-B6A0-882E7F0D378C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Clear stale exiting pointer in futex_lock_pi() retry path\n\nFuzzying/stressing futexes triggered:\n\n WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524\n\nWhen futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY\nand stores a refcounted task pointer in 'exiting'.\n\nAfter wait_for_owner_exiting() consumes that reference, the local pointer\nis never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a\ndifferent error, the bogus pointer is passed to wait_for_owner_exiting().\n\n CPU0\t\t\t CPU1\t\t CPU2\n futex_lock_pi(uaddr)\n // acquires the PI futex\n exit()\n futex_cleanup_begin()\n futex_state = EXITING;\n\t\t\t futex_lock_pi(uaddr)\n\t\t\t futex_lock_pi_atomic()\n\t\t\t\t attach_to_pi_owner()\n\t\t\t\t // observes EXITING\n\t\t\t\t *exiting = owner; // takes ref\n\t\t\t\t return -EBUSY\n\t\t\t wait_for_owner_exiting(-EBUSY, owner)\n\t\t\t\t put_task_struct(); // drops ref\n\t\t\t // exiting still points to owner\n\t\t\t goto retry;\n\t\t\t futex_lock_pi_atomic()\n\t\t\t\t lock_pi_update_atomic()\n\t\t\t\t cmpxchg(uaddr)\n\t\t\t\t\t*uaddr ^= WAITERS // whatever\n\t\t\t\t // value changed\n\t\t\t\t return -EAGAIN;\n\t\t\t wait_for_owner_exiting(-EAGAIN, exiting) // stale\n\t\t\t\t WARN_ON_ONCE(exiting)\n\nFix this by resetting upon retry, essentially aligning it with requeue_pi."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfutex: Borrar puntero ’exiting’ obsoleto en la ruta de reintento de futex_lock_pi()\n\nFuzzing/estrés de futexes desencadenó:\n\nADVERTENCIA: kernel/futex/core.c:825 en wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524\n\nCuando futex_lock_pi_atomic() ve que el propietario está saliendo, devuelve -EBUSY y almacena un puntero de tarea con conteo de referencias en ’exiting’.\n\nDespués de que wait_for_owner_exiting() consume esa referencia, el puntero local nunca se restablece a nil. Tras un reintento, si futex_lock_pi_atomic() devuelve un error diferente, el puntero erróneo se pasa a wait_for_owner_exiting().\n\n CPU0\t\t\t CPU1\t\t CPU2\n futex_lock_pi(uaddr)\n // adquiere el futex PI\n exit()\n futex_cleanup_begin()\n futex_state = EXITING;\n\t\t\t futex_lock_pi(uaddr)\n\t\t\t futex_lock_pi_atomic()\n\t\t\t\t attach_to_pi_owner()\n\t\t\t\t // observa EXITING\n\t\t\t\t exiting = owner; // toma ref\n\t\t\t\t return -EBUSY\n\t\t\t wait_for_owner_exiting(-EBUSY, owner)\n\t\t\t\t put_task_struct(); // suelta ref\n\t\t\t // exiting todavía apunta al propietario\n\t\t\t goto retry;\n\t\t\t futex_lock_pi_atomic()\n\t\t\t\t lock_pi_update_atomic()\n\t\t\t\t cmpxchg(uaddr)\n\t\t\t\t\tuaddr ^= WAITERS // lo que sea\n\t\t\t\t // valor cambiado\n\t\t\t\t return -EAGAIN;\n\t\t\t wait_for_owner_exiting(-EAGAIN, exiting) // obsoleto\n\t\t\t\t WARN_ON_ONCE(exiting)\n\nSolucione esto restableciendo al reintentar, esencialmente alineándolo con requeue_pi."}],"id":"CVE-2026-31555","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31555","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:41.447334Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:29.837","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/210d36d892de5195e6766c45519dfb1e65f3eb83"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e8e06bf8909e79b4acd950cf578cfc2f10bbefa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/71112e62807d1925dc3ae6188b11f8cfc85aec23"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7475dfad10a05a5bfadebf5f2499bd61b19ed293"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/92e47ad03e03dbb5515bdf06444bf6b1e147310d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de7c0c04ad868f2cee6671b11c0a6d20421af1da"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e7824ec168d2ac883a213cd1f4d6cc0816002a85"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31557.json b/data/2026/CVE-2026-31557.json index 0f2a00b535..68bb758542 100644 --- a/data/2026/CVE-2026-31557.json +++ b/data/2026/CVE-2026-31557.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nvme/target/admin-cmd.c","drivers/nvme/target/core.c","drivers/nvme/target/nvmet.h","drivers/nvme/target/rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ede147a85d1d4c075d13ba190453d6b09ecbea37","status":"affected","version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","versionType":"git"},{"lessThan":"a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec","status":"affected","version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","versionType":"git"},{"lessThan":"49c7c50ee6325a084216e94395e067ecde8088fa","status":"affected","version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","versionType":"git"},{"lessThan":"ca111c9d8d6c9d5735878d933a1716c4be86c2d1","status":"affected","version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","versionType":"git"},{"lessThan":"25ceffc1dabec3b93f458b437aae26f4da293f87","status":"affected","version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","versionType":"git"},{"lessThan":"2922e3507f6d5caa7f1d07f145e186fc6f317a4e","status":"affected","version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","versionType":"git"},{"status":"affected","version":"d44ff3b100b94e9f23b1e8dbe688eee9bb867ac9","versionType":"git"},{"status":"affected","version":"84026f8c9357c62a9d3e4c554ffd10ccab813654","versionType":"git"},{"lessThan":"5.16","status":"affected","version":"5.15.42","versionType":"semver"},{"lessThan":"5.18","status":"affected","version":"5.17.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nvme/target/admin-cmd.c","drivers/nvme/target/core.c","drivers/nvme/target/nvmet.h","drivers/nvme/target/rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"752141E3-2E88-4CDB-962E-FE1DFC022596","versionEndExcluding":"5.16","versionStartIncluding":"5.15.42","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E648BBD2-268B-4150-94DA-5E0D23BF336E","versionEndExcluding":"5.18","versionStartIncluding":"5.17.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67222101-CC02-4250-A6E8-A98BDD29DB6F","versionEndExcluding":"6.12.80","versionStartIncluding":"5.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:*","matchCriteriaId":"0384FA0A-DE99-48D7-84E3-46ED0C3B5E03","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: move async event work off nvmet-wq\n\nFor target nvmet_ctrl_free() flushes ctrl->async_event_work.\nIf nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue\ncompletion for the same worker:-\n\nA. Async event work queued on nvmet-wq (prior to disconnect):\n nvmet_execute_async_event()\n queue_work(nvmet_wq, &ctrl->async_event_work)\n\n nvmet_add_async_event()\n queue_work(nvmet_wq, &ctrl->async_event_work)\n\nB. Full pre-work chain (RDMA CM path):\n nvmet_rdma_cm_handler()\n nvmet_rdma_queue_disconnect()\n __nvmet_rdma_queue_disconnect()\n queue_work(nvmet_wq, &queue->release_work)\n process_one_work()\n lock((wq_completion)nvmet-wq) <--------- 1st\n nvmet_rdma_release_queue_work()\n\nC. Recursive path (same worker):\n nvmet_rdma_release_queue_work()\n nvmet_rdma_free_queue()\n nvmet_sq_destroy()\n nvmet_ctrl_put()\n nvmet_ctrl_free()\n flush_work(&ctrl->async_event_work)\n __flush_work()\n touch_wq_lockdep_map()\n lock((wq_completion)nvmet-wq) <--------- 2nd\n\nLockdep splat:\n\n ============================================\n WARNING: possible recursive locking detected\n 6.19.0-rc3nvme+ #14 Tainted: G N\n --------------------------------------------\n kworker/u192:42/44933 is trying to acquire lock:\n ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90\n\n but task is already holding lock:\n ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n\n 3 locks held by kworker/u192:42/44933:\n #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n #1: ffffc9000e6cbe28 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660\n #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530\n\n Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma]\n Call Trace:\n __flush_work+0x268/0x530\n nvmet_ctrl_free+0x140/0x310 [nvmet]\n nvmet_cq_put+0x74/0x90 [nvmet]\n nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma]\n nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma]\n process_one_work+0x206/0x660\n worker_thread+0x184/0x320\n kthread+0x10c/0x240\n ret_from_fork+0x319/0x390\n\nMove async event work to a dedicated nvmet-aen-wq to avoid reentrant\nflush on nvmet-wq."}],"id":"CVE-2026-31557","lastModified":"2026-10-30T13:18:40.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31557","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:53.279331Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:30.080","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25ceffc1dabec3b93f458b437aae26f4da293f87"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2922e3507f6d5caa7f1d07f145e186fc6f317a4e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/49c7c50ee6325a084216e94395e067ecde8088fa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca111c9d8d6c9d5735878d933a1716c4be86c2d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ede147a85d1d4c075d13ba190453d6b09ecbea37"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-667"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nvme/target/admin-cmd.c","drivers/nvme/target/core.c","drivers/nvme/target/nvmet.h","drivers/nvme/target/rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ede147a85d1d4c075d13ba190453d6b09ecbea37","status":"affected","version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","versionType":"git"},{"lessThan":"a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec","status":"affected","version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","versionType":"git"},{"lessThan":"49c7c50ee6325a084216e94395e067ecde8088fa","status":"affected","version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","versionType":"git"},{"lessThan":"ca111c9d8d6c9d5735878d933a1716c4be86c2d1","status":"affected","version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","versionType":"git"},{"lessThan":"25ceffc1dabec3b93f458b437aae26f4da293f87","status":"affected","version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","versionType":"git"},{"lessThan":"2922e3507f6d5caa7f1d07f145e186fc6f317a4e","status":"affected","version":"8832cf922151e9dfa2821736beb0ae2dd3968b6e","versionType":"git"},{"status":"affected","version":"d44ff3b100b94e9f23b1e8dbe688eee9bb867ac9","versionType":"git"},{"status":"affected","version":"84026f8c9357c62a9d3e4c554ffd10ccab813654","versionType":"git"},{"lessThan":"5.16","status":"affected","version":"5.15.42","versionType":"semver"},{"lessThan":"5.18","status":"affected","version":"5.17.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nvme/target/admin-cmd.c","drivers/nvme/target/core.c","drivers/nvme/target/nvmet.h","drivers/nvme/target/rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"752141E3-2E88-4CDB-962E-FE1DFC022596","versionEndExcluding":"5.16","versionStartIncluding":"5.15.42","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E648BBD2-268B-4150-94DA-5E0D23BF336E","versionEndExcluding":"5.18","versionStartIncluding":"5.17.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"67222101-CC02-4250-A6E8-A98BDD29DB6F","versionEndExcluding":"6.12.80","versionStartIncluding":"5.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:*","matchCriteriaId":"0384FA0A-DE99-48D7-84E3-46ED0C3B5E03","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: move async event work off nvmet-wq\n\nFor target nvmet_ctrl_free() flushes ctrl->async_event_work.\nIf nvmet_ctrl_free() runs on nvmet-wq, the flush re-enters workqueue\ncompletion for the same worker:-\n\nA. Async event work queued on nvmet-wq (prior to disconnect):\n nvmet_execute_async_event()\n queue_work(nvmet_wq, &ctrl->async_event_work)\n\n nvmet_add_async_event()\n queue_work(nvmet_wq, &ctrl->async_event_work)\n\nB. Full pre-work chain (RDMA CM path):\n nvmet_rdma_cm_handler()\n nvmet_rdma_queue_disconnect()\n __nvmet_rdma_queue_disconnect()\n queue_work(nvmet_wq, &queue->release_work)\n process_one_work()\n lock((wq_completion)nvmet-wq) <--------- 1st\n nvmet_rdma_release_queue_work()\n\nC. Recursive path (same worker):\n nvmet_rdma_release_queue_work()\n nvmet_rdma_free_queue()\n nvmet_sq_destroy()\n nvmet_ctrl_put()\n nvmet_ctrl_free()\n flush_work(&ctrl->async_event_work)\n __flush_work()\n touch_wq_lockdep_map()\n lock((wq_completion)nvmet-wq) <--------- 2nd\n\nLockdep splat:\n\n ============================================\n WARNING: possible recursive locking detected\n 6.19.0-rc3nvme+ #14 Tainted: G N\n --------------------------------------------\n kworker/u192:42/44933 is trying to acquire lock:\n ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26/0x90\n\n but task is already holding lock:\n ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n\n 3 locks held by kworker/u192:42/44933:\n #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x53e/0x660\n #1: ffffc9000e6cbe28 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5/0x660\n #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, at: __flush_work+0x62/0x530\n\n Workqueue: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma]\n Call Trace:\n __flush_work+0x268/0x530\n nvmet_ctrl_free+0x140/0x310 [nvmet]\n nvmet_cq_put+0x74/0x90 [nvmet]\n nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma]\n nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma]\n process_one_work+0x206/0x660\n worker_thread+0x184/0x320\n kthread+0x10c/0x240\n ret_from_fork+0x319/0x390\n\nMove async event work to a dedicated nvmet-aen-wq to avoid reentrant\nflush on nvmet-wq."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: nvmet: mover el trabajo de eventos asíncronos fuera de nvmet-wq Para el objetivo, nvmet_ctrl_free() vacía ctrl -> async_event_work.\nSi nvmet_ctrl_free() se ejecuta en nvmet-wq, el vaciado vuelve a entrar en la finalización de la cola de trabajo para el mismo trabajador:- A. Trabajo de eventos asíncronos en cola en nvmet-wq (antes de la desconexión): nvmet_execute_async_event() queue_work(nvmet_wq, ref:ctrl -> async_event_work) nvmet_add_async_event() queue_work(nvmet_wq, ref:ctrl -> async_event_work) B. Cadena completa de pre-trabajo (ruta RDMA CM): nvmet_rdma_cm_handler() nvmet_rdma_queue_disconnect() __nvmet_rdma_queue_disconnect() queue_work(nvmet_wq, ref:queue -> release_work) process_one_work() lock((wq_completion)nvmet-wq) <- - - - - - - - - 1ª nvmet_rdma_release_queue_work() C. Ruta recursiva (mismo trabajador): nvmet_rdma_release_queue_work() nvmet_rdma_free_queue() nvmet_sq_destroy() nvmet_ctrl_put() nvmet_ctrl_free() flush_work(ref:ctrl -> async_event_work) __flush_work() touch_wq_lockdep_map() lock((wq_completion)nvmet-wq) <- - - - - - - - - 2ª Error de Lockdep: ============================================ ADVERTENCIA: posible bloqueo recursivo detectado 6.19.0-rc3nvme+ #14 Tainted: G N - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - kworker/u192:42/44933 está intentando adquirir el bloqueo: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, en: touch_wq_lockdep_map+0x26/0x90 pero la tarea ya tiene el bloqueo: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, en: process_one_work+0x53e/0x660 3 bloqueos mantenidos por kworker/u192:42/44933: #0: ffff888118a00948 ((wq_completion)nvmet-wq){+.+.}-{0:0}, en: process_one_work+0x53e/0x660 #1: ffffc9000e6cbe28 ((work_completion)(ref:queue -> release_work)){+.+.}-{0:0}, en: process_one_work+0x1c5/0x660 #2: ffffffff82d4db60 (rcu_read_lock){....}-{1:3}, en: __flush_work+0x62/0x530 Cola de trabajo: nvmet-wq nvmet_rdma_release_queue_work [nvmet_rdma] Traza de llamada: __flush_work+0x268/0x530 nvmet_ctrl_free+0x140/0x310 [nvmet] nvmet_cq_put+0x74/0x90 [nvmet] nvmet_rdma_free_queue+0x23/0xe0 [nvmet_rdma] nvmet_rdma_release_queue_work+0x19/0x50 [nvmet_rdma] process_one_work+0x206/0x660 worker_thread+0x184/0x320 kthread+0x10c/0x240 ret_from_fork+0x319/0x390 Mover el trabajo de eventos asíncronos a una nvmet-aen-wq dedicada para evitar el vaciado reentrante en nvmet-wq."}],"id":"CVE-2026-31557","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31557","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:53.279331Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:30.080","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25ceffc1dabec3b93f458b437aae26f4da293f87"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2922e3507f6d5caa7f1d07f145e186fc6f317a4e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/49c7c50ee6325a084216e94395e067ecde8088fa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a8a3fb2888e2c4fd5410a19ac1623cc78a2383ec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca111c9d8d6c9d5735878d933a1716c4be86c2d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ede147a85d1d4c075d13ba190453d6b09ecbea37"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-667"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31558.json b/data/2026/CVE-2026-31558.json index 9b58fb77d7..25178e18c5 100644 --- a/data/2026/CVE-2026-31558.json +++ b/data/2026/CVE-2026-31558.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/loongarch/kvm/vcpu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"596c3f8069c4792f22fce8c4452f44410032d910","status":"affected","version":"73516e9da512adc63ba3859fbd82a21f6257348f","versionType":"git"},{"lessThan":"878cf6acb4fd8ab4126cf9d369a5bb0e23123418","status":"affected","version":"73516e9da512adc63ba3859fbd82a21f6257348f","versionType":"git"},{"lessThan":"47857b05bd50db01e211a1b6f513d57901cd3e6b","status":"affected","version":"73516e9da512adc63ba3859fbd82a21f6257348f","versionType":"git"},{"lessThan":"2db06c15d8c7a0ccb6108524e16cd9163753f354","status":"affected","version":"73516e9da512adc63ba3859fbd82a21f6257348f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/loongarch/kvm/vcpu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CD80DE3B-1F52-4735-A373-3F3F2440FA5D","versionEndExcluding":"6.12.80","versionStartIncluding":"6.10.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.10:-:*:*:*:*:*:*","matchCriteriaId":"9EA80796-744E-45F5-8632-2AB4F7889FCD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust\n\nkvm_get_vcpu_by_cpuid() takes a cpuid parameter whose type is int, so\ncpuid can be negative. Let kvm_get_vcpu_by_cpuid() return NULL for this\ncase so as to make it more robust.\n\nThis fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[]."}],"id":"CVE-2026-31558","lastModified":"2026-06-17T10:33:58.553","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:30.200","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2db06c15d8c7a0ccb6108524e16cd9163753f354"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/47857b05bd50db01e211a1b6f513d57901cd3e6b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/596c3f8069c4792f22fce8c4452f44410032d910"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/878cf6acb4fd8ab4126cf9d369a5bb0e23123418"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/loongarch/kvm/vcpu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"596c3f8069c4792f22fce8c4452f44410032d910","status":"affected","version":"73516e9da512adc63ba3859fbd82a21f6257348f","versionType":"git"},{"lessThan":"878cf6acb4fd8ab4126cf9d369a5bb0e23123418","status":"affected","version":"73516e9da512adc63ba3859fbd82a21f6257348f","versionType":"git"},{"lessThan":"47857b05bd50db01e211a1b6f513d57901cd3e6b","status":"affected","version":"73516e9da512adc63ba3859fbd82a21f6257348f","versionType":"git"},{"lessThan":"2db06c15d8c7a0ccb6108524e16cd9163753f354","status":"affected","version":"73516e9da512adc63ba3859fbd82a21f6257348f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/loongarch/kvm/vcpu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CD80DE3B-1F52-4735-A373-3F3F2440FA5D","versionEndExcluding":"6.12.80","versionStartIncluding":"6.10.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.10:-:*:*:*:*:*:*","matchCriteriaId":"9EA80796-744E-45F5-8632-2AB4F7889FCD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust\n\nkvm_get_vcpu_by_cpuid() takes a cpuid parameter whose type is int, so\ncpuid can be negative. Let kvm_get_vcpu_by_cpuid() return NULL for this\ncase so as to make it more robust.\n\nThis fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[]."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nLoongArch: KVM: Hacer kvm_get_vcpu_by_cpuid() más robusta\n\nkvm_get_vcpu_by_cpuid() toma un parámetro cpuid cuyo tipo es int, por lo que cpuid puede ser negativo. Permitir que kvm_get_vcpu_by_cpuid() devuelva NULL para este caso para hacerla más robusta.\n\nEsto corrige un acceso fuera de límites a kvm_arch::phyid_map::phys_map[]."}],"id":"CVE-2026-31558","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:30.200","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2db06c15d8c7a0ccb6108524e16cd9163753f354"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/47857b05bd50db01e211a1b6f513d57901cd3e6b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/596c3f8069c4792f22fce8c4452f44410032d910"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/878cf6acb4fd8ab4126cf9d369a5bb0e23123418"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31559.json b/data/2026/CVE-2026-31559.json index af1e200555..6e5f3d396c 100644 --- a/data/2026/CVE-2026-31559.json +++ b/data/2026/CVE-2026-31559.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/loongarch/kernel/env.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5e7fde2c551f86e6c3de3fd7a9b1f52806ac8db0","status":"affected","version":"facc69f43502c135c16b97d5ded7253f15597912","versionType":"git"},{"lessThan":"a1da957c25cf751a2dce8fb7777f82ccbac0cb3e","status":"affected","version":"70a2365e18affc5ebdaab1ca6a0b3c4f3aac2ee8","versionType":"git"},{"lessThan":"b61a309743322fb57fb9afa9aa3495ac758e4f5e","status":"affected","version":"70a2365e18affc5ebdaab1ca6a0b3c4f3aac2ee8","versionType":"git"},{"lessThan":"3a28daa9b7d7c2ddf2c722e9e95d7e0928bf0cd1","status":"affected","version":"70a2365e18affc5ebdaab1ca6a0b3c4f3aac2ee8","versionType":"git"},{"status":"affected","version":"620805dc674eab3055543496a7ef25beb9ffd2a8","versionType":"git"},{"status":"affected","version":"8dfeedf9eceadc1a2fc9066b4c5230690d1cad48","versionType":"git"},{"lessThan":"6.12.80","status":"affected","version":"6.12.43","versionType":"semver"},{"lessThan":"6.16","status":"affected","version":"6.15.11","versionType":"semver"},{"lessThan":"6.17","status":"affected","version":"6.16.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/loongarch/kernel/env.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F7CE6A43-928A-4E74-83AF-3208B2BE7109","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.43","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"53FE35DC-2528-48D7-A855-1127CA02EE4D","versionEndExcluding":"6.16","versionStartIncluding":"6.15.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B868A3A9-BFE7-42B2-BEFD-D2CCDCB3827F","versionEndExcluding":"6.17","versionStartIncluding":"6.16.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"44CB3599-9974-4F35-B3CC-580CAC6FA38B","versionEndExcluding":"6.18.21","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Fix missing NULL checks for kstrdup()\n\n1. Replace \"of_find_node_by_path(\"/\")\" with \"of_root\" to avoid multiple\ncalls to \"of_node_put()\".\n\n2. Fix a potential kernel oops during early boot when memory allocation\nfails while parsing CPU model from device tree."}],"id":"CVE-2026-31559","lastModified":"2026-06-17T10:33:58.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:30.300","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a28daa9b7d7c2ddf2c722e9e95d7e0928bf0cd1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e7fde2c551f86e6c3de3fd7a9b1f52806ac8db0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a1da957c25cf751a2dce8fb7777f82ccbac0cb3e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b61a309743322fb57fb9afa9aa3495ac758e4f5e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/loongarch/kernel/env.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5e7fde2c551f86e6c3de3fd7a9b1f52806ac8db0","status":"affected","version":"facc69f43502c135c16b97d5ded7253f15597912","versionType":"git"},{"lessThan":"a1da957c25cf751a2dce8fb7777f82ccbac0cb3e","status":"affected","version":"70a2365e18affc5ebdaab1ca6a0b3c4f3aac2ee8","versionType":"git"},{"lessThan":"b61a309743322fb57fb9afa9aa3495ac758e4f5e","status":"affected","version":"70a2365e18affc5ebdaab1ca6a0b3c4f3aac2ee8","versionType":"git"},{"lessThan":"3a28daa9b7d7c2ddf2c722e9e95d7e0928bf0cd1","status":"affected","version":"70a2365e18affc5ebdaab1ca6a0b3c4f3aac2ee8","versionType":"git"},{"status":"affected","version":"620805dc674eab3055543496a7ef25beb9ffd2a8","versionType":"git"},{"status":"affected","version":"8dfeedf9eceadc1a2fc9066b4c5230690d1cad48","versionType":"git"},{"lessThan":"6.12.80","status":"affected","version":"6.12.43","versionType":"semver"},{"lessThan":"6.16","status":"affected","version":"6.15.11","versionType":"semver"},{"lessThan":"6.17","status":"affected","version":"6.16.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/loongarch/kernel/env.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F7CE6A43-928A-4E74-83AF-3208B2BE7109","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.43","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"53FE35DC-2528-48D7-A855-1127CA02EE4D","versionEndExcluding":"6.16","versionStartIncluding":"6.15.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B868A3A9-BFE7-42B2-BEFD-D2CCDCB3827F","versionEndExcluding":"6.17","versionStartIncluding":"6.16.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"44CB3599-9974-4F35-B3CC-580CAC6FA38B","versionEndExcluding":"6.18.21","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Fix missing NULL checks for kstrdup()\n\n1. Replace \"of_find_node_by_path(\"/\")\" with \"of_root\" to avoid multiple\ncalls to \"of_node_put()\".\n\n2. Fix a potential kernel oops during early boot when memory allocation\nfails while parsing CPU model from device tree."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nLoongArch: Corrige la falta de comprobaciones de NULL para kstrdup()\n\n1. Reemplaza ’of_find_node_by_path(“/”)’ con ’of_root’ para evitar múltiples llamadas a ’of_node_put()’.\n\n2. Corrige un posible ’kernel oops’ durante el arranque temprano cuando falla la asignación de memoria al analizar el modelo de CPU del árbol de dispositivos."}],"id":"CVE-2026-31559","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:30.300","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a28daa9b7d7c2ddf2c722e9e95d7e0928bf0cd1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e7fde2c551f86e6c3de3fd7a9b1f52806ac8db0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a1da957c25cf751a2dce8fb7777f82ccbac0cb3e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b61a309743322fb57fb9afa9aa3495ac758e4f5e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31560.json b/data/2026/CVE-2026-31560.json index cc06487b17..d10b615fe4 100644 --- a/data/2026/CVE-2026-31560.json +++ b/data/2026/CVE-2026-31560.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/spi/spi-dw-dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3709357c1a7b7a422b0cbc2748f187acf612cd94","status":"affected","version":"bdbdf0f06337d3661b64c0288c291cb06624065e","versionType":"git"},{"lessThan":"bac13309339b6f1ac02e6e53ebc75cf61483c396","status":"affected","version":"bdbdf0f06337d3661b64c0288c291cb06624065e","versionType":"git"},{"lessThan":"b8188ff3cfaa5621212b08473488cdbe41f86531","status":"affected","version":"bdbdf0f06337d3661b64c0288c291cb06624065e","versionType":"git"},{"lessThan":"aae4a47073b12c23eb1d2c5401bda442fbe27bd1","status":"affected","version":"bdbdf0f06337d3661b64c0288c291cb06624065e","versionType":"git"},{"lessThan":"184f5aaf72f1f1c73e66bae0b8d28e81c2f2a72f","status":"affected","version":"bdbdf0f06337d3661b64c0288c291cb06624065e","versionType":"git"},{"lessThan":"3b46d61890632c8f8b117147b6923bff4b42ccb7","status":"affected","version":"bdbdf0f06337d3661b64c0288c291cb06624065e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/spi/spi-dw-dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.92","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE5C168D-744C-4BAC-8555-6A27E3391430","versionEndExcluding":"6.19.11","versionStartIncluding":"5.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:-:*:*:*:*:*:*","matchCriteriaId":"0E2DC66F-4A95-475F-B8B6-191DEC1E7EF6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-dw-dma: fix print error log when wait finish transaction\n\nIf an error occurs, the device may not have a current message. In this\ncase, the system will crash.\n\nIn this case, it's better to use dev from the struct ctlr (struct spi_controller*)."}],"id":"CVE-2026-31560","lastModified":"2026-10-30T13:18:41.000","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:30.403","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/184f5aaf72f1f1c73e66bae0b8d28e81c2f2a72f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3709357c1a7b7a422b0cbc2748f187acf612cd94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b46d61890632c8f8b117147b6923bff4b42ccb7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/aae4a47073b12c23eb1d2c5401bda442fbe27bd1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b8188ff3cfaa5621212b08473488cdbe41f86531"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bac13309339b6f1ac02e6e53ebc75cf61483c396"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/spi/spi-dw-dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3709357c1a7b7a422b0cbc2748f187acf612cd94","status":"affected","version":"bdbdf0f06337d3661b64c0288c291cb06624065e","versionType":"git"},{"lessThan":"bac13309339b6f1ac02e6e53ebc75cf61483c396","status":"affected","version":"bdbdf0f06337d3661b64c0288c291cb06624065e","versionType":"git"},{"lessThan":"b8188ff3cfaa5621212b08473488cdbe41f86531","status":"affected","version":"bdbdf0f06337d3661b64c0288c291cb06624065e","versionType":"git"},{"lessThan":"aae4a47073b12c23eb1d2c5401bda442fbe27bd1","status":"affected","version":"bdbdf0f06337d3661b64c0288c291cb06624065e","versionType":"git"},{"lessThan":"184f5aaf72f1f1c73e66bae0b8d28e81c2f2a72f","status":"affected","version":"bdbdf0f06337d3661b64c0288c291cb06624065e","versionType":"git"},{"lessThan":"3b46d61890632c8f8b117147b6923bff4b42ccb7","status":"affected","version":"bdbdf0f06337d3661b64c0288c291cb06624065e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/spi/spi-dw-dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.92","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE5C168D-744C-4BAC-8555-6A27E3391430","versionEndExcluding":"6.19.11","versionStartIncluding":"5.8.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.8:-:*:*:*:*:*:*","matchCriteriaId":"0E2DC66F-4A95-475F-B8B6-191DEC1E7EF6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-dw-dma: fix print error log when wait finish transaction\n\nIf an error occurs, the device may not have a current message. In this\ncase, the system will crash.\n\nIn this case, it's better to use dev from the struct ctlr (struct spi_controller*)."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nspi: spi-dw-dma: corregir el registro de errores de impresión al esperar que finalice la transacción\n\nSi ocurre un error, el dispositivo podría no tener un mensaje actual. En este\ncaso, el sistema se bloqueará.\n\nEn este caso, es mejor usar dev de la struct ctlr (struct spi_controller)."}],"id":"CVE-2026-31560","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:30.403","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/184f5aaf72f1f1c73e66bae0b8d28e81c2f2a72f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3709357c1a7b7a422b0cbc2748f187acf612cd94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b46d61890632c8f8b117147b6923bff4b42ccb7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/aae4a47073b12c23eb1d2c5401bda442fbe27bd1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b8188ff3cfaa5621212b08473488cdbe41f86531"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bac13309339b6f1ac02e6e53ebc75cf61483c396"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31561.json b/data/2026/CVE-2026-31561.json index 6022031ba3..2c170cffd6 100644 --- a/data/2026/CVE-2026-31561.json +++ b/data/2026/CVE-2026-31561.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kernel/cpu/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d7853d9fe94abf43b46c57b0b7f8418198b7615a","status":"affected","version":"ff45746fbf005f96e42bea466698e3fdbf926013","versionType":"git"},{"lessThan":"a6e14114684d2324e5401617d6d01acb4a4e0e22","status":"affected","version":"ff45746fbf005f96e42bea466698e3fdbf926013","versionType":"git"},{"lessThan":"00d956dafa76f86a73424fe5cce3d604a8be2e4b","status":"affected","version":"ff45746fbf005f96e42bea466698e3fdbf926013","versionType":"git"},{"lessThan":"411df123c017169922cc767affce76282b8e6c85","status":"affected","version":"ff45746fbf005f96e42bea466698e3fdbf926013","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kernel/cpu/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AC9469D5-3400-4C2C-A51B-AF83A8E8F623","versionEndExcluding":"6.12.80","versionStartIncluding":"6.9.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*","matchCriteriaId":"3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask\n\nCommit in Fixes added the FRED CR4 bit to the CR4 pinned bits mask so\nthat whenever something else modifies CR4, that bit remains set. Which\nin itself is a perfectly fine idea.\n\nHowever, there's an issue when during boot FRED is initialized: first on\nthe BSP and later on the APs. Thus, there's a window in time when\nexceptions cannot be handled.\n\nThis becomes particularly nasty when running as SEV-{ES,SNP} or TDX\nguests which, when they manage to trigger exceptions during that short\nwindow described above, triple fault due to FRED MSRs not being set up\nyet.\n\nSee Link tag below for a much more detailed explanation of the\nsituation.\n\nSo, as a result, the commit in that Link URL tried to address this\nshortcoming by temporarily disabling CR4 pinning when an AP is not\nonline yet.\n\nHowever, that is a problem in itself because in this case, an attack on\nthe kernel needs to only modify the online bit - a single bit in RW\nmemory - and then disable CR4 pinning and then disable SM*P, leading to\nmore and worse things to happen to the system.\n\nSo, instead, remove the FRED bit from the CR4 pinning mask, thus\nobviating the need to temporarily disable CR4 pinning.\n\nIf someone manages to disable FRED when poking at CR4, then\nidt_invalidate() would make sure the system would crash'n'burn on the\nfirst exception triggered, which is a much better outcome security-wise."}],"id":"CVE-2026-31561","lastModified":"2026-06-17T10:33:58.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:30.500","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/00d956dafa76f86a73424fe5cce3d604a8be2e4b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/411df123c017169922cc767affce76282b8e6c85"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6e14114684d2324e5401617d6d01acb4a4e0e22"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d7853d9fe94abf43b46c57b0b7f8418198b7615a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kernel/cpu/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d7853d9fe94abf43b46c57b0b7f8418198b7615a","status":"affected","version":"ff45746fbf005f96e42bea466698e3fdbf926013","versionType":"git"},{"lessThan":"a6e14114684d2324e5401617d6d01acb4a4e0e22","status":"affected","version":"ff45746fbf005f96e42bea466698e3fdbf926013","versionType":"git"},{"lessThan":"00d956dafa76f86a73424fe5cce3d604a8be2e4b","status":"affected","version":"ff45746fbf005f96e42bea466698e3fdbf926013","versionType":"git"},{"lessThan":"411df123c017169922cc767affce76282b8e6c85","status":"affected","version":"ff45746fbf005f96e42bea466698e3fdbf926013","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kernel/cpu/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AC9469D5-3400-4C2C-A51B-AF83A8E8F623","versionEndExcluding":"6.12.80","versionStartIncluding":"6.9.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*","matchCriteriaId":"3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask\n\nCommit in Fixes added the FRED CR4 bit to the CR4 pinned bits mask so\nthat whenever something else modifies CR4, that bit remains set. Which\nin itself is a perfectly fine idea.\n\nHowever, there's an issue when during boot FRED is initialized: first on\nthe BSP and later on the APs. Thus, there's a window in time when\nexceptions cannot be handled.\n\nThis becomes particularly nasty when running as SEV-{ES,SNP} or TDX\nguests which, when they manage to trigger exceptions during that short\nwindow described above, triple fault due to FRED MSRs not being set up\nyet.\n\nSee Link tag below for a much more detailed explanation of the\nsituation.\n\nSo, as a result, the commit in that Link URL tried to address this\nshortcoming by temporarily disabling CR4 pinning when an AP is not\nonline yet.\n\nHowever, that is a problem in itself because in this case, an attack on\nthe kernel needs to only modify the online bit - a single bit in RW\nmemory - and then disable CR4 pinning and then disable SM*P, leading to\nmore and worse things to happen to the system.\n\nSo, instead, remove the FRED bit from the CR4 pinning mask, thus\nobviating the need to temporarily disable CR4 pinning.\n\nIf someone manages to disable FRED when poking at CR4, then\nidt_invalidate() would make sure the system would crash'n'burn on the\nfirst exception triggered, which is a much better outcome security-wise."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nx86/cpu: Eliminar X86_CR4_FRED de la máscara de bits fijados de CR4\n\nEl commit en Fixes añadió el bit FRED CR4 a la máscara de bits fijados de CR4 para que cada vez que algo más modifique CR4, ese bit permanezca establecido. Lo cual en sí mismo es una idea perfectamente válida.\n\nSin embargo, hay un problema cuando durante el arranque FRED es inicializado: primero en el BSP y luego en los APs. Así, hay una ventana de tiempo cuando las excepciones no pueden ser manejadas.\n\nEsto se vuelve particularmente desagradable cuando se ejecuta como invitados SEV-{ES,SNP} o TDX los cuales, cuando logran disparar excepciones durante esa corta ventana descrita anteriormente, causan una triple falla debido a que los MSR de FRED aún no están configurados.\n\nVer la etiqueta Link a continuación para una explicación mucho más detallada de la situación.\n\nAsí, como resultado, el commit en esa URL de Link intentó abordar esta deficiencia deshabilitando temporalmente el fijado de CR4 cuando un AP aún no está en línea.\n\nSin embargo, eso es un problema en sí mismo porque en este caso, un ataque al kernel solo necesita modificar el bit en línea - un solo bit en memoria RW - y luego deshabilitar el fijado de CR4 y luego deshabilitar SMP, lo que lleva a que ocurran cosas más y peores en el sistema.\n\nAsí que, en su lugar, eliminar el bit FRED de la máscara de fijado de CR4, obviando así la necesidad de deshabilitar temporalmente el fijado de CR4.\n\nSi alguien logra deshabilitar FRED al manipular CR4, entonces idt_invalidate() se aseguraría de que el sistema se bloqueara y fallara con la primera excepción disparada, lo cual es un resultado mucho mejor en términos de seguridad."}],"id":"CVE-2026-31561","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:30.500","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/00d956dafa76f86a73424fe5cce3d604a8be2e4b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/411df123c017169922cc767affce76282b8e6c85"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6e14114684d2324e5401617d6d01acb4a4e0e22"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d7853d9fe94abf43b46c57b0b7f8418198b7615a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31562.json b/data/2026/CVE-2026-31562.json index c49f9553ed..6d861bbe83 100644 --- a/data/2026/CVE-2026-31562.json +++ b/data/2026/CVE-2026-31562.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/mediatek/mtk_dsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"57b4864ca02f76d7debe8ce14c912335aef16055","status":"affected","version":"e4732b590a77318dff134612b013d66d2448ab20","versionType":"git"},{"lessThan":"9a709b7e36324dfc1e6728eb81405470b7ae84e5","status":"affected","version":"e4732b590a77318dff134612b013d66d2448ab20","versionType":"git"},{"lessThan":"df03f5ac1eae7c5a2c01846e3e64dfc2870eec6b","status":"affected","version":"e4732b590a77318dff134612b013d66d2448ab20","versionType":"git"},{"lessThan":"4cfdfeb6ac06079f92fccd977fa742d6c5b8dd3a","status":"affected","version":"e4732b590a77318dff134612b013d66d2448ab20","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/mediatek/mtk_dsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"043434D3-69EE-45A7-BD27-488276523C5E","versionEndExcluding":"6.18.21","versionStartIncluding":"6.9.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*","matchCriteriaId":"3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register\n\nThe call to mipi_dsi_host_register triggers a callback to mtk_dsi_bind,\nwhich uses dev_get_drvdata to retrieve the mtk_dsi struct, so this\nstructure needs to be stored inside the driver data before invoking it.\n\nAs drvdata is currently uninitialized it leads to a crash when\nregistering the DSI DRM encoder right after acquiring\nthe mode_config.idr_mutex, blocking all subsequent DRM operations.\n\nFixes the following crash during mediatek-drm probe (tested on Xiaomi\nSmart Clock x04g):\n\nUnable to handle kernel NULL pointer dereference at virtual address\n 0000000000000040\n[...]\nModules linked in: mediatek_drm(+) drm_display_helper cec drm_client_lib\n drm_dma_helper drm_kms_helper panel_simple\n[...]\nCall trace:\n drm_mode_object_add+0x58/0x98 (P)\n __drm_encoder_init+0x48/0x140\n drm_encoder_init+0x6c/0xa0\n drm_simple_encoder_init+0x20/0x34 [drm_kms_helper]\n mtk_dsi_bind+0x34/0x13c [mediatek_drm]\n component_bind_all+0x120/0x280\n mtk_drm_bind+0x284/0x67c [mediatek_drm]\n try_to_bring_up_aggregate_device+0x23c/0x320\n __component_add+0xa4/0x198\n component_add+0x14/0x20\n mtk_dsi_host_attach+0x78/0x100 [mediatek_drm]\n mipi_dsi_attach+0x2c/0x50\n panel_simple_dsi_probe+0x4c/0x9c [panel_simple]\n mipi_dsi_drv_probe+0x1c/0x28\n really_probe+0xc0/0x3dc\n __driver_probe_device+0x80/0x160\n driver_probe_device+0x40/0x120\n __device_attach_driver+0xbc/0x17c\n bus_for_each_drv+0x88/0xf0\n __device_attach+0x9c/0x1cc\n device_initial_probe+0x54/0x60\n bus_probe_device+0x34/0xa0\n device_add+0x5b0/0x800\n mipi_dsi_device_register_full+0xdc/0x16c\n mipi_dsi_host_register+0xc4/0x17c\n mtk_dsi_probe+0x10c/0x260 [mediatek_drm]\n platform_probe+0x5c/0xa4\n really_probe+0xc0/0x3dc\n __driver_probe_device+0x80/0x160\n driver_probe_device+0x40/0x120\n __driver_attach+0xc8/0x1f8\n bus_for_each_dev+0x7c/0xe0\n driver_attach+0x24/0x30\n bus_add_driver+0x11c/0x240\n driver_register+0x68/0x130\n __platform_register_drivers+0x64/0x160\n mtk_drm_init+0x24/0x1000 [mediatek_drm]\n do_one_initcall+0x60/0x1d0\n do_init_module+0x54/0x240\n load_module+0x1838/0x1dc0\n init_module_from_file+0xd8/0xf0\n __arm64_sys_finit_module+0x1b4/0x428\n invoke_syscall.constprop.0+0x48/0xc8\n do_el0_svc+0x3c/0xb8\n el0_svc+0x34/0xe8\n el0t_64_sync_handler+0xa0/0xe4\n el0t_64_sync+0x198/0x19c\nCode: 52800022 941004ab 2a0003f3 37f80040 (29005a80)"}],"id":"CVE-2026-31562","lastModified":"2026-10-21T13:18:39.607","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:30.610","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cfdfeb6ac06079f92fccd977fa742d6c5b8dd3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/57b4864ca02f76d7debe8ce14c912335aef16055"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a709b7e36324dfc1e6728eb81405470b7ae84e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df03f5ac1eae7c5a2c01846e3e64dfc2870eec6b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/mediatek/mtk_dsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"57b4864ca02f76d7debe8ce14c912335aef16055","status":"affected","version":"e4732b590a77318dff134612b013d66d2448ab20","versionType":"git"},{"lessThan":"9a709b7e36324dfc1e6728eb81405470b7ae84e5","status":"affected","version":"e4732b590a77318dff134612b013d66d2448ab20","versionType":"git"},{"lessThan":"df03f5ac1eae7c5a2c01846e3e64dfc2870eec6b","status":"affected","version":"e4732b590a77318dff134612b013d66d2448ab20","versionType":"git"},{"lessThan":"4cfdfeb6ac06079f92fccd977fa742d6c5b8dd3a","status":"affected","version":"e4732b590a77318dff134612b013d66d2448ab20","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/mediatek/mtk_dsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"043434D3-69EE-45A7-BD27-488276523C5E","versionEndExcluding":"6.18.21","versionStartIncluding":"6.9.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*","matchCriteriaId":"3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register\n\nThe call to mipi_dsi_host_register triggers a callback to mtk_dsi_bind,\nwhich uses dev_get_drvdata to retrieve the mtk_dsi struct, so this\nstructure needs to be stored inside the driver data before invoking it.\n\nAs drvdata is currently uninitialized it leads to a crash when\nregistering the DSI DRM encoder right after acquiring\nthe mode_config.idr_mutex, blocking all subsequent DRM operations.\n\nFixes the following crash during mediatek-drm probe (tested on Xiaomi\nSmart Clock x04g):\n\nUnable to handle kernel NULL pointer dereference at virtual address\n 0000000000000040\n[...]\nModules linked in: mediatek_drm(+) drm_display_helper cec drm_client_lib\n drm_dma_helper drm_kms_helper panel_simple\n[...]\nCall trace:\n drm_mode_object_add+0x58/0x98 (P)\n __drm_encoder_init+0x48/0x140\n drm_encoder_init+0x6c/0xa0\n drm_simple_encoder_init+0x20/0x34 [drm_kms_helper]\n mtk_dsi_bind+0x34/0x13c [mediatek_drm]\n component_bind_all+0x120/0x280\n mtk_drm_bind+0x284/0x67c [mediatek_drm]\n try_to_bring_up_aggregate_device+0x23c/0x320\n __component_add+0xa4/0x198\n component_add+0x14/0x20\n mtk_dsi_host_attach+0x78/0x100 [mediatek_drm]\n mipi_dsi_attach+0x2c/0x50\n panel_simple_dsi_probe+0x4c/0x9c [panel_simple]\n mipi_dsi_drv_probe+0x1c/0x28\n really_probe+0xc0/0x3dc\n __driver_probe_device+0x80/0x160\n driver_probe_device+0x40/0x120\n __device_attach_driver+0xbc/0x17c\n bus_for_each_drv+0x88/0xf0\n __device_attach+0x9c/0x1cc\n device_initial_probe+0x54/0x60\n bus_probe_device+0x34/0xa0\n device_add+0x5b0/0x800\n mipi_dsi_device_register_full+0xdc/0x16c\n mipi_dsi_host_register+0xc4/0x17c\n mtk_dsi_probe+0x10c/0x260 [mediatek_drm]\n platform_probe+0x5c/0xa4\n really_probe+0xc0/0x3dc\n __driver_probe_device+0x80/0x160\n driver_probe_device+0x40/0x120\n __driver_attach+0xc8/0x1f8\n bus_for_each_dev+0x7c/0xe0\n driver_attach+0x24/0x30\n bus_add_driver+0x11c/0x240\n driver_register+0x68/0x130\n __platform_register_drivers+0x64/0x160\n mtk_drm_init+0x24/0x1000 [mediatek_drm]\n do_one_initcall+0x60/0x1d0\n do_init_module+0x54/0x240\n load_module+0x1838/0x1dc0\n init_module_from_file+0xd8/0xf0\n __arm64_sys_finit_module+0x1b4/0x428\n invoke_syscall.constprop.0+0x48/0xc8\n do_el0_svc+0x3c/0xb8\n el0_svc+0x34/0xe8\n el0t_64_sync_handler+0xa0/0xe4\n el0t_64_sync+0x198/0x19c\nCode: 52800022 941004ab 2a0003f3 37f80040 (29005a80)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/mediatek: dsi: Almacenar datos del controlador antes de invocar mipi_dsi_host_register\n\nLa llamada a mipi_dsi_host_register activa una devolución de llamada a mtk_dsi_bind, que utiliza dev_get_drvdata para recuperar la estructura mtk_dsi, por lo que esta estructura necesita ser almacenada dentro de los datos del controlador antes de invocarla.\n\nComo drvdata está actualmente sin inicializar, conduce a un fallo al registrar el codificador DSI DRM justo después de adquirir el mode_config.idr_mutex, bloqueando todas las operaciones DRM subsiguientes.\n\nCorrige el siguiente fallo durante la sonda de mediatek-drm (probado en Xiaomi Smart Clock x04g):\n\nIncapaz de manejar la desreferencia de puntero NULL del kernel en la dirección virtual\n 0000000000000040\n[...]\nMódulos enlazados: mediatek_drm(+) drm_display_helper cec drm_client_lib\n drm_dma_helper drm_kms_helper panel_simple\n[...]\nTraza de llamada:\n drm_mode_object_add+0x58/0x98 (P)\n __drm_encoder_init+0x48/0x140\n drm_encoder_init+0x6c/0xa0\n drm_simple_encoder_init+0x20/0x34 [drm_kms_helper]\n mtk_dsi_bind+0x34/0x13c [mediatek_drm]\n component_bind_all+0x120/0x280\n mtk_drm_bind+0x284/0x67c [mediatek_drm]\n try_to_bring_up_aggregate_device+0x23c/0x320\n __component_add+0xa4/0x198\n component_add+0x14/0x20\n mtk_dsi_host_attach+0x78/0x100 [mediatek_drm]\n mipi_dsi_attach+0x2c/0x50\n panel_simple_dsi_probe+0x4c/0x9c [panel_simple]\n mipi_dsi_drv_probe+0x1c/0x28\n really_probe+0xc0/0x3dc\n __driver_probe_device+0x80/0x160\n driver_probe_device+0x40/0x120\n __device_attach_driver+0xbc/0x17c\n bus_for_each_drv+0x88/0xf0\n __device_attach+0x9c/0x1cc\n device_initial_probe+0x54/0x60\n bus_probe_device+0x34/0xa0\n device_add+0x5b0/0x800\n mipi_dsi_device_register_full+0xdc/0x16c\n mipi_dsi_host_register+0xc4/0x17c\n mtk_dsi_probe+0x10c/0x260 [mediatek_drm]\n platform_probe+0x5c/0xa4\n really_probe+0xc0/0x3dc\n __driver_probe_device+0x80/0x160\n driver_probe_device+0x40/0x120\n __driver_attach+0xc8/0x1f8\n bus_for_each_dev+0x7c/0xe0\n driver_attach+0x24/0x30\n bus_add_driver+0x11c/0x240\n driver_register+0x68/0x130\n __platform_register_drivers+0x64/0x160\n mtk_drm_init+0x24/0x 1000 [mediatek_drm]\n do_one_initcall+0x60/0x1d0\n do_init_module+0x54/0x240\n load_module+0x 1838/0x 1dc0\n init_module_from_file+0xd8/0xf0\n __arm64_sys_finit_module+0x1b4/0x428\n invoke_syscall.constprop.0+0x48/0xc8\n do_el0_svc+0x3c/0xb8\n el0_svc+0x34/0xe8\n el0t_64_sync_handler+0xa0/0xe4\n el0t_64_sync+0x198/0x19c\nCódigo: 52800022 941004ab 2a0003f3 37f80040 (29005a80)"}],"id":"CVE-2026-31562","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:30.610","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cfdfeb6ac06079f92fccd977fa742d6c5b8dd3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/57b4864ca02f76d7debe8ce14c912335aef16055"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a709b7e36324dfc1e6728eb81405470b7ae84e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/df03f5ac1eae7c5a2c01846e3e64dfc2870eec6b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31563.json b/data/2026/CVE-2026-31563.json index c9fced765e..6444ec899a 100644 --- a/data/2026/CVE-2026-31563.json +++ b/data/2026/CVE-2026-31563.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"92e7081f0c79d9073087e54bab745bb184192c2e","status":"affected","version":"aeeafeb29b1b270302a9a85a13f7d70a68a3b9e6","versionType":"git"},{"lessThan":"78c8b090a3d5c1689dc989861b0163180db2b3f8","status":"affected","version":"5430388a81113e62a2d48b5d7dc1e76231908ebf","versionType":"git"},{"lessThan":"984350b37372f79f71d4f0a5264c640e40daf9ce","status":"affected","version":"7db8aa3fc4ed0a2928246747b2514b0741a8187e","versionType":"git"},{"lessThan":"f4bc91398b579730284328322365afa77a9d568f","status":"affected","version":"6bc8a5098bf4a365c4086a4a4130bfab10a58260","versionType":"git"},{"lessThan":"ca4d05afb4683d685bb2c6fccae4386c478f524a","status":"affected","version":"6bc8a5098bf4a365c4086a4a4130bfab10a58260","versionType":"git"},{"lessThan":"647b8a2fe474474704110db6bd07f7a139e621eb","status":"affected","version":"6bc8a5098bf4a365c4086a4a4130bfab10a58260","versionType":"git"},{"status":"affected","version":"a4cb0a15ab8e6d06c08229a2c7bdbe1f2454473f","versionType":"git"},{"lessThan":"6.1.168","status":"affected","version":"6.1.151","versionType":"semver"},{"lessThan":"6.6.131","status":"affected","version":"6.6.105","versionType":"semver"},{"lessThan":"6.12.80","status":"affected","version":"6.12.46","versionType":"semver"},{"lessThan":"6.17","status":"affected","version":"6.16.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6468B51A-D3CD-45F2-88B1-0D3D9E733B35","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.151","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AE86A654-AD51-494F-B566-F414BE18B4C5","versionEndExcluding":"6.6.131","versionStartIncluding":"6.6.105","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C4349E2C-F7A7-436A-ABF7-490B6A65F94F","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.46","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"92625292-0FEA-4DC5-932B-1EC5C57AED85","versionEndExcluding":"6.17","versionStartIncluding":"6.16.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"44CB3599-9974-4F35-B3CC-580CAC6FA38B","versionEndExcluding":"6.18.21","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: Use dev_consume_skb_any() to free TX SKBs\n\nThe napi_consume_skb() function is not intended to be called in an IRQ\ndisabled context. However, after commit 6bc8a5098bf4 (\"net: macb: Fix\ntx_ptr_lock locking\"), the freeing of TX SKBs is performed with IRQs\ndisabled. To resolve the following call trace, use dev_consume_skb_any()\nfor freeing TX SKBs:\n WARNING: kernel/softirq.c:430 at __local_bh_enable_ip+0x174/0x188, CPU#0: ksoftirqd/0/15\n Modules linked in:\n CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 7.0.0-rc4-next-20260319-yocto-standard-dirty #37 PREEMPT\n Hardware name: ZynqMP ZCU102 Rev1.1 (DT)\n pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __local_bh_enable_ip+0x174/0x188\n lr : local_bh_enable+0x24/0x38\n sp : ffff800082b3bb10\n x29: ffff800082b3bb10 x28: ffff0008031f3c00 x27: 000000000011ede0\n x26: ffff000800a7ff00 x25: ffff800083937ce8 x24: 0000000000017a80\n x23: ffff000803243a78 x22: 0000000000000040 x21: 0000000000000000\n x20: ffff000800394c80 x19: 0000000000000200 x18: 0000000000000001\n x17: 0000000000000001 x16: ffff000803240000 x15: 0000000000000000\n x14: ffffffffffffffff x13: 0000000000000028 x12: ffff000800395650\n x11: ffff8000821d1528 x10: ffff800081c2bc08 x9 : ffff800081c1e258\n x8 : 0000000100000301 x7 : ffff8000810426ec x6 : 0000000000000000\n x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000\n x2 : 0000000000000008 x1 : 0000000000000200 x0 : ffff8000810428dc\n Call trace:\n __local_bh_enable_ip+0x174/0x188 (P)\n local_bh_enable+0x24/0x38\n skb_attempt_defer_free+0x190/0x1d8\n napi_consume_skb+0x58/0x108\n macb_tx_poll+0x1a4/0x558\n __napi_poll+0x50/0x198\n net_rx_action+0x1f4/0x3d8\n handle_softirqs+0x16c/0x560\n run_ksoftirqd+0x44/0x80\n smpboot_thread_fn+0x1d8/0x338\n kthread+0x120/0x150\n ret_from_fork+0x10/0x20\n irq event stamp: 29751\n hardirqs last enabled at (29750): [] _raw_spin_unlock_irqrestore+0x44/0x88\n hardirqs last disabled at (29751): [] _raw_spin_lock_irqsave+0x38/0x98\n softirqs last enabled at (29150): [] handle_softirqs+0x504/0x560\n softirqs last disabled at (29153): [] run_ksoftirqd+0x44/0x80"}],"id":"CVE-2026-31563","lastModified":"2026-11-10T13:19:00.590","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:30.720","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/647b8a2fe474474704110db6bd07f7a139e621eb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/78c8b090a3d5c1689dc989861b0163180db2b3f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/92e7081f0c79d9073087e54bab745bb184192c2e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/984350b37372f79f71d4f0a5264c640e40daf9ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca4d05afb4683d685bb2c6fccae4386c478f524a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f4bc91398b579730284328322365afa77a9d568f"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"92e7081f0c79d9073087e54bab745bb184192c2e","status":"affected","version":"aeeafeb29b1b270302a9a85a13f7d70a68a3b9e6","versionType":"git"},{"lessThan":"78c8b090a3d5c1689dc989861b0163180db2b3f8","status":"affected","version":"5430388a81113e62a2d48b5d7dc1e76231908ebf","versionType":"git"},{"lessThan":"984350b37372f79f71d4f0a5264c640e40daf9ce","status":"affected","version":"7db8aa3fc4ed0a2928246747b2514b0741a8187e","versionType":"git"},{"lessThan":"f4bc91398b579730284328322365afa77a9d568f","status":"affected","version":"6bc8a5098bf4a365c4086a4a4130bfab10a58260","versionType":"git"},{"lessThan":"ca4d05afb4683d685bb2c6fccae4386c478f524a","status":"affected","version":"6bc8a5098bf4a365c4086a4a4130bfab10a58260","versionType":"git"},{"lessThan":"647b8a2fe474474704110db6bd07f7a139e621eb","status":"affected","version":"6bc8a5098bf4a365c4086a4a4130bfab10a58260","versionType":"git"},{"status":"affected","version":"a4cb0a15ab8e6d06c08229a2c7bdbe1f2454473f","versionType":"git"},{"lessThan":"6.1.168","status":"affected","version":"6.1.151","versionType":"semver"},{"lessThan":"6.6.131","status":"affected","version":"6.6.105","versionType":"semver"},{"lessThan":"6.12.80","status":"affected","version":"6.12.46","versionType":"semver"},{"lessThan":"6.17","status":"affected","version":"6.16.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/cadence/macb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6468B51A-D3CD-45F2-88B1-0D3D9E733B35","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.151","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AE86A654-AD51-494F-B566-F414BE18B4C5","versionEndExcluding":"6.6.131","versionStartIncluding":"6.6.105","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C4349E2C-F7A7-436A-ABF7-490B6A65F94F","versionEndExcluding":"6.12.80","versionStartIncluding":"6.12.46","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"92625292-0FEA-4DC5-932B-1EC5C57AED85","versionEndExcluding":"6.17","versionStartIncluding":"6.16.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"44CB3599-9974-4F35-B3CC-580CAC6FA38B","versionEndExcluding":"6.18.21","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: Use dev_consume_skb_any() to free TX SKBs\n\nThe napi_consume_skb() function is not intended to be called in an IRQ\ndisabled context. However, after commit 6bc8a5098bf4 (\"net: macb: Fix\ntx_ptr_lock locking\"), the freeing of TX SKBs is performed with IRQs\ndisabled. To resolve the following call trace, use dev_consume_skb_any()\nfor freeing TX SKBs:\n WARNING: kernel/softirq.c:430 at __local_bh_enable_ip+0x174/0x188, CPU#0: ksoftirqd/0/15\n Modules linked in:\n CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 7.0.0-rc4-next-20260319-yocto-standard-dirty #37 PREEMPT\n Hardware name: ZynqMP ZCU102 Rev1.1 (DT)\n pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n pc : __local_bh_enable_ip+0x174/0x188\n lr : local_bh_enable+0x24/0x38\n sp : ffff800082b3bb10\n x29: ffff800082b3bb10 x28: ffff0008031f3c00 x27: 000000000011ede0\n x26: ffff000800a7ff00 x25: ffff800083937ce8 x24: 0000000000017a80\n x23: ffff000803243a78 x22: 0000000000000040 x21: 0000000000000000\n x20: ffff000800394c80 x19: 0000000000000200 x18: 0000000000000001\n x17: 0000000000000001 x16: ffff000803240000 x15: 0000000000000000\n x14: ffffffffffffffff x13: 0000000000000028 x12: ffff000800395650\n x11: ffff8000821d1528 x10: ffff800081c2bc08 x9 : ffff800081c1e258\n x8 : 0000000100000301 x7 : ffff8000810426ec x6 : 0000000000000000\n x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000\n x2 : 0000000000000008 x1 : 0000000000000200 x0 : ffff8000810428dc\n Call trace:\n __local_bh_enable_ip+0x174/0x188 (P)\n local_bh_enable+0x24/0x38\n skb_attempt_defer_free+0x190/0x1d8\n napi_consume_skb+0x58/0x108\n macb_tx_poll+0x1a4/0x558\n __napi_poll+0x50/0x198\n net_rx_action+0x1f4/0x3d8\n handle_softirqs+0x16c/0x560\n run_ksoftirqd+0x44/0x80\n smpboot_thread_fn+0x1d8/0x338\n kthread+0x120/0x150\n ret_from_fork+0x10/0x20\n irq event stamp: 29751\n hardirqs last enabled at (29750): [] _raw_spin_unlock_irqrestore+0x44/0x88\n hardirqs last disabled at (29751): [] _raw_spin_lock_irqsave+0x38/0x98\n softirqs last enabled at (29150): [] handle_softirqs+0x504/0x560\n softirqs last disabled at (29153): [] run_ksoftirqd+0x44/0x80"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: macb: Usar dev_consume_skb_any() para liberar SKBs de TX\n\nLa función napi_consume_skb() no está destinada a ser llamada en un contexto con IRQ deshabilitadas. Sin embargo, después del commit 6bc8a5098bf4 (’net: macb: Fix tx_ptr_lock locking’), la liberación de los SKBs de TX se realiza con las IRQ deshabilitadas. Para resolver la siguiente traza de llamada, utilice dev_consume_skb_any() para liberar los SKBs de TX:\n ADVERTENCIA: kernel/softirq.c:430 en __local_bh_enable_ip+0x174/0x188, CPU#0: ksoftirqd/0/15\n Módulos enlazados:\n CPU: 0 UID: 0 PID: 15 Comm: ksoftirqd/0 No contaminado 7.0.0-rc4-next-20260319-yocto-standard-dirty #37 PREEMPT\n Nombre del hardware: ZynqMP ZCU102 Rev1.1 (DT)\n pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=- -)\n pc : __local_bh_enable_ip+0x174/0x188\n lr : local_bh_enable+0x24/0x38\n sp : ffff800082b3bb10\n x29: ffff800082b3bb10 x28: ffff0008031f3c00 x27: 000000000011ede0\n x26: ffff000800a7ff00 x25: ffff800083937ce8 x24: 0000000000017a80\n x23: ffff000803243a78 x22: 0000000000000040 x21: 0000000000000000\n x20: ffff000800394c80 x19: 0000000000000200 x18: 0000000000000001\n x17: 0000000000000001 x16: ffff000803240000 x15: 0000000000000000\n x14: ffffffffffffffff x13: 0000000000000028 x12: ffff000800395650\n x11: ffff8000821d1528 x10: ffff800081c2bc08 x9 : ffff800081c1e258\n x8 : 0000000100000301 x7 : ffff8000810426ec x6 : 0000000000000000\n x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000\n x2 : 0000000000000008 x1 : 0000000000000200 x0 : ffff8000810428dc\n Traza de llamada:\n __local_bh_enable_ip+0x174/0x188 (P)\n local_bh_enable+0x24/0x38\n skb_attempt_defer_free+0x190/0x1d8\n napi_consume_skb+0x58/0x108\n macb_tx_poll+0x1a4/0x558\n __napi_poll+0x50/0x198\n net_rx_action+0x1f4/0x3d8\n handle_softirqs+0x16c/0x560\n run_ksoftirqd+0x44/0x80\n smpboot_thread_fn+0x1d8/0x338\n kthread+0x120/0x150\n ret_from_fork+0x10/0x20\n Marca de tiempo del evento irq: 29751\n hardirqs habilitadas por última vez en (29750): [[ffff8000813be184]] _raw_spin_unlock_irqrestore+0x44/0x88\n hardirqs deshabilitadas por última vez en (29751): [[ffff8000813bdf60]] _raw_spin_lock_irqsave+0x38/0x98\n softirqs habilitadas por última vez en (29150): [[ffff8000800f1aec]] handle_softirqs+0x504/0x560\n softirqs deshabilitadas por última vez en (29153): [[ffff8000800f2fec]] run_ksoftirqd+0x44/0x80"}],"id":"CVE-2026-31563","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:30.720","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/647b8a2fe474474704110db6bd07f7a139e621eb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/78c8b090a3d5c1689dc989861b0163180db2b3f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/92e7081f0c79d9073087e54bab745bb184192c2e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/984350b37372f79f71d4f0a5264c640e40daf9ce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca4d05afb4683d685bb2c6fccae4386c478f524a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f4bc91398b579730284328322365afa77a9d568f"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31564.json b/data/2026/CVE-2026-31564.json index dab0ee3aaf..8bb34012fa 100644 --- a/data/2026/CVE-2026-31564.json +++ b/data/2026/CVE-2026-31564.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/loongarch/kvm/intc/eiointc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c4f0a9481cf0dd7c71a07484bc98f2570fdb3a82","status":"affected","version":"d3e43a1f34acbb9a814337fc5624765538e5a274","versionType":"git"},{"lessThan":"6bcfb7f46d667b04bd1a1169ccedf5fb699c60df","status":"affected","version":"d3e43a1f34acbb9a814337fc5624765538e5a274","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/loongarch/kvm/intc/eiointc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5054C854-C253-4020-BD2E-2BDA121E424C","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access()\n\nIn function kvm_eiointc_regs_access(), the register base address is\ncaculated from array base address plus offset, the offset is absolute\nvalue from the base address. The data type of array base address is\nu64, it should be converted into the \"void *\" type and then plus the\noffset."}],"id":"CVE-2026-31564","lastModified":"2026-06-17T10:33:59.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:30.850","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6bcfb7f46d667b04bd1a1169ccedf5fb699c60df"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4f0a9481cf0dd7c71a07484bc98f2570fdb3a82"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/loongarch/kvm/intc/eiointc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c4f0a9481cf0dd7c71a07484bc98f2570fdb3a82","status":"affected","version":"d3e43a1f34acbb9a814337fc5624765538e5a274","versionType":"git"},{"lessThan":"6bcfb7f46d667b04bd1a1169ccedf5fb699c60df","status":"affected","version":"d3e43a1f34acbb9a814337fc5624765538e5a274","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/loongarch/kvm/intc/eiointc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5054C854-C253-4020-BD2E-2BDA121E424C","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access()\n\nIn function kvm_eiointc_regs_access(), the register base address is\ncaculated from array base address plus offset, the offset is absolute\nvalue from the base address. The data type of array base address is\nu64, it should be converted into the \"void *\" type and then plus the\noffset."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nLoongArch: KVM: Corrección del cálculo de la dirección base en kvm_eiointc_regs_access()\n\nEn la función kvm_eiointc_regs_access(), la dirección base del registro se calcula a partir de la dirección base del array más el desplazamiento; el desplazamiento es un valor absoluto desde la dirección base. El tipo de dato de la dirección base del array es u64, debería ser convertido al tipo ’void *’ y luego sumarle el desplazamiento."}],"id":"CVE-2026-31564","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:30.850","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6bcfb7f46d667b04bd1a1169ccedf5fb699c60df"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4f0a9481cf0dd7c71a07484bc98f2570fdb3a82"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31565.json b/data/2026/CVE-2026-31565.json index 6e78056751..b89b298b36 100644 --- a/data/2026/CVE-2026-31565.json +++ b/data/2026/CVE-2026-31565.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"009831768faeca3fb5950ce63f1b49594ec82389","status":"affected","version":"0b3c392b82cdf867808a8ea7c6760d3c7e6b6627","versionType":"git"},{"lessThan":"adf0de36e52a48681eb58cbd7cbf6c8d200caa2b","status":"affected","version":"07322c8a12d6c796450faacb8be9e5e3c278ec84","versionType":"git"},{"lessThan":"acb060bc2609c2eab49263968be59c7d59d497bc","status":"affected","version":"c8f304d75f6c6cc679a73f89591f9a915da38f09","versionType":"git"},{"lessThan":"a8a1c7621127a15a02494b96ee376406c064237b","status":"affected","version":"c8f304d75f6c6cc679a73f89591f9a915da38f09","versionType":"git"},{"lessThan":"cd8bcec2de5e24e05c34c9391940fda6f50e79b4","status":"affected","version":"c8f304d75f6c6cc679a73f89591f9a915da38f09","versionType":"git"},{"lessThan":"464bbb844ba5b68e038220c34019069a0a9f1581","status":"affected","version":"c8f304d75f6c6cc679a73f89591f9a915da38f09","versionType":"git"},{"lessThan":"6f52370970ac07d352a7af4089e55e0e6425f827","status":"affected","version":"c8f304d75f6c6cc679a73f89591f9a915da38f09","versionType":"git"},{"status":"affected","version":"6ee53f82540769a6d6e77e40b901f9b9edfa5ff2","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.116","versionType":"semver"},{"lessThan":"6.1.168","status":"affected","version":"6.1.33","versionType":"semver"},{"lessThan":"6.4","status":"affected","version":"6.3.7","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7CB05C1F-FB40-4C30-AA14-E56D6AC3BD9E","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.116","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"09951E95-9B4E-464A-9DAA-53C3B5B22EA2","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B564FB8F-0797-43B6-8D10-1926A40F3099","versionEndExcluding":"6.4","versionStartIncluding":"6.3.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"523F816F-7981-495C-95C0-E3588239D4B9","versionEndExcluding":"6.6.131","versionStartIncluding":"6.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*","matchCriteriaId":"DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix deadlock during netdev reset with active connections\n\nResolve deadlock that occurs when user executes netdev reset while RDMA\napplications (e.g., rping) are active. The netdev reset causes ice\ndriver to remove irdma auxiliary driver, triggering device_delete and\nsubsequent client removal. During client removal, uverbs_client waits\nfor QP reference count to reach zero while cma_client holds the final\nreference, creating circular dependency and indefinite wait in iWARP\nmode. Skip QP reference count wait during device reset to prevent\ndeadlock."}],"id":"CVE-2026-31565","lastModified":"2026-11-10T13:19:00.813","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31565","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:56.278730Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:30.950","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/009831768faeca3fb5950ce63f1b49594ec82389"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/464bbb844ba5b68e038220c34019069a0a9f1581"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6f52370970ac07d352a7af4089e55e0e6425f827"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a8a1c7621127a15a02494b96ee376406c064237b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/acb060bc2609c2eab49263968be59c7d59d497bc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/adf0de36e52a48681eb58cbd7cbf6c8d200caa2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cd8bcec2de5e24e05c34c9391940fda6f50e79b4"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"009831768faeca3fb5950ce63f1b49594ec82389","status":"affected","version":"0b3c392b82cdf867808a8ea7c6760d3c7e6b6627","versionType":"git"},{"lessThan":"adf0de36e52a48681eb58cbd7cbf6c8d200caa2b","status":"affected","version":"07322c8a12d6c796450faacb8be9e5e3c278ec84","versionType":"git"},{"lessThan":"acb060bc2609c2eab49263968be59c7d59d497bc","status":"affected","version":"c8f304d75f6c6cc679a73f89591f9a915da38f09","versionType":"git"},{"lessThan":"a8a1c7621127a15a02494b96ee376406c064237b","status":"affected","version":"c8f304d75f6c6cc679a73f89591f9a915da38f09","versionType":"git"},{"lessThan":"cd8bcec2de5e24e05c34c9391940fda6f50e79b4","status":"affected","version":"c8f304d75f6c6cc679a73f89591f9a915da38f09","versionType":"git"},{"lessThan":"464bbb844ba5b68e038220c34019069a0a9f1581","status":"affected","version":"c8f304d75f6c6cc679a73f89591f9a915da38f09","versionType":"git"},{"lessThan":"6f52370970ac07d352a7af4089e55e0e6425f827","status":"affected","version":"c8f304d75f6c6cc679a73f89591f9a915da38f09","versionType":"git"},{"status":"affected","version":"6ee53f82540769a6d6e77e40b901f9b9edfa5ff2","versionType":"git"},{"lessThan":"5.15.203","status":"affected","version":"5.15.116","versionType":"semver"},{"lessThan":"6.1.168","status":"affected","version":"6.1.33","versionType":"semver"},{"lessThan":"6.4","status":"affected","version":"6.3.7","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/hw/irdma/verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7CB05C1F-FB40-4C30-AA14-E56D6AC3BD9E","versionEndExcluding":"5.15.203","versionStartIncluding":"5.15.116","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"09951E95-9B4E-464A-9DAA-53C3B5B22EA2","versionEndExcluding":"6.1.168","versionStartIncluding":"6.1.33","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B564FB8F-0797-43B6-8D10-1926A40F3099","versionEndExcluding":"6.4","versionStartIncluding":"6.3.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"523F816F-7981-495C-95C0-E3588239D4B9","versionEndExcluding":"6.6.131","versionStartIncluding":"6.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*","matchCriteriaId":"DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix deadlock during netdev reset with active connections\n\nResolve deadlock that occurs when user executes netdev reset while RDMA\napplications (e.g., rping) are active. The netdev reset causes ice\ndriver to remove irdma auxiliary driver, triggering device_delete and\nsubsequent client removal. During client removal, uverbs_client waits\nfor QP reference count to reach zero while cma_client holds the final\nreference, creating circular dependency and indefinite wait in iWARP\nmode. Skip QP reference count wait during device reset to prevent\ndeadlock."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRDMA/irdma: Corregir interbloqueo durante el reinicio de netdev con conexiones activas\n\nResolver interbloqueo que ocurre cuando el usuario ejecuta el reinicio de netdev mientras las aplicaciones RDMA (p. ej., rping) están activas. El reinicio de netdev hace que el controlador ice elimine el controlador auxiliar irdma, desencadenando device_delete y la posterior eliminación del cliente. Durante la eliminación del cliente, uverbs_client espera a que el recuento de referencias de QP llegue a cero mientras cma_client mantiene la referencia final, creando una dependencia circular y una espera indefinida en modo iWARP. Omitir la espera del recuento de referencias de QP durante el reinicio del dispositivo para evitar el interbloqueo."}],"id":"CVE-2026-31565","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31565","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:38:56.278730Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:30.950","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/009831768faeca3fb5950ce63f1b49594ec82389"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/464bbb844ba5b68e038220c34019069a0a9f1581"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6f52370970ac07d352a7af4089e55e0e6425f827"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a8a1c7621127a15a02494b96ee376406c064237b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/acb060bc2609c2eab49263968be59c7d59d497bc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/adf0de36e52a48681eb58cbd7cbf6c8d200caa2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cd8bcec2de5e24e05c34c9391940fda6f50e79b4"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31566.json b/data/2026/CVE-2026-31566.json index ec2f42811f..d9a2034ee1 100644 --- a/data/2026/CVE-2026-31566.json +++ b/data/2026/CVE-2026-31566.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"bc7760c107dc08ef3e231d72c492e67b0a86848b","status":"affected","version":"9ae55f030dc523fc4dc6069557e4a887ea815453","versionType":"git"},{"lessThan":"e23602eb0779760544314ed3905fa6a89a4e4070","status":"affected","version":"9ae55f030dc523fc4dc6069557e4a887ea815453","versionType":"git"},{"lessThan":"138e42be35ff2ce6572ae744de851ea286cf3c69","status":"affected","version":"9ae55f030dc523fc4dc6069557e4a887ea815453","versionType":"git"},{"lessThan":"39820864eacd886f1a6f817414fb8f9ea3e9a2b4","status":"affected","version":"9ae55f030dc523fc4dc6069557e4a887ea815453","versionType":"git"},{"lessThan":"42d248726a0837640452b71c5a202ca3d35239ec","status":"affected","version":"9ae55f030dc523fc4dc6069557e4a887ea815453","versionType":"git"},{"lessThan":"7150850146ebfa4ca998f653f264b8df6f7f85be","status":"affected","version":"9ae55f030dc523fc4dc6069557e4a887ea815453","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.0"},{"lessThan":"6.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EC257481-F46E-4855-AA5E-77FE25D7BA31","versionEndExcluding":"6.1.168","versionStartIncluding":"6.0.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.0:-:*:*:*:*:*:*","matchCriteriaId":"7BE551E5-89CF-47A8-9B26-03CE727FBA37","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib\n\namdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence\nfrom amdgpu_ib_schedule(). This fence is used to wait for job\ncompletion.\n\nCurrently, the code drops the fence reference using dma_fence_put()\nbefore calling dma_fence_wait().\n\nIf dma_fence_put() releases the last reference, the fence may be\nfreed before dma_fence_wait() is called. This can lead to a\nuse-after-free.\n\nFix this by waiting on the fence first and releasing the reference\nonly after dma_fence_wait() completes.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696)\n\n(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)"}],"id":"CVE-2026-31566","lastModified":"2026-10-19T19:18:00.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31566","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:55.523185Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:31.077","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/138e42be35ff2ce6572ae744de851ea286cf3c69"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/39820864eacd886f1a6f817414fb8f9ea3e9a2b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/42d248726a0837640452b71c5a202ca3d35239ec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7150850146ebfa4ca998f653f264b8df6f7f85be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bc7760c107dc08ef3e231d72c492e67b0a86848b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e23602eb0779760544314ed3905fa6a89a4e4070"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"bc7760c107dc08ef3e231d72c492e67b0a86848b","status":"affected","version":"9ae55f030dc523fc4dc6069557e4a887ea815453","versionType":"git"},{"lessThan":"e23602eb0779760544314ed3905fa6a89a4e4070","status":"affected","version":"9ae55f030dc523fc4dc6069557e4a887ea815453","versionType":"git"},{"lessThan":"138e42be35ff2ce6572ae744de851ea286cf3c69","status":"affected","version":"9ae55f030dc523fc4dc6069557e4a887ea815453","versionType":"git"},{"lessThan":"39820864eacd886f1a6f817414fb8f9ea3e9a2b4","status":"affected","version":"9ae55f030dc523fc4dc6069557e4a887ea815453","versionType":"git"},{"lessThan":"42d248726a0837640452b71c5a202ca3d35239ec","status":"affected","version":"9ae55f030dc523fc4dc6069557e4a887ea815453","versionType":"git"},{"lessThan":"7150850146ebfa4ca998f653f264b8df6f7f85be","status":"affected","version":"9ae55f030dc523fc4dc6069557e4a887ea815453","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.0"},{"lessThan":"6.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EC257481-F46E-4855-AA5E-77FE25D7BA31","versionEndExcluding":"6.1.168","versionStartIncluding":"6.0.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.0:-:*:*:*:*:*:*","matchCriteriaId":"7BE551E5-89CF-47A8-9B26-03CE727FBA37","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib\n\namdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence\nfrom amdgpu_ib_schedule(). This fence is used to wait for job\ncompletion.\n\nCurrently, the code drops the fence reference using dma_fence_put()\nbefore calling dma_fence_wait().\n\nIf dma_fence_put() releases the last reference, the fence may be\nfreed before dma_fence_wait() is called. This can lead to a\nuse-after-free.\n\nFix this by waiting on the fence first and releasing the reference\nonly after dma_fence_wait() completes.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696)\n\n(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amdgpu: Corrección de la liberación de ’fence’ antes de la espera en amdgpu_amdkfd_submit_ib\n\namdgpu_amdkfd_submit_ib() envía una tarea de GPU y obtiene un ’fence’ de amdgpu_ib_schedule(). Este ’fence’ se utiliza para esperar la finalización de la tarea.\n\nActualmente, el código libera la referencia del ’fence’ usando dma_fence_put() antes de llamar a dma_fence_wait().\n\nSi dma_fence_put() libera la última referencia, el ’fence’ puede ser liberado antes de que se llame a dma_fence_wait(). Esto puede llevar a un uso después de liberación.\n\nSolucione esto esperando primero en el ’fence’ y liberando la referencia solo después de que dma_fence_wait() se complete.\n\nSoluciona lo siguiente:\ndrivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() advertencia: pasando memoria liberada ’f’ (línea 696)\n\n(seleccionado de la confirmación 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)"}],"id":"CVE-2026-31566","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31566","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:55.523185Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:31.077","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/138e42be35ff2ce6572ae744de851ea286cf3c69"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/39820864eacd886f1a6f817414fb8f9ea3e9a2b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/42d248726a0837640452b71c5a202ca3d35239ec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7150850146ebfa4ca998f653f264b8df6f7f85be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bc7760c107dc08ef3e231d72c492e67b0a86848b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e23602eb0779760544314ed3905fa6a89a4e4070"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31567.json b/data/2026/CVE-2026-31567.json index 00c3e7c24a..aa768c60f1 100644 --- a/data/2026/CVE-2026-31567.json +++ b/data/2026/CVE-2026-31567.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/power/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3025ca5daa9d682b629c0c958b538e41deeb559d","status":"affected","version":"35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d","versionType":"git"},{"lessThan":"f19d1323aa3dd7ead469aef47d9085f8939565d9","status":"affected","version":"35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d","versionType":"git"},{"lessThan":"a8d51efb5929ae308895455a3e496b5eca2cd143","status":"affected","version":"35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d","versionType":"git"},{"status":"affected","version":"4ddf7293928cb619077724b7d828734da8181e6c","versionType":"git"},{"lessThan":"6.18","status":"affected","version":"6.17.8","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/power/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"57D56998-E0C3-4F58-BBF0-B20D1B4322C8","versionEndExcluding":"6.18","versionStartIncluding":"6.17.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2E98868-4027-46EE-AD08-92C9D7283181","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*","matchCriteriaId":"DCE57113-2223-4308-A0F2-5E6ECFBB3C23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask()\n\nCommit 35e4a69b2003f (\"PM: sleep: Allow pm_restrict_gfp_mask()\nstacking\") introduced refcount-based GFP mask management that warns\nwhen pm_restore_gfp_mask() is called with saved_gfp_count == 0.\n\nSome hibernation paths call pm_restore_gfp_mask() defensively where\nthe GFP mask may or may not be restricted depending on the execution\npath. For example, the uswsusp interface invokes it in\nSNAPSHOT_CREATE_IMAGE, SNAPSHOT_UNFREEZE, and snapshot_release().\nBefore the stacking change this was a silent no-op; it now triggers\na spurious WARNING.\n\nRemove the WARN_ON() wrapper from the !saved_gfp_count check while\nretaining the check itself, so that defensive calls remain harmless\nwithout producing false warnings.\n\n[ rjw: Subject tweak ]"}],"id":"CVE-2026-31567","lastModified":"2026-06-17T10:33:59.597","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:31.197","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3025ca5daa9d682b629c0c958b538e41deeb559d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a8d51efb5929ae308895455a3e496b5eca2cd143"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f19d1323aa3dd7ead469aef47d9085f8939565d9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/power/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3025ca5daa9d682b629c0c958b538e41deeb559d","status":"affected","version":"35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d","versionType":"git"},{"lessThan":"f19d1323aa3dd7ead469aef47d9085f8939565d9","status":"affected","version":"35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d","versionType":"git"},{"lessThan":"a8d51efb5929ae308895455a3e496b5eca2cd143","status":"affected","version":"35e4a69b2003f20a69e7d19ae96ab1eef1aa8e8d","versionType":"git"},{"status":"affected","version":"4ddf7293928cb619077724b7d828734da8181e6c","versionType":"git"},{"lessThan":"6.18","status":"affected","version":"6.17.8","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/power/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"57D56998-E0C3-4F58-BBF0-B20D1B4322C8","versionEndExcluding":"6.18","versionStartIncluding":"6.17.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2E98868-4027-46EE-AD08-92C9D7283181","versionEndExcluding":"6.18.21","versionStartIncluding":"6.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*","matchCriteriaId":"DCE57113-2223-4308-A0F2-5E6ECFBB3C23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask()\n\nCommit 35e4a69b2003f (\"PM: sleep: Allow pm_restrict_gfp_mask()\nstacking\") introduced refcount-based GFP mask management that warns\nwhen pm_restore_gfp_mask() is called with saved_gfp_count == 0.\n\nSome hibernation paths call pm_restore_gfp_mask() defensively where\nthe GFP mask may or may not be restricted depending on the execution\npath. For example, the uswsusp interface invokes it in\nSNAPSHOT_CREATE_IMAGE, SNAPSHOT_UNFREEZE, and snapshot_release().\nBefore the stacking change this was a silent no-op; it now triggers\na spurious WARNING.\n\nRemove the WARN_ON() wrapper from the !saved_gfp_count check while\nretaining the check itself, so that defensive calls remain harmless\nwithout producing false warnings.\n\n[ rjw: Subject tweak ]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nPM: sleep: Eliminar WARN_ON() espurio de pm_restore_gfp_mask()\n\nEl commit 35e4a69b2003f (’PM: sleep: Permitir el apilamiento de pm_restrict_gfp_mask()’) introdujo la gestión de la máscara GFP basada en recuento de referencias que advierte cuando se llama a pm_restore_gfp_mask() con saved_gfp_count == 0.\n\nAlgunas rutas de hibernación llaman a pm_restore_gfp_mask() de forma defensiva donde la máscara GFP puede o no estar restringida dependiendo de la ruta de ejecución. Por ejemplo, la interfaz uswsusp lo invoca en SNAPSHOT_CREATE_IMAGE, SNAPSHOT_UNFREEZE y snapshot_release(). Antes del cambio de apilamiento, esto era una operación nula silenciosa; ahora activa una ADVERTENCIA espuria.\n\nEliminar el envoltorio WARN_ON() de la comprobación !saved_gfp_count mientras se mantiene la comprobación en sí, para que las llamadas defensivas sigan siendo inofensivas sin producir advertencias falsas.\n\n[ rjw: Ajuste del asunto ]"}],"id":"CVE-2026-31567","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:31.197","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3025ca5daa9d682b629c0c958b538e41deeb559d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a8d51efb5929ae308895455a3e496b5eca2cd143"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f19d1323aa3dd7ead469aef47d9085f8939565d9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-617"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31568.json b/data/2026/CVE-2026-31568.json index 981a40eccd..dd8ea72887 100644 --- a/data/2026/CVE-2026-31568.json +++ b/data/2026/CVE-2026-31568.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/s390/mm/fault.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"48eda93e50f8361dee8e261fe55d0b31714e1e56","status":"affected","version":"084ea4d611a3d00ee3930400b262240e10895900","versionType":"git"},{"lessThan":"1eb35c54cd81cf874ce7d69e3dbfb162f211b8bd","status":"affected","version":"084ea4d611a3d00ee3930400b262240e10895900","versionType":"git"},{"lessThan":"b36b0e804aee5f20c6798dbeaeaa7cfdb7c6cf88","status":"affected","version":"084ea4d611a3d00ee3930400b262240e10895900","versionType":"git"},{"lessThan":"43ac2d18db1131df0a89993f709131ebfc29f3bd","status":"affected","version":"084ea4d611a3d00ee3930400b262240e10895900","versionType":"git"},{"lessThan":"b00be77302d7ec4ad0367bb236494fce7172b730","status":"affected","version":"084ea4d611a3d00ee3930400b262240e10895900","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/s390/mm/fault.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E034C3DB-8767-405F-B61D-0462FF99F64E","versionEndExcluding":"6.18.21","versionStartIncluding":"5.7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:-:*:*:*:*:*:*","matchCriteriaId":"3D23CE42-BDB2-4216-8495-230ABE98FCDD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Add missing secure storage access fixups for donated memory\n\nThere are special cases where secure storage access exceptions happen\nin a kernel context for pages that don't have the PG_arch_1 bit\nset. That bit is set for non-exported guest secure storage (memory)\nbut is absent on storage donated to the Ultravisor since the kernel\nisn't allowed to export donated pages.\n\nPrior to this patch we would try to export the page by calling\narch_make_folio_accessible() which would instantly return since the\narch bit is absent signifying that the page was already exported and\nno further action is necessary. This leads to secure storage access\nexception loops which can never be resolved.\n\nWith this patch we unconditionally try to export and if that fails we\nfixup."}],"id":"CVE-2026-31568","lastModified":"2026-11-05T22:18:40.660","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31568","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:07.590565Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:31.313","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1eb35c54cd81cf874ce7d69e3dbfb162f211b8bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/43ac2d18db1131df0a89993f709131ebfc29f3bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/48eda93e50f8361dee8e261fe55d0b31714e1e56"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b00be77302d7ec4ad0367bb236494fce7172b730"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b36b0e804aee5f20c6798dbeaeaa7cfdb7c6cf88"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/s390/mm/fault.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"48eda93e50f8361dee8e261fe55d0b31714e1e56","status":"affected","version":"084ea4d611a3d00ee3930400b262240e10895900","versionType":"git"},{"lessThan":"1eb35c54cd81cf874ce7d69e3dbfb162f211b8bd","status":"affected","version":"084ea4d611a3d00ee3930400b262240e10895900","versionType":"git"},{"lessThan":"b36b0e804aee5f20c6798dbeaeaa7cfdb7c6cf88","status":"affected","version":"084ea4d611a3d00ee3930400b262240e10895900","versionType":"git"},{"lessThan":"43ac2d18db1131df0a89993f709131ebfc29f3bd","status":"affected","version":"084ea4d611a3d00ee3930400b262240e10895900","versionType":"git"},{"lessThan":"b00be77302d7ec4ad0367bb236494fce7172b730","status":"affected","version":"084ea4d611a3d00ee3930400b262240e10895900","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/s390/mm/fault.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E034C3DB-8767-405F-B61D-0462FF99F64E","versionEndExcluding":"6.18.21","versionStartIncluding":"5.7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.7:-:*:*:*:*:*:*","matchCriteriaId":"3D23CE42-BDB2-4216-8495-230ABE98FCDD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Add missing secure storage access fixups for donated memory\n\nThere are special cases where secure storage access exceptions happen\nin a kernel context for pages that don't have the PG_arch_1 bit\nset. That bit is set for non-exported guest secure storage (memory)\nbut is absent on storage donated to the Ultravisor since the kernel\nisn't allowed to export donated pages.\n\nPrior to this patch we would try to export the page by calling\narch_make_folio_accessible() which would instantly return since the\narch bit is absent signifying that the page was already exported and\nno further action is necessary. This leads to secure storage access\nexception loops which can never be resolved.\n\nWith this patch we unconditionally try to export and if that fails we\nfixup."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ns390/mm: Añadir correcciones faltantes de acceso a almacenamiento seguro para memoria donada\n\nHay casos especiales donde ocurren excepciones de acceso a almacenamiento seguro en un contexto de kernel para páginas que no tienen el bit PG_arch_1 establecido. Ese bit está establecido para almacenamiento seguro de invitado no exportado (memoria) pero está ausente en el almacenamiento donado al Ultravisor ya que el kernel no tiene permitido exportar páginas donadas.\n\nAntes de este parche, intentaríamos exportar la página llamando a arch_make_folio_accessible() lo que regresaría instantáneamente ya que el bit arch está ausente, significando que la página ya había sido exportada y no es necesaria ninguna acción adicional. Esto lleva a bucles de excepción de acceso a almacenamiento seguro que nunca pueden ser resueltos.\n\nCon este parche, intentamos exportar incondicionalmente y si eso falla, corregimos."}],"id":"CVE-2026-31568","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31568","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:07.590565Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:31.313","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1eb35c54cd81cf874ce7d69e3dbfb162f211b8bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/43ac2d18db1131df0a89993f709131ebfc29f3bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/48eda93e50f8361dee8e261fe55d0b31714e1e56"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b00be77302d7ec4ad0367bb236494fce7172b730"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b36b0e804aee5f20c6798dbeaeaa7cfdb7c6cf88"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31569.json b/data/2026/CVE-2026-31569.json index 25d6c5bd3c..a460981497 100644 --- a/data/2026/CVE-2026-31569.json +++ b/data/2026/CVE-2026-31569.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/loongarch/kvm/intc/eiointc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"126053d0a685bf1f2e98db8966386f38b2336338","status":"affected","version":"3956a52bc05bd811082a3c9d2b423ee957e6fefc","versionType":"git"},{"lessThan":"2a0cbcd28ecf6e0b88fa498bebb94bd1be61a7c3","status":"affected","version":"3956a52bc05bd811082a3c9d2b423ee957e6fefc","versionType":"git"},{"lessThan":"b97bd69eb0f67b5f961b304d28e9ba45e202d841","status":"affected","version":"3956a52bc05bd811082a3c9d2b423ee957e6fefc","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/loongarch/kvm/intc/eiointc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"539740A6-2448-4C77-8279-4E64A6FD93E4","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*","matchCriteriaId":"5A3F9505-6B98-4269-8B81-127E55A1BF00","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Handle the case that EIOINTC's coremap is empty\n\nEIOINTC's coremap in eiointc_update_sw_coremap() can be empty, currently\nwe get a cpuid with -1 in this case, but we actually need 0 because it's\nsimilar as the case that cpuid >= 4.\n\nThis fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[]."}],"id":"CVE-2026-31569","lastModified":"2026-06-17T10:33:59.807","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":4.7,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:31.420","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/126053d0a685bf1f2e98db8966386f38b2336338"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2a0cbcd28ecf6e0b88fa498bebb94bd1be61a7c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b97bd69eb0f67b5f961b304d28e9ba45e202d841"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/loongarch/kvm/intc/eiointc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"126053d0a685bf1f2e98db8966386f38b2336338","status":"affected","version":"3956a52bc05bd811082a3c9d2b423ee957e6fefc","versionType":"git"},{"lessThan":"2a0cbcd28ecf6e0b88fa498bebb94bd1be61a7c3","status":"affected","version":"3956a52bc05bd811082a3c9d2b423ee957e6fefc","versionType":"git"},{"lessThan":"b97bd69eb0f67b5f961b304d28e9ba45e202d841","status":"affected","version":"3956a52bc05bd811082a3c9d2b423ee957e6fefc","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/loongarch/kvm/intc/eiointc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"539740A6-2448-4C77-8279-4E64A6FD93E4","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*","matchCriteriaId":"5A3F9505-6B98-4269-8B81-127E55A1BF00","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: KVM: Handle the case that EIOINTC's coremap is empty\n\nEIOINTC's coremap in eiointc_update_sw_coremap() can be empty, currently\nwe get a cpuid with -1 in this case, but we actually need 0 because it's\nsimilar as the case that cpuid >= 4.\n\nThis fix an out-of-bounds access to kvm_arch::phyid_map::phys_map[]."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: LoongArch: KVM: Manejar el caso en que el coremap de EIOINTC está vacío El coremap de EIOINTC en eiointc_update_sw_coremap() puede estar vacío; actualmente obtenemos un cpuid con -1 en este caso, pero en realidad necesitamos 0 porque es similar al caso en que cpuid mayor o igual que 4. Esto corrige un acceso fuera de límites a kvm_arch::phyid_map::phys_map[]."}],"id":"CVE-2026-31569","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":4.7,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:31.420","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/126053d0a685bf1f2e98db8966386f38b2336338"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2a0cbcd28ecf6e0b88fa498bebb94bd1be61a7c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b97bd69eb0f67b5f961b304d28e9ba45e202d841"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31570.json b/data/2026/CVE-2026-31570.json index ec03dc25d1..385ce74018 100644 --- a/data/2026/CVE-2026-31570.json +++ b/data/2026/CVE-2026-31570.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/can/gw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e7c99348b0612b2bc02d5ce6ff9873261cc7605f","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"999ca48d55a8a46da21519db7e834e5867200379","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"a025283d7f7404c739225e457fb99db2368bb544","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"54ecdf76a55e75c1f5085e440f8ab671a3283ef5","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"84f8b76d24273175a22713e83e90874e1880d801","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"66b689efd08227da2c5ca49b58b30a95d23c695a","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"b9c310d72783cc2f30d103eed83920a5a29c671a","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/can/gw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.4"},{"lessThan":"5.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5CE4B3A5-1831-420D-B001-512B8103441C","versionEndExcluding":"5.10.253","versionStartIncluding":"5.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.4:-:*:*:*:*:*:*","matchCriteriaId":"4D70AB13-37BE-4BD3-A652-10191F1642E4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gw: fix OOB heap access in cgw_csum_crc8_rel()\n\ncgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():\n\n int from = calc_idx(crc8->from_idx, cf->len);\n int to = calc_idx(crc8->to_idx, cf->len);\n int res = calc_idx(crc8->result_idx, cf->len);\n\n if (from < 0 || to < 0 || res < 0)\n return;\n\nHowever, the loop and the result write then use the raw s8 fields directly\ninstead of the computed variables:\n\n for (i = crc8->from_idx; ...) /* BUG: raw negative index */\n cf->data[crc8->result_idx] = ...; /* BUG: raw negative index */\n\nWith from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,\ncalc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with\ni = -64, reading cf->data[-64], and the write goes to cf->data[-64].\nThis write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the\nstart of the canfd_frame on the heap.\n\nThe companion function cgw_csum_xor_rel() uses `from`/`to`/`res`\ncorrectly throughout; fix cgw_csum_crc8_rel() to match.\n\nConfirmed with KASAN on linux-7.0-rc2:\n BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0\n Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62\n\nTo configure the can-gw crc8 checksums CAP_NET_ADMIN is needed."}],"id":"CVE-2026-31570","lastModified":"2026-10-19T19:18:00.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31570","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:57.728767Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:31.520","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/54ecdf76a55e75c1f5085e440f8ab671a3283ef5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66b689efd08227da2c5ca49b58b30a95d23c695a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/84f8b76d24273175a22713e83e90874e1880d801"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/999ca48d55a8a46da21519db7e834e5867200379"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a025283d7f7404c739225e457fb99db2368bb544"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b9c310d72783cc2f30d103eed83920a5a29c671a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e7c99348b0612b2bc02d5ce6ff9873261cc7605f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/can/gw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e7c99348b0612b2bc02d5ce6ff9873261cc7605f","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"999ca48d55a8a46da21519db7e834e5867200379","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"a025283d7f7404c739225e457fb99db2368bb544","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"54ecdf76a55e75c1f5085e440f8ab671a3283ef5","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"84f8b76d24273175a22713e83e90874e1880d801","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"66b689efd08227da2c5ca49b58b30a95d23c695a","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"},{"lessThan":"b9c310d72783cc2f30d103eed83920a5a29c671a","status":"affected","version":"456a8a646b2563438c16a9b27decf9aa717f1ebb","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/can/gw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.4"},{"lessThan":"5.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5CE4B3A5-1831-420D-B001-512B8103441C","versionEndExcluding":"5.10.253","versionStartIncluding":"5.4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.4:-:*:*:*:*:*:*","matchCriteriaId":"4D70AB13-37BE-4BD3-A652-10191F1642E4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gw: fix OOB heap access in cgw_csum_crc8_rel()\n\ncgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():\n\n int from = calc_idx(crc8->from_idx, cf->len);\n int to = calc_idx(crc8->to_idx, cf->len);\n int res = calc_idx(crc8->result_idx, cf->len);\n\n if (from < 0 || to < 0 || res < 0)\n return;\n\nHowever, the loop and the result write then use the raw s8 fields directly\ninstead of the computed variables:\n\n for (i = crc8->from_idx; ...) /* BUG: raw negative index */\n cf->data[crc8->result_idx] = ...; /* BUG: raw negative index */\n\nWith from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,\ncalc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with\ni = -64, reading cf->data[-64], and the write goes to cf->data[-64].\nThis write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the\nstart of the canfd_frame on the heap.\n\nThe companion function cgw_csum_xor_rel() uses `from`/`to`/`res`\ncorrectly throughout; fix cgw_csum_crc8_rel() to match.\n\nConfirmed with KASAN on linux-7.0-rc2:\n BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0\n Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62\n\nTo configure the can-gw crc8 checksums CAP_NET_ADMIN is needed."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: can: gw: corrige el acceso fuera de límites (OOB) a la memoria dinámica en cgw_csum_crc8_rel() cgw_csum_crc8_rel() calcula correctamente los índices seguros dentro de los límites mediante calc_idx(): int from = calc_idx(crc8 -> from_idx, cf -> len); int to = calc_idx(crc8 -> to_idx, cf -> len); int res = calc_idx(crc8 -> result_idx, cf -> len); if (from menor que 0 || to menor que 0 || res menor que 0) return; Sin embargo, el bucle y la escritura del resultado luego usan los campos s8 sin procesar directamente\nen lugar de las variables calculadas: for (i = crc8 -> from_idx; ...) /* ERROR: índice negativo sin procesar */ cf -> data[crc8 -> result_idx] = ...; /* ERROR: índice negativo sin procesar */ Con from_idx = to_idx = result_idx = -64 en una trama CAN FD de 64 bytes,\ncalc_idx(-64, 64) = 0 por lo que la comprobación pasa, pero el bucle itera con\ni = -64, leyendo cf -> data[-64], y la escritura va a cf -> data[-64].\nEsta escritura podría terminar hasta 56 (7.0-rc) o 40 (menor o igual que 6.19) bytes antes del\ninicio del canfd_frame en la memoria dinámica. La función compañera cgw_csum_xor_rel() usa ’from’/’to’/’res’\ncorrectamente en todo momento; corrige cgw_csum_crc8_rel() para que coincida. Confirmado con KASAN en linux-7.0-rc2: ERROR: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0 Lectura de tamaño 1 en la dirección ffff8880076619c8 por la tarea poc_cgw_oob/62 Para configurar las sumas de comprobación crc8 de can-gw se necesita CAP_NET_ADMIN."}],"id":"CVE-2026-31570","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31570","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:57.728767Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:31.520","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/54ecdf76a55e75c1f5085e440f8ab671a3283ef5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66b689efd08227da2c5ca49b58b30a95d23c695a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/84f8b76d24273175a22713e83e90874e1880d801"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/999ca48d55a8a46da21519db7e834e5867200379"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a025283d7f7404c739225e457fb99db2368bb544"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b9c310d72783cc2f30d103eed83920a5a29c671a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e7c99348b0612b2bc02d5ce6ff9873261cc7605f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31571.json b/data/2026/CVE-2026-31571.json index f064f35132..4ff826982c 100644 --- a/data/2026/CVE-2026-31571.json +++ b/data/2026/CVE-2026-31571.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/i915/display/intel_plane.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"70e2eb91cb6310a3508439f6f2539dfffa0abf77","status":"affected","version":"6a01df2f1b2a3b29721143729a3feff816bc0083","versionType":"git"},{"lessThan":"12f3b6cbab8fbeb95097685b40f0147406cf9746","status":"affected","version":"6a01df2f1b2a3b29721143729a3feff816bc0083","versionType":"git"},{"lessThan":"bfa71b7a9dc6b5b8af157686e03308291141d00c","status":"affected","version":"6a01df2f1b2a3b29721143729a3feff816bc0083","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/i915/display/intel_plane.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36BA90C1-6493-4928-A360-8DF69289C352","versionEndExcluding":"6.18.21","versionStartIncluding":"6.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*","matchCriteriaId":"A1ECC65A-EE37-4479-8E99-4BB68A22A31F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Unlink NV12 planes earlier\n\nunlink_nv12_plane() will clobber parts of the plane state\npotentially already set up by plane_atomic_check(), so we\nmust make sure not to call the two in the wrong order.\nThe problem happens when a plane previously selected as\na Y plane is now configured as a normal plane by user space.\nplane_atomic_check() will first compute the proper plane\nstate based on the userspace request, and unlink_nv12_plane()\nlater clears some of the state.\n\nThis used to work on account of unlink_nv12_plane() skipping\nthe state clearing based on the plane visibility. But I removed\nthat check, thinking it was an impossible situation. Now when\nthat situation happens unlink_nv12_plane() will just WARN\nand proceed to clobber the state.\n\nRather than reverting to the old way of doing things, I think\nit's more clear if we unlink the NV12 planes before we even\ncompute the new plane state.\n\n(cherry picked from commit 017ecd04985573eeeb0745fa2c23896fb22ee0cc)"}],"id":"CVE-2026-31571","lastModified":"2026-11-05T22:18:40.810","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31571","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:14.635829Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:31.653","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/12f3b6cbab8fbeb95097685b40f0147406cf9746"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70e2eb91cb6310a3508439f6f2539dfffa0abf77"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bfa71b7a9dc6b5b8af157686e03308291141d00c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/i915/display/intel_plane.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"70e2eb91cb6310a3508439f6f2539dfffa0abf77","status":"affected","version":"6a01df2f1b2a3b29721143729a3feff816bc0083","versionType":"git"},{"lessThan":"12f3b6cbab8fbeb95097685b40f0147406cf9746","status":"affected","version":"6a01df2f1b2a3b29721143729a3feff816bc0083","versionType":"git"},{"lessThan":"bfa71b7a9dc6b5b8af157686e03308291141d00c","status":"affected","version":"6a01df2f1b2a3b29721143729a3feff816bc0083","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/i915/display/intel_plane.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36BA90C1-6493-4928-A360-8DF69289C352","versionEndExcluding":"6.18.21","versionStartIncluding":"6.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.15:-:*:*:*:*:*:*","matchCriteriaId":"A1ECC65A-EE37-4479-8E99-4BB68A22A31F","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Unlink NV12 planes earlier\n\nunlink_nv12_plane() will clobber parts of the plane state\npotentially already set up by plane_atomic_check(), so we\nmust make sure not to call the two in the wrong order.\nThe problem happens when a plane previously selected as\na Y plane is now configured as a normal plane by user space.\nplane_atomic_check() will first compute the proper plane\nstate based on the userspace request, and unlink_nv12_plane()\nlater clears some of the state.\n\nThis used to work on account of unlink_nv12_plane() skipping\nthe state clearing based on the plane visibility. But I removed\nthat check, thinking it was an impossible situation. Now when\nthat situation happens unlink_nv12_plane() will just WARN\nand proceed to clobber the state.\n\nRather than reverting to the old way of doing things, I think\nit's more clear if we unlink the NV12 planes before we even\ncompute the new plane state.\n\n(cherry picked from commit 017ecd04985573eeeb0745fa2c23896fb22ee0cc)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/i915: Desvincular planos NV12 antes\n\nunlink_nv12_plane() sobrescribirá partes del estado del plano potencialmente ya configuradas por plane_atomic_check(), por lo que debemos asegurarnos de no llamar a las dos en el orden incorrecto. El problema ocurre cuando un plano previamente seleccionado como un plano Y ahora se configura como un plano normal por el espacio de usuario. plane_atomic_check() primero calculará el estado del plano adecuado basado en la solicitud del espacio de usuario, y unlink_nv12_plane() más tarde borra parte del estado.\n\nEsto solía funcionar debido a que unlink_nv12_plane() omitía la limpieza del estado basada en la visibilidad del plano. Pero eliminé esa verificación, pensando que era una situación imposible. Ahora, cuando esa situación ocurre, unlink_nv12_plane() simplemente ADVERTIRÁ y procederá a sobrescribir el estado.\n\nEn lugar de revertir a la antigua forma de hacer las cosas, creo que es más claro si desvinculamos los planos NV12 incluso antes de calcular el nuevo estado del plano.\n\n(seleccionado de la confirmación 017ecd04985573eeeb0745fa2c23896fb22ee0cc)"}],"id":"CVE-2026-31571","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31571","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:14.635829Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:31.653","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/12f3b6cbab8fbeb95097685b40f0147406cf9746"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70e2eb91cb6310a3508439f6f2539dfffa0abf77"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bfa71b7a9dc6b5b8af157686e03308291141d00c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31572.json b/data/2026/CVE-2026-31572.json index d4f856e0f7..f502780a8d 100644 --- a/data/2026/CVE-2026-31572.json +++ b/data/2026/CVE-2026-31572.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/i2c/busses/i2c-designware-amdisp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"83bcea9da91965484df64a6492b89e65d41ab31c","status":"affected","version":"d6263c468a761cd4c89887073614394ac48441e1","versionType":"git"},{"lessThan":"e81f0341754c309e33babea2821eda8f98f0b44c","status":"affected","version":"d6263c468a761cd4c89887073614394ac48441e1","versionType":"git"},{"lessThan":"e2f1ada8e089dd5a331bcd8b88125ae2af8d188f","status":"affected","version":"d6263c468a761cd4c89887073614394ac48441e1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/i2c/busses/i2c-designware-amdisp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ABCE137D-81F5-4A69-BEC9-C222E10F0BAF","versionEndExcluding":"6.18.21","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: designware: amdisp: Fix resume-probe race condition issue\n\nIdentified resume-probe race condition in kernel v7.0 with the commit\n38fa29b01a6a (\"i2c: designware: Combine the init functions\"),but this\nissue existed from the beginning though not detected.\n\nThe amdisp i2c device requires ISP to be in power-on state for probe\nto succeed. To meet this requirement, this device is added to genpd\nto control ISP power using runtime PM. The pm_runtime_get_sync() called\nbefore i2c_dw_probe() triggers PM resume, which powers on ISP and also\ninvokes the amdisp i2c runtime resume before the probe completes resulting\nin this race condition and a NULL dereferencing issue in v7.0\n\nFix this race condition by using the genpd APIs directly during probe:\n - Call dev_pm_genpd_resume() to Power ON ISP before probe\n - Call dev_pm_genpd_suspend() to Power OFF ISP after probe\n - Set the device to suspended state with pm_runtime_set_suspended()\n - Enable runtime PM only after the device is fully initialized"}],"id":"CVE-2026-31572","lastModified":"2026-11-05T22:18:40.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31572","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:22.654738Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:31.757","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83bcea9da91965484df64a6492b89e65d41ab31c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2f1ada8e089dd5a331bcd8b88125ae2af8d188f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e81f0341754c309e33babea2821eda8f98f0b44c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/i2c/busses/i2c-designware-amdisp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"83bcea9da91965484df64a6492b89e65d41ab31c","status":"affected","version":"d6263c468a761cd4c89887073614394ac48441e1","versionType":"git"},{"lessThan":"e81f0341754c309e33babea2821eda8f98f0b44c","status":"affected","version":"d6263c468a761cd4c89887073614394ac48441e1","versionType":"git"},{"lessThan":"e2f1ada8e089dd5a331bcd8b88125ae2af8d188f","status":"affected","version":"d6263c468a761cd4c89887073614394ac48441e1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/i2c/busses/i2c-designware-amdisp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ABCE137D-81F5-4A69-BEC9-C222E10F0BAF","versionEndExcluding":"6.18.21","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: designware: amdisp: Fix resume-probe race condition issue\n\nIdentified resume-probe race condition in kernel v7.0 with the commit\n38fa29b01a6a (\"i2c: designware: Combine the init functions\"),but this\nissue existed from the beginning though not detected.\n\nThe amdisp i2c device requires ISP to be in power-on state for probe\nto succeed. To meet this requirement, this device is added to genpd\nto control ISP power using runtime PM. The pm_runtime_get_sync() called\nbefore i2c_dw_probe() triggers PM resume, which powers on ISP and also\ninvokes the amdisp i2c runtime resume before the probe completes resulting\nin this race condition and a NULL dereferencing issue in v7.0\n\nFix this race condition by using the genpd APIs directly during probe:\n - Call dev_pm_genpd_resume() to Power ON ISP before probe\n - Call dev_pm_genpd_suspend() to Power OFF ISP after probe\n - Set the device to suspended state with pm_runtime_set_suspended()\n - Enable runtime PM only after the device is fully initialized"},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\ni2c: designware: amdisp: Solución al problema de condición de carrera de reanudación-sonda\n\nSe identificó una condición de carrera de reanudación-sonda en el kernel v7.0 con el commit 38fa29b01a6a (’i2c: designware: Combine the init functions’), pero este problema existía desde el principio aunque no fue detectado.\n\nEl dispositivo i2c amdisp requiere que el ISP esté en estado de encendido para que la sonda tenga éxito. Para cumplir con este requisito, este dispositivo se añade a genpd para controlar la energía del ISP utilizando PM en tiempo de ejecución. La llamada a pm_runtime_get_sync() antes de i2c_dw_probe() activa la reanudación de PM, lo que enciende el ISP y también invoca la reanudación en tiempo de ejecución del i2c amdisp antes de que la sonda se complete, resultando en esta condición de carrera y un problema de desreferenciación de NULL en v7.0.\n\nSe corrige esta condición de carrera utilizando las APIs de genpd directamente durante la sonda:\n - Llamar a dev_pm_genpd_resume() para Encender el ISP antes de la sonda\n - Llamar a dev_pm_genpd_suspend() para Apagar el ISP después de la sonda\n - Establecer el dispositivo en estado suspendido con pm_runtime_set_suspended()\n - Habilitar PM en tiempo de ejecución solo después de que el dispositivo esté completamente inicializado"}],"id":"CVE-2026-31572","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31572","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:22.654738Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:31.757","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83bcea9da91965484df64a6492b89e65d41ab31c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2f1ada8e089dd5a331bcd8b88125ae2af8d188f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e81f0341754c309e33babea2821eda8f98f0b44c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-362"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31573.json b/data/2026/CVE-2026-31573.json index 4b5b1b9ab4..dfbf3ded05 100644 --- a/data/2026/CVE-2026-31573.json +++ b/data/2026/CVE-2026-31573.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/platform/verisilicon/imx8m_vpu_hw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"53b88097bb0e0b895a691ae7da4a54b567c0d375","status":"affected","version":"42a9fbccb33a38c5a9e0a84680939da8eae4f60e","versionType":"git"},{"lessThan":"5d177ff5eb235de9cc0b8e877466f5a3af6f573e","status":"affected","version":"f2efc1e8ab65bdb9b892af132887323e4df92f02","versionType":"git"},{"lessThan":"07861e84b766c6db8014bc34138f3be4a62aad2a","status":"affected","version":"5133ef7c893c2c3aee7dd12503dc480de9dbfbb5","versionType":"git"},{"lessThan":"1e7e9119cf9b0d8585b27653b1a6dc31397c252e","status":"affected","version":"286d629d10640bc22f3bf46aa4f356eb7975e862","versionType":"git"},{"lessThan":"e8d97c270cb46a2a88739019d0f8547adc7d97da","status":"affected","version":"e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765","versionType":"git"},{"status":"affected","version":"f988fbf0536b42f6a05ccc1ac709d60236ec1aa6","versionType":"git"},{"lessThan":"6.7","status":"affected","version":"6.6.160","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/platform/verisilicon/imx8m_vpu_hw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.19.11","status":"affected","version":"6.19.6","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BFE33C3-C605-4CC2-9F15-3494BA78E2C9","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: Fix kernel panic due to __initconst misuse\n\nFix a kernel panic when probing the driver as a module:\n\n Unable to handle kernel paging request at virtual address\n ffffd9c18eb05000\n of_find_matching_node_and_match+0x5c/0x1a0\n hantro_probe+0x2f4/0x7d0 [hantro_vpu]\n\nThe imx8mq_vpu_shared_resources array is referenced by variant\nstructures through their shared_devices field. When built as a\nmodule, __initconst causes this data to be freed after module\ninit, but it's later accessed during probe, causing a page fault.\n\nThe imx8mq_vpu_shared_resources is referenced from non-init code,\nso keeping __initconst or __initconst_or_module here is wrong.\n\nDrop the __initconst annotation and let it live in the normal .rodata\nsection.\n\nA bug of __initconst called from regular non-init probe code\nleading to bugs during probe deferrals or during unbind-bind cycles."}],"id":"CVE-2026-31573","lastModified":"2026-10-30T13:18:41.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:31.857","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/07861e84b766c6db8014bc34138f3be4a62aad2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1e7e9119cf9b0d8585b27653b1a6dc31397c252e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/53b88097bb0e0b895a691ae7da4a54b567c0d375"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5d177ff5eb235de9cc0b8e877466f5a3af6f573e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e8d97c270cb46a2a88739019d0f8547adc7d97da"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/platform/verisilicon/imx8m_vpu_hw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"53b88097bb0e0b895a691ae7da4a54b567c0d375","status":"affected","version":"42a9fbccb33a38c5a9e0a84680939da8eae4f60e","versionType":"git"},{"lessThan":"5d177ff5eb235de9cc0b8e877466f5a3af6f573e","status":"affected","version":"f2efc1e8ab65bdb9b892af132887323e4df92f02","versionType":"git"},{"lessThan":"07861e84b766c6db8014bc34138f3be4a62aad2a","status":"affected","version":"5133ef7c893c2c3aee7dd12503dc480de9dbfbb5","versionType":"git"},{"lessThan":"1e7e9119cf9b0d8585b27653b1a6dc31397c252e","status":"affected","version":"286d629d10640bc22f3bf46aa4f356eb7975e862","versionType":"git"},{"lessThan":"e8d97c270cb46a2a88739019d0f8547adc7d97da","status":"affected","version":"e0203ddf9af7c8e170e1e99ce83b4dc07f0cd765","versionType":"git"},{"status":"affected","version":"f988fbf0536b42f6a05ccc1ac709d60236ec1aa6","versionType":"git"},{"lessThan":"6.7","status":"affected","version":"6.6.160","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/platform/verisilicon/imx8m_vpu_hw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6.19.11","status":"affected","version":"6.19.6","versionType":"semver"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1BFE33C3-C605-4CC2-9F15-3494BA78E2C9","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19.6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: Fix kernel panic due to __initconst misuse\n\nFix a kernel panic when probing the driver as a module:\n\n Unable to handle kernel paging request at virtual address\n ffffd9c18eb05000\n of_find_matching_node_and_match+0x5c/0x1a0\n hantro_probe+0x2f4/0x7d0 [hantro_vpu]\n\nThe imx8mq_vpu_shared_resources array is referenced by variant\nstructures through their shared_devices field. When built as a\nmodule, __initconst causes this data to be freed after module\ninit, but it's later accessed during probe, causing a page fault.\n\nThe imx8mq_vpu_shared_resources is referenced from non-init code,\nso keeping __initconst or __initconst_or_module here is wrong.\n\nDrop the __initconst annotation and let it live in the normal .rodata\nsection.\n\nA bug of __initconst called from regular non-init probe code\nleading to bugs during probe deferrals or during unbind-bind cycles."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: verisilicon: Corrige un pánico del kernel debido al uso indebido de __initconst\n\nCorrige un pánico del kernel al sondear el controlador como un módulo:\n\n No se puede manejar la solicitud de paginación del kernel en la dirección virtual\n ffffd9c18eb05000\n of_find_matching_node_and_match+0x5c/0x1a0\n hantro_probe+0x2f4/0x7d0 [hantro_vpu]\n\nEl array imx8mq_vpu_shared_resources es referenciado por estructuras variantes a través de su campo shared_devices. Cuando se construye como un módulo, __initconst hace que estos datos sean liberados después de la inicialización del módulo, pero se accede a ellos más tarde durante el sondeo, causando un fallo de página.\n\nEl imx8mq_vpu_shared_resources es referenciado desde código no de inicialización, por lo que mantener __initconst o __initconst_or_module aquí es incorrecto.\n\nElimina la anotación __initconst y deja que resida en la sección normal .rodata.\n\nUn error de __initconst llamado desde código de sondeo regular no de inicialización que lleva a errores durante aplazamientos de sondeo o durante ciclos de desvinculación-vinculación."}],"id":"CVE-2026-31573","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:31.857","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/07861e84b766c6db8014bc34138f3be4a62aad2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1e7e9119cf9b0d8585b27653b1a6dc31397c252e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/53b88097bb0e0b895a691ae7da4a54b567c0d375"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5d177ff5eb235de9cc0b8e877466f5a3af6f573e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e8d97c270cb46a2a88739019d0f8547adc7d97da"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31574.json b/data/2026/CVE-2026-31574.json index 0c68aa3099..7ed2006de0 100644 --- a/data/2026/CVE-2026-31574.json +++ b/data/2026/CVE-2026-31574.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/time/clockevents.c","kernel/time/tick-broadcast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9401b593fa48218d2667df1610b0ebc518554880","status":"affected","version":"d6e152d905bdb1f32f9d99775e2f453350399a6a","versionType":"git"},{"lessThan":"4096fd0e8eaea13ebe5206700b33f49635ae18e5","status":"affected","version":"d6e152d905bdb1f32f9d99775e2f453350399a6a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/time/clockevents.c","kernel/time/tick-broadcast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.0"},{"lessThan":"7.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:-:*:*:*:*:*:*","matchCriteriaId":"EF897730-3F1E-47A2-8B07-22535202C487","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nclockevents: Add missing resets of the next_event_forced flag\n\nThe prevention mechanism against timer interrupt starvation missed to reset\nthe next_event_forced flag in a couple of places:\n\n - When the clock event state changes. That can cause the flag to be\n stale over a shutdown/startup sequence\n\n - When a non-forced event is armed, which then prevents rearming before\n that event. If that event is far out in the future this will cause\n missed timer interrupts.\n\n - In the suspend wakeup handler.\n\nThat led to stalls which have been reported by several people.\n\nAdd the missing resets, which fixes the problems for the reporters."}],"id":"CVE-2026-31574","lastModified":"2026-11-05T22:18:41.117","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:29.451177Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:32.020","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4096fd0e8eaea13ebe5206700b33f49635ae18e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9401b593fa48218d2667df1610b0ebc518554880"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/time/clockevents.c","kernel/time/tick-broadcast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9401b593fa48218d2667df1610b0ebc518554880","status":"affected","version":"d6e152d905bdb1f32f9d99775e2f453350399a6a","versionType":"git"},{"lessThan":"4096fd0e8eaea13ebe5206700b33f49635ae18e5","status":"affected","version":"d6e152d905bdb1f32f9d99775e2f453350399a6a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/time/clockevents.c","kernel/time/tick-broadcast.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.0"},{"lessThan":"7.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:-:*:*:*:*:*:*","matchCriteriaId":"EF897730-3F1E-47A2-8B07-22535202C487","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nclockevents: Add missing resets of the next_event_forced flag\n\nThe prevention mechanism against timer interrupt starvation missed to reset\nthe next_event_forced flag in a couple of places:\n\n - When the clock event state changes. That can cause the flag to be\n stale over a shutdown/startup sequence\n\n - When a non-forced event is armed, which then prevents rearming before\n that event. If that event is far out in the future this will cause\n missed timer interrupts.\n\n - In the suspend wakeup handler.\n\nThat led to stalls which have been reported by several people.\n\nAdd the missing resets, which fixes the problems for the reporters."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nclockevents: Añadir restablecimientos faltantes del indicador next_event_forced\n\nEl mecanismo de prevención contra el agotamiento de interrupciones del temporizador omitió restablecer el indicador next_event_forced en un par de lugares:\n\n - Cuando el estado del evento de reloj cambia. Eso puede hacer que el indicador quede obsoleto durante una secuencia de apagado/arranque\n\n - Cuando se arma un evento no forzado, lo que luego impide el rearme antes de ese evento. Si ese evento está muy lejos en el futuro, esto causará interrupciones del temporizador perdidas.\n\n - En el gestor de activación de suspensión.\n\nEso llevó a bloqueos que han sido reportados por varias personas.\n\nAñadir los restablecimientos faltantes, lo que soluciona los problemas para los que los reportaron."}],"id":"CVE-2026-31574","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31574","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:29.451177Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:32.020","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4096fd0e8eaea13ebe5206700b33f49635ae18e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9401b593fa48218d2667df1610b0ebc518554880"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31575.json b/data/2026/CVE-2026-31575.json index c16ec55dc0..48cf614315 100644 --- a/data/2026/CVE-2026-31575.json +++ b/data/2026/CVE-2026-31575.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/hugetlb.h","mm/userfaultfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5a525c43baaba0bf3063f86996ca3623b71e4172","status":"affected","version":"a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3","versionType":"git"},{"lessThan":"574501ede47ac439afd67ba9812bc66722d500ba","status":"affected","version":"a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3","versionType":"git"},{"lessThan":"08282b1bf74c69fc8ecd25493e7fdb5460f01290","status":"affected","version":"a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3","versionType":"git"},{"lessThan":"f4689fc089765d36c026063fb22d23533e883eb6","status":"affected","version":"a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3","versionType":"git"},{"lessThan":"0217c7fb4de4a40cee667eb21901f3204effe5ac","status":"affected","version":"a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/hugetlb.h","mm/userfaultfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9BC7BB9E-B7C1-413D-9B8D-BE033C486508","versionEndExcluding":"6.12.84","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/userfaultfd: fix hugetlb fault mutex hash calculation\n\nIn mfill_atomic_hugetlb(), linear_page_index() is used to calculate the\npage index for hugetlb_fault_mutex_hash(). However, linear_page_index()\nreturns the index in PAGE_SIZE units, while hugetlb_fault_mutex_hash()\nexpects the index in huge page units. This mismatch means that different\naddresses within the same huge page can produce different hash values,\nleading to the use of different mutexes for the same huge page. This can\ncause races between faulting threads, which can corrupt the reservation\nmap and trigger the BUG_ON in resv_map_release().\n\nFix this by introducing hugetlb_linear_page_index(), which returns the\npage index in huge page granularity, and using it in place of\nlinear_page_index()."}],"id":"CVE-2026-31575","lastModified":"2026-11-05T22:18:41.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31575","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:34.682609Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:32.123","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0217c7fb4de4a40cee667eb21901f3204effe5ac"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08282b1bf74c69fc8ecd25493e7fdb5460f01290"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/574501ede47ac439afd67ba9812bc66722d500ba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a525c43baaba0bf3063f86996ca3623b71e4172"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f4689fc089765d36c026063fb22d23533e883eb6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/hugetlb.h","mm/userfaultfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5a525c43baaba0bf3063f86996ca3623b71e4172","status":"affected","version":"a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3","versionType":"git"},{"lessThan":"574501ede47ac439afd67ba9812bc66722d500ba","status":"affected","version":"a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3","versionType":"git"},{"lessThan":"08282b1bf74c69fc8ecd25493e7fdb5460f01290","status":"affected","version":"a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3","versionType":"git"},{"lessThan":"f4689fc089765d36c026063fb22d23533e883eb6","status":"affected","version":"a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3","versionType":"git"},{"lessThan":"0217c7fb4de4a40cee667eb21901f3204effe5ac","status":"affected","version":"a08c7193e4f18dc8508f2d07d0de2c5b94cb39a3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/hugetlb.h","mm/userfaultfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9BC7BB9E-B7C1-413D-9B8D-BE033C486508","versionEndExcluding":"6.12.84","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/userfaultfd: fix hugetlb fault mutex hash calculation\n\nIn mfill_atomic_hugetlb(), linear_page_index() is used to calculate the\npage index for hugetlb_fault_mutex_hash(). However, linear_page_index()\nreturns the index in PAGE_SIZE units, while hugetlb_fault_mutex_hash()\nexpects the index in huge page units. This mismatch means that different\naddresses within the same huge page can produce different hash values,\nleading to the use of different mutexes for the same huge page. This can\ncause races between faulting threads, which can corrupt the reservation\nmap and trigger the BUG_ON in resv_map_release().\n\nFix this by introducing hugetlb_linear_page_index(), which returns the\npage index in huge page granularity, and using it in place of\nlinear_page_index()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/userfaultfd: corrige el cálculo del hash del mutex de fallo de hugetlb\n\nEn mfill_atomic_hugetlb(), se utiliza linear_page_index() para calcular el índice de página para hugetlb_fault_mutex_hash(). Sin embargo, linear_page_index() devuelve el índice en unidades PAGE_SIZE, mientras que hugetlb_fault_mutex_hash() espera el índice en unidades de página enorme. Esta discrepancia significa que diferentes direcciones dentro de la misma página enorme pueden producir diferentes valores hash, lo que lleva al uso de diferentes mutexes para la misma página enorme. Esto puede causar condiciones de carrera entre hilos con fallos, lo que puede corromper el mapa de reserva y activar el BUG_ON en resv_map_release().\n\nSe corrige esto introduciendo hugetlb_linear_page_index(), que devuelve el índice de página con granularidad de página enorme, y usándolo en lugar de linear_page_index()."}],"id":"CVE-2026-31575","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31575","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:34.682609Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:32.123","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0217c7fb4de4a40cee667eb21901f3204effe5ac"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08282b1bf74c69fc8ecd25493e7fdb5460f01290"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/574501ede47ac439afd67ba9812bc66722d500ba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a525c43baaba0bf3063f86996ca3623b71e4172"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f4689fc089765d36c026063fb22d23533e883eb6"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31576.json b/data/2026/CVE-2026-31576.json index b40d3dc233..9deeccd427 100644 --- a/data/2026/CVE-2026-31576.json +++ b/data/2026/CVE-2026-31576.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/usb/hackrf/hackrf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"87b9685cca91ed715c39ba544715832d26a7f4b4","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"131ec9046e1c8af101aebdaec4e8095e05f3312b","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"67fd62e3efdc9dce01f76d95a745212f4feb38e6","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"45cbaf5c7cdc5386d86377f0daf94a17a007fed0","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"98a0a81ce78020c2522e0046f49d200de9778cb9","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"07e9e674b6146b1f6fc41b1f54b8968bf2802824","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"2145c71a8044362e82e9923f001ba2aeb771b848","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"fcd1d70792a35c8a97414fe429f48311e41269c2","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"3b7da2b4d0fe014eff181ed37e3bf832eb8ed258","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/usb/hackrf/hackrf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.4"},{"lessThan":"4.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: hackrf: fix to not free memory after the device is registered in hackrf_probe()\n\nIn hackrf driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nhackrf_probe()\n kzalloc(); // alloc hackrf_dev\n ....\n v4l2_device_register();\n ....\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open hackrf fd\n\t\t\t\t\t\t....\n v4l2_device_unregister();\n ....\n kfree(); // free hackrf_dev\n ....\n\t\t\t\t\t\tsys_ioctl(fd, ...);\n\t\t\t\t\t\t v4l2_ioctl();\n\t\t\t\t\t\t video_is_registered() // UAF!!\n\t\t\t\t\t\t....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t v4l2_release() // UAF!!\n\t\t\t\t\t\t hackrf_video_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a V4L2 or video device is unregistered, the device node is removed so\nnew open() calls are blocked.\n\nHowever, file descriptors that are already open-and any in-flight I/O-do\nnot terminate immediately; they remain valid until the last reference is\ndropped and the driver's release() is invoked.\n\nTherefore, freeing device memory on the error path after hackrf_probe()\nhas registered dev it will lead to a race to use-after-free vuln, since\nthose already-open handles haven't been released yet.\n\nAnd since release() free memory too, race to use-after-free and\ndouble-free vuln occur.\n\nTo prevent this, if device is registered from probe(), it should be\nmodified to free memory only through release() rather than calling\nkfree() directly."}],"id":"CVE-2026-31576","lastModified":"2026-06-17T10:34:00.573","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:32.230","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/usb/hackrf/hackrf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"87b9685cca91ed715c39ba544715832d26a7f4b4","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"131ec9046e1c8af101aebdaec4e8095e05f3312b","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"67fd62e3efdc9dce01f76d95a745212f4feb38e6","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"45cbaf5c7cdc5386d86377f0daf94a17a007fed0","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"98a0a81ce78020c2522e0046f49d200de9778cb9","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"07e9e674b6146b1f6fc41b1f54b8968bf2802824","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"2145c71a8044362e82e9923f001ba2aeb771b848","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"fcd1d70792a35c8a97414fe429f48311e41269c2","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"},{"lessThan":"3b7da2b4d0fe014eff181ed37e3bf832eb8ed258","status":"affected","version":"8bc4a9ed85046c214458c9e82aea75d2f46cfffd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/usb/hackrf/hackrf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.4"},{"lessThan":"4.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: hackrf: fix to not free memory after the device is registered in hackrf_probe()\n\nIn hackrf driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nhackrf_probe()\n kzalloc(); // alloc hackrf_dev\n ....\n v4l2_device_register();\n ....\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open hackrf fd\n\t\t\t\t\t\t....\n v4l2_device_unregister();\n ....\n kfree(); // free hackrf_dev\n ....\n\t\t\t\t\t\tsys_ioctl(fd, ...);\n\t\t\t\t\t\t v4l2_ioctl();\n\t\t\t\t\t\t video_is_registered() // UAF!!\n\t\t\t\t\t\t....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t v4l2_release() // UAF!!\n\t\t\t\t\t\t hackrf_video_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a V4L2 or video device is unregistered, the device node is removed so\nnew open() calls are blocked.\n\nHowever, file descriptors that are already open-and any in-flight I/O-do\nnot terminate immediately; they remain valid until the last reference is\ndropped and the driver's release() is invoked.\n\nTherefore, freeing device memory on the error path after hackrf_probe()\nhas registered dev it will lead to a race to use-after-free vuln, since\nthose already-open handles haven't been released yet.\n\nAnd since release() free memory too, race to use-after-free and\ndouble-free vuln occur.\n\nTo prevent this, if device is registered from probe(), it should be\nmodified to free memory only through release() rather than calling\nkfree() directly."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: hackrf: corrección para no liberar memoria después de que el dispositivo es registrado en hackrf_probe()\n\nEn el controlador hackrf, la siguiente condición de carrera ocurre:\n””“\n\t\tCPU0\t\t\t\t\t\tCPU1\nhackrf_probe()\n kzalloc(); // asigna hackrf_dev\n ....\n v4l2_device_register();\n ....\n\t\t\t\t\t\tfd = sys_open(“/path/to/dev”); // abre el descriptor de archivo hackrf\n\t\t\t\t\t\t....\n v4l2_device_unregister();\n ....\n kfree(); // libera hackrf_dev\n ....\n\t\t\t\t\t\tsys_ioctl(fd, ...);\n\t\t\t\t\t\t v4l2_ioctl();\n\t\t\t\t\t\t video_is_registered() // ¡¡UAF!!\n\t\t\t\t\t\t....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t v4l2_release() // ¡¡UAF!!\n\t\t\t\t\t\t hackrf_video_release()\n\t\t\t\t\t\t kfree(); // ¡¡DFB!!\n”””\n\nCuando un dispositivo V4L2 o de video es dado de baja, el nodo del dispositivo es eliminado, por lo que las nuevas llamadas a open() son bloqueadas.\n\nSin embargo, los descriptores de archivo que ya están abiertos -y cualquier E/S en curso- no terminan inmediatamente; permanecen válidos hasta que la última referencia es liberada y se invoca el release() del controlador.\n\nPor lo tanto, liberar la memoria del dispositivo en la ruta de error después de que hackrf_probe() ha registrado el dispositivo conducirá a una condición de carrera de vulnerabilidad de uso después de liberación, ya que esos manejadores ya abiertos aún no han sido liberados.\n\nY dado que release() también libera memoria, ocurren una condición de carrera de uso después de liberación y una vulnerabilidad de doble liberación.\n\nPara evitar esto, si el dispositivo es registrado desde probe(), debería modificarse para liberar memoria solo a través de release() en lugar de llamar a kfree() directamente."}],"id":"CVE-2026-31576","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:32.230","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31577.json b/data/2026/CVE-2026-31577.json index d5b352fc64..c13be6a585 100644 --- a/data/2026/CVE-2026-31577.json +++ b/data/2026/CVE-2026-31577.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/nilfs2/dat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6637bbcfb59df5b732a79e5ab1a74886a0b93d59","status":"affected","version":"d626fcdabea2258be395a775bdbe09270e9bf73d","versionType":"git"},{"lessThan":"837c7a59fb58f81b0db33848357f6a5d0d1250ad","status":"affected","version":"d05cc5395e36711edad8bdef6945f138d8a7097b","versionType":"git"},{"lessThan":"7902b1df1520a0880bcda7a3704cfacd17905a83","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"lessThan":"7318e3549518ce8f14776a489d86488d80d7e2c8","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"lessThan":"449ec5fc99f45974525ba9eea16b6670c45cd363","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"lessThan":"c36e206f302f1ddefed92d09ecbba070e1ae079e","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"lessThan":"41de342278ae025c99cc8d33648773f05e306cf1","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"lessThan":"97fb7afec404912d967a7d4715f37742666b3084","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"lessThan":"4a4e0328edd9e9755843787d28f16dd4165f8b48","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"status":"affected","version":"6c3da8c0a35bbafe359d9166269d5590f29664de","versionType":"git"},{"status":"affected","version":"605babb979c213737618b1c837e89624e5ab11fd","versionType":"git"},{"status":"affected","version":"307d021b1a7f33048b624f7aaeaa75e3eae571f1","versionType":"git"},{"status":"affected","version":"1829b24a36ca12ca95b96d5478faeff40c17f2b6","versionType":"git"},{"lessThan":"5.10.258","status":"affected","version":"5.10.118","versionType":"semver"},{"lessThan":"5.15.209","status":"affected","version":"5.15.42","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.296","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.245","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.196","versionType":"semver"},{"lessThan":"5.18","status":"affected","version":"5.17.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/nilfs2/dat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map\n\nThe DAT inode's btree node cache (i_assoc_inode) is initialized lazily\nduring btree operations. However, nilfs_mdt_save_to_shadow_map()\nassumes i_assoc_inode is already initialized when copying dirty pages\nto the shadow map during GC.\n\nIf NILFS_IOCTL_CLEAN_SEGMENTS is called immediately after mount before\nany btree operation has occurred on the DAT inode, i_assoc_inode is\nNULL leading to a general protection fault.\n\nFix this by calling nilfs_attach_btree_node_cache() on the DAT inode\nin nilfs_dat_read() at mount time, ensuring i_assoc_inode is always\ninitialized before any GC operation can use it."}],"id":"CVE-2026-31577","lastModified":"2026-06-17T10:34:00.707","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:32.347","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/41de342278ae025c99cc8d33648773f05e306cf1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/449ec5fc99f45974525ba9eea16b6670c45cd363"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4a4e0328edd9e9755843787d28f16dd4165f8b48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6637bbcfb59df5b732a79e5ab1a74886a0b93d59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7318e3549518ce8f14776a489d86488d80d7e2c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7902b1df1520a0880bcda7a3704cfacd17905a83"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/837c7a59fb58f81b0db33848357f6a5d0d1250ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/97fb7afec404912d967a7d4715f37742666b3084"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c36e206f302f1ddefed92d09ecbba070e1ae079e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/nilfs2/dat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6637bbcfb59df5b732a79e5ab1a74886a0b93d59","status":"affected","version":"d626fcdabea2258be395a775bdbe09270e9bf73d","versionType":"git"},{"lessThan":"837c7a59fb58f81b0db33848357f6a5d0d1250ad","status":"affected","version":"d05cc5395e36711edad8bdef6945f138d8a7097b","versionType":"git"},{"lessThan":"7902b1df1520a0880bcda7a3704cfacd17905a83","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"lessThan":"7318e3549518ce8f14776a489d86488d80d7e2c8","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"lessThan":"449ec5fc99f45974525ba9eea16b6670c45cd363","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"lessThan":"c36e206f302f1ddefed92d09ecbba070e1ae079e","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"lessThan":"41de342278ae025c99cc8d33648773f05e306cf1","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"lessThan":"97fb7afec404912d967a7d4715f37742666b3084","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"lessThan":"4a4e0328edd9e9755843787d28f16dd4165f8b48","status":"affected","version":"e897be17a441fa637cd166fc3de1445131e57692","versionType":"git"},{"status":"affected","version":"6c3da8c0a35bbafe359d9166269d5590f29664de","versionType":"git"},{"status":"affected","version":"605babb979c213737618b1c837e89624e5ab11fd","versionType":"git"},{"status":"affected","version":"307d021b1a7f33048b624f7aaeaa75e3eae571f1","versionType":"git"},{"status":"affected","version":"1829b24a36ca12ca95b96d5478faeff40c17f2b6","versionType":"git"},{"lessThan":"5.10.258","status":"affected","version":"5.10.118","versionType":"semver"},{"lessThan":"5.15.209","status":"affected","version":"5.15.42","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.296","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.245","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.196","versionType":"semver"},{"lessThan":"5.18","status":"affected","version":"5.17.10","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/nilfs2/dat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map\n\nThe DAT inode's btree node cache (i_assoc_inode) is initialized lazily\nduring btree operations. However, nilfs_mdt_save_to_shadow_map()\nassumes i_assoc_inode is already initialized when copying dirty pages\nto the shadow map during GC.\n\nIf NILFS_IOCTL_CLEAN_SEGMENTS is called immediately after mount before\nany btree operation has occurred on the DAT inode, i_assoc_inode is\nNULL leading to a general protection fault.\n\nFix this by calling nilfs_attach_btree_node_cache() on the DAT inode\nin nilfs_dat_read() at mount time, ensuring i_assoc_inode is always\ninitialized before any GC operation can use it."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnilfs2: corrección de la desreferencia de i_assoc_inode NULL en nilfs_mdt_save_to_shadow_map\n\nLa caché de nodos btree del inodo DAT (i_assoc_inode) se inicializa de forma perezosa durante las operaciones btree. Sin embargo, nilfs_mdt_save_to_shadow_map() asume que i_assoc_inode ya está inicializado al copiar páginas sucias al mapa de sombra durante la GC.\n\nSi se llama a NILFS_IOCTL_CLEAN_SEGMENTS inmediatamente después del montaje antes de que haya ocurrido cualquier operación btree en el inodo DAT, i_assoc_inode es NULL, lo que lleva a un fallo de protección general.\n\nEsto se soluciona llamando a nilfs_attach_btree_node_cache() en el inodo DAT en nilfs_dat_read() en el momento del montaje, asegurando que i_assoc_inode siempre esté inicializado antes de que cualquier operación de GC pueda usarlo."}],"id":"CVE-2026-31577","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:32.347","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/41de342278ae025c99cc8d33648773f05e306cf1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/449ec5fc99f45974525ba9eea16b6670c45cd363"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4a4e0328edd9e9755843787d28f16dd4165f8b48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6637bbcfb59df5b732a79e5ab1a74886a0b93d59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7318e3549518ce8f14776a489d86488d80d7e2c8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7902b1df1520a0880bcda7a3704cfacd17905a83"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/837c7a59fb58f81b0db33848357f6a5d0d1250ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/97fb7afec404912d967a7d4715f37742666b3084"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c36e206f302f1ddefed92d09ecbba070e1ae079e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31578.json b/data/2026/CVE-2026-31578.json index 2412323944..6c77d2ce7c 100644 --- a/data/2026/CVE-2026-31578.json +++ b/data/2026/CVE-2026-31578.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/usb/as102/as102_usb_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0d36653a3a821e5a974798adb347b3ea09332914","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"25d500cf391e384356a612b85cf60b353ad3cd0c","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"07ceb444c8f627cf863864d4274b5a77769725ed","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"cb8092038e95dc1113a68e63762de40fff61ba71","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"582fbecb3756330006fe1950762412a68c2cacd2","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"09e9206008b887aa553733bd915d73131071a086","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"2eeae47a438694408189138048a786be99954032","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"7e5aedf6059cba2a669d86caeaf5a51f33ec85a1","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/usb/as102/as102_usb_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.14"},{"lessThan":"3.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: as102: fix to not free memory after the device is registered in as102_usb_probe()\n\nIn as102_usb driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nas102_usb_probe()\n kzalloc(); // alloc as102_dev_t\n ....\n usb_register_dev();\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open as102 fd\n\t\t\t\t\t\t....\n usb_deregister_dev();\n ....\n kfree(); // free as102_dev_t\n ....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t as102_release() // UAF!!\n\t\t\t\t\t\t as102_usb_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a USB character device registered with usb_register_dev() is later\nunregistered (via usb_deregister_dev() or disconnect), the device node is\nremoved so new open() calls fail. However, file descriptors that are\nalready open do not go away immediately: they remain valid until the last\nreference is dropped and the driver's .release() is invoked.\n\nIn as102, as102_usb_probe() calls usb_register_dev() and then, on an\nerror path, does usb_deregister_dev() and frees as102_dev_t right away.\nIf userspace raced a successful open() before the deregistration, that\nopen FD will later hit as102_release() --> as102_usb_release() and access\nor free as102_dev_t again, occur a race to use-after-free and\ndouble-free vuln.\n\nThe fix is to never kfree(as102_dev_t) directly once usb_register_dev()\nhas succeeded. After deregistration, defer freeing memory to .release().\n\nIn other words, let release() perform the last kfree when the final open\nFD is closed."}],"id":"CVE-2026-31578","lastModified":"2026-06-17T10:34:00.887","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:32.480","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/07ceb444c8f627cf863864d4274b5a77769725ed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09e9206008b887aa553733bd915d73131071a086"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0d36653a3a821e5a974798adb347b3ea09332914"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/25d500cf391e384356a612b85cf60b353ad3cd0c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2eeae47a438694408189138048a786be99954032"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/582fbecb3756330006fe1950762412a68c2cacd2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e5aedf6059cba2a669d86caeaf5a51f33ec85a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cb8092038e95dc1113a68e63762de40fff61ba71"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/usb/as102/as102_usb_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0d36653a3a821e5a974798adb347b3ea09332914","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"25d500cf391e384356a612b85cf60b353ad3cd0c","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"07ceb444c8f627cf863864d4274b5a77769725ed","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"cb8092038e95dc1113a68e63762de40fff61ba71","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"582fbecb3756330006fe1950762412a68c2cacd2","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"09e9206008b887aa553733bd915d73131071a086","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"2eeae47a438694408189138048a786be99954032","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"7e5aedf6059cba2a669d86caeaf5a51f33ec85a1","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"},{"lessThan":"8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c","status":"affected","version":"cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/usb/as102/as102_usb_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.14"},{"lessThan":"3.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: as102: fix to not free memory after the device is registered in as102_usb_probe()\n\nIn as102_usb driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nas102_usb_probe()\n kzalloc(); // alloc as102_dev_t\n ....\n usb_register_dev();\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open as102 fd\n\t\t\t\t\t\t....\n usb_deregister_dev();\n ....\n kfree(); // free as102_dev_t\n ....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t as102_release() // UAF!!\n\t\t\t\t\t\t as102_usb_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a USB character device registered with usb_register_dev() is later\nunregistered (via usb_deregister_dev() or disconnect), the device node is\nremoved so new open() calls fail. However, file descriptors that are\nalready open do not go away immediately: they remain valid until the last\nreference is dropped and the driver's .release() is invoked.\n\nIn as102, as102_usb_probe() calls usb_register_dev() and then, on an\nerror path, does usb_deregister_dev() and frees as102_dev_t right away.\nIf userspace raced a successful open() before the deregistration, that\nopen FD will later hit as102_release() --> as102_usb_release() and access\nor free as102_dev_t again, occur a race to use-after-free and\ndouble-free vuln.\n\nThe fix is to never kfree(as102_dev_t) directly once usb_register_dev()\nhas succeeded. After deregistration, defer freeing memory to .release().\n\nIn other words, let release() perform the last kfree when the final open\nFD is closed."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: as102: corrección para no liberar memoria después de que el dispositivo es registrado en as102_usb_probe()\n\nEn el controlador as102_usb, la siguiente condición de carrera ocurre:\n””“\n\t\tCPU0\t\t\t\t\t\tCPU1\nas102_usb_probe()\n kzalloc(); // alloc as102_dev_t\n ....\n usb_register_dev();\n\t\t\t\t\t\tfd = sys_open(“/path/to/dev”); // open as102 fd\n\t\t\t\t\t\t....\n usb_deregister_dev();\n ....\n kfree(); // free as102_dev_t\n ....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t as102_release() // UAF!!\n\t\t\t\t\t\t as102_usb_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n”””\n\nCuando un dispositivo de caracteres USB registrado con usb_register_dev() es posteriormente desregistrado (a través de usb_deregister_dev() o desconexión), el nodo del dispositivo es eliminado por lo que las nuevas llamadas a open() fallan. Sin embargo, los descriptores de archivo que ya están abiertos no desaparecen inmediatamente: permanecen válidos hasta que la última referencia es eliminada y se invoca el .release() del controlador.\n\nEn as102, as102_usb_probe() llama a usb_register_dev() y luego, en una ruta de error, hace usb_deregister_dev() y libera as102_dev_t de inmediato. Si el espacio de usuario compitió con un open() exitoso antes del desregistro, ese FD abierto posteriormente alcanzará as102_release() - as102_usb_release() y accederá o liberará as102_dev_t de nuevo, ocurrirá una condición de carrera de uso después de liberación y una vulnerabilidad de doble liberación.\n\nLa corrección es nunca kfree(as102_dev_t) directamente una vez que usb_register_dev() ha tenido éxito. Después del desregistro, diferir la liberación de memoria a .release().\n\nEn otras palabras, dejar que release() realice el último kfree cuando el FD abierto final es cerrado."}],"id":"CVE-2026-31578","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:32.480","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/07ceb444c8f627cf863864d4274b5a77769725ed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09e9206008b887aa553733bd915d73131071a086"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0d36653a3a821e5a974798adb347b3ea09332914"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/25d500cf391e384356a612b85cf60b353ad3cd0c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2eeae47a438694408189138048a786be99954032"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/582fbecb3756330006fe1950762412a68c2cacd2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e5aedf6059cba2a669d86caeaf5a51f33ec85a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cb8092038e95dc1113a68e63762de40fff61ba71"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31579.json b/data/2026/CVE-2026-31579.json index 7712a17335..a6e0fca476 100644 --- a/data/2026/CVE-2026-31579.json +++ b/data/2026/CVE-2026-31579.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireguard/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"707607db2193591b68c0e70f814133472c185b1e","status":"affected","version":"900575aa33a3eaaef802b31de187a85c4a4b4bd0","versionType":"git"},{"lessThan":"9a9e69155b2091b8297afaf1533b8d68a3096841","status":"affected","version":"900575aa33a3eaaef802b31de187a85c4a4b4bd0","versionType":"git"},{"lessThan":"1c52ef00e391144334f10995985c2f256d4be982","status":"affected","version":"900575aa33a3eaaef802b31de187a85c4a4b4bd0","versionType":"git"},{"lessThan":"a1d0f6cbb962af29586e3e65a4bced1a5e39221f","status":"affected","version":"900575aa33a3eaaef802b31de187a85c4a4b4bd0","versionType":"git"},{"lessThan":"60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","status":"affected","version":"900575aa33a3eaaef802b31de187a85c4a4b4bd0","versionType":"git"},{"status":"affected","version":"363cc6efdbb54bb06cd5034a69b41aae974a736f","versionType":"git"},{"lessThan":"5.8","status":"affected","version":"5.7.7","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireguard/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E7BFA239-2F39-4B24-92AA-6F60AA187C18","versionEndExcluding":"6.18.24","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit\n\nwg_netns_pre_exit() manually acquires rtnl_lock() inside the\npernet .pre_exit callback. This causes a hung task when another\nthread holds rtnl_mutex - the cleanup_net workqueue (or the\nsetup_net failure rollback path) blocks indefinitely in\nwg_netns_pre_exit() waiting to acquire the lock.\n\nConvert to .exit_rtnl, introduced in commit 7a60d91c690b (\"net:\nAdd ->exit_rtnl() hook to struct pernet_operations.\"), where the\nframework already holds RTNL and batches all callbacks under a\nsingle rtnl_lock()/rtnl_unlock() pair, eliminating the contention\nwindow.\n\nThe rcu_assign_pointer(wg->creating_net, NULL) is safe to move\nfrom .pre_exit to .exit_rtnl (which runs after synchronize_rcu())\nbecause all RCU readers of creating_net either use maybe_get_net()\n- which returns NULL for a dying namespace with zero refcount - or\naccess net->user_ns which remains valid throughout the entire\nops_undo_list sequence.\n\n[ Jason: added __net_exit and __read_mostly annotations that were missing. ]"}],"id":"CVE-2026-31579","lastModified":"2026-11-05T22:18:41.440","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31579","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:40.854579Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:32.587","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c52ef00e391144334f10995985c2f256d4be982"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/707607db2193591b68c0e70f814133472c185b1e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a9e69155b2091b8297afaf1533b8d68a3096841"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a1d0f6cbb962af29586e3e65a4bced1a5e39221f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireguard/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"707607db2193591b68c0e70f814133472c185b1e","status":"affected","version":"900575aa33a3eaaef802b31de187a85c4a4b4bd0","versionType":"git"},{"lessThan":"9a9e69155b2091b8297afaf1533b8d68a3096841","status":"affected","version":"900575aa33a3eaaef802b31de187a85c4a4b4bd0","versionType":"git"},{"lessThan":"1c52ef00e391144334f10995985c2f256d4be982","status":"affected","version":"900575aa33a3eaaef802b31de187a85c4a4b4bd0","versionType":"git"},{"lessThan":"a1d0f6cbb962af29586e3e65a4bced1a5e39221f","status":"affected","version":"900575aa33a3eaaef802b31de187a85c4a4b4bd0","versionType":"git"},{"lessThan":"60a25ef8dacb3566b1a8c4de00572a498e2a3bf9","status":"affected","version":"900575aa33a3eaaef802b31de187a85c4a4b4bd0","versionType":"git"},{"status":"affected","version":"363cc6efdbb54bb06cd5034a69b41aae974a736f","versionType":"git"},{"lessThan":"5.8","status":"affected","version":"5.7.7","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireguard/device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.8"},{"lessThan":"5.8","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E7BFA239-2F39-4B24-92AA-6F60AA187C18","versionEndExcluding":"6.18.24","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit\n\nwg_netns_pre_exit() manually acquires rtnl_lock() inside the\npernet .pre_exit callback. This causes a hung task when another\nthread holds rtnl_mutex - the cleanup_net workqueue (or the\nsetup_net failure rollback path) blocks indefinitely in\nwg_netns_pre_exit() waiting to acquire the lock.\n\nConvert to .exit_rtnl, introduced in commit 7a60d91c690b (\"net:\nAdd ->exit_rtnl() hook to struct pernet_operations.\"), where the\nframework already holds RTNL and batches all callbacks under a\nsingle rtnl_lock()/rtnl_unlock() pair, eliminating the contention\nwindow.\n\nThe rcu_assign_pointer(wg->creating_net, NULL) is safe to move\nfrom .pre_exit to .exit_rtnl (which runs after synchronize_rcu())\nbecause all RCU readers of creating_net either use maybe_get_net()\n- which returns NULL for a dying namespace with zero refcount - or\naccess net->user_ns which remains valid throughout the entire\nops_undo_list sequence.\n\n[ Jason: added __net_exit and __read_mostly annotations that were missing. ]"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwireguard: dispositivo: usar la devolución de llamada exit_rtnl en lugar de rtnl_lock manual en pre_exit\n\nwg_netns_pre_exit() adquiere manualmente rtnl_lock() dentro de la devolución de llamada .pre_exit de pernet. Esto causa una tarea colgada cuando otro hilo mantiene rtnl_mutex - la cola de trabajo cleanup_net (o la ruta de reversión de fallos de setup_net) se bloquea indefinidamente en wg_netns_pre_exit() esperando adquirir el bloqueo.\n\nConvertir a .exit_rtnl, introducido en el commit 7a60d91c690b (’net: Añadir el hook -> exit_rtnl() a la estructura pernet_operations.’), donde el framework ya mantiene RTNL y agrupa todas las devoluciones de llamada bajo un único par rtnl_lock()/rtnl_unlock(), eliminando la ventana de contención.\n\nEl rcu_assign_pointer(wg -> creating_net, NULL) es seguro moverlo de .pre_exit a .exit_rtnl (que se ejecuta después de synchronize_rcu()) porque todos los lectores RCU de creating_net o usan maybe_get_net() - que devuelve NULL para un espacio de nombres moribundo con recuento de referencias cero - o acceden a net -> user_ns que permanece válido durante toda la secuencia ops_undo_list.\n\n[ Jason: añadió las anotaciones __net_exit y __read_mostly que faltaban. ]"}],"id":"CVE-2026-31579","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31579","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:40.854579Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:32.587","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c52ef00e391144334f10995985c2f256d4be982"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/60a25ef8dacb3566b1a8c4de00572a498e2a3bf9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/707607db2193591b68c0e70f814133472c185b1e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a9e69155b2091b8297afaf1533b8d68a3096841"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a1d0f6cbb962af29586e3e65a4bced1a5e39221f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31580.json b/data/2026/CVE-2026-31580.json index 17ad6fea82..5d07f6fd03 100644 --- a/data/2026/CVE-2026-31580.json +++ b/data/2026/CVE-2026-31580.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/md/bcache/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"81f44ed8c3f54abb7561ece774ea4cca5070b2f2","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"f50e7c325ab1207fe941555bcff659f6d7050572","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"9467d360be70e6ee55b0c1cd2a1f1424f57b5b85","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"add4982510f3b7c318a2dd7438bdc9c63171e753","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"2d6965581e164fa2ba3f7652ddae5535f6336576","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"4f71c8ba2dc009042493021d94a9718fbe2ebf27","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"fec114a98b8735ee89c75216c45a78e28be0f128","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/md/bcache/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.10"},{"lessThan":"3.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452] blk_update_request+0x14e/0x370\n[6888366.280561] blk_mq_end_request+0x1a/0x130\n[6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903] __complete_request+0x22/0x70 [libceph]\n[6888366.281032] osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164] ? inet_recvmsg+0x5b/0xd0\n[6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405] ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661] ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc->sb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime. If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made."}],"id":"CVE-2026-31580","lastModified":"2026-11-05T22:18:41.593","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:46.970760Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:32.683","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2d6965581e164fa2ba3f7652ddae5535f6336576"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f71c8ba2dc009042493021d94a9718fbe2ebf27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/81f44ed8c3f54abb7561ece774ea4cca5070b2f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9467d360be70e6ee55b0c1cd2a1f1424f57b5b85"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/add4982510f3b7c318a2dd7438bdc9c63171e753"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f50e7c325ab1207fe941555bcff659f6d7050572"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fec114a98b8735ee89c75216c45a78e28be0f128"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/md/bcache/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"81f44ed8c3f54abb7561ece774ea4cca5070b2f2","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"f50e7c325ab1207fe941555bcff659f6d7050572","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"9467d360be70e6ee55b0c1cd2a1f1424f57b5b85","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"add4982510f3b7c318a2dd7438bdc9c63171e753","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"2d6965581e164fa2ba3f7652ddae5535f6336576","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"4f71c8ba2dc009042493021d94a9718fbe2ebf27","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"},{"lessThan":"fec114a98b8735ee89c75216c45a78e28be0f128","status":"affected","version":"cafe563591446cf80bfbc2fe3bc72a2e36cf1060","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/md/bcache/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.10"},{"lessThan":"3.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452] blk_update_request+0x14e/0x370\n[6888366.280561] blk_mq_end_request+0x1a/0x130\n[6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903] __complete_request+0x22/0x70 [libceph]\n[6888366.281032] osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164] ? inet_recvmsg+0x5b/0xd0\n[6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405] ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661] ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc->sb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime. If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbcache: corrige el uso después de liberación de cached_dev.sb_bio y la caída\n\nEn nuestro entorno de producción, hemos recibido múltiples informes de caídas relacionados con libceph, que han llamado nuestra atención:\n\n””“\n[6888366.280350] Call Trace:\n[6888366.280452] blk_update_request+0x14e/0x370\n[6888366.280561] blk_mq_end_request+0x1a/0x130\n[6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903] __complete_request+0x22/0x70 [libceph]\n[6888366.281032] osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164] ? inet_recvmsg+0x5b/0xd0\n[6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405] ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661] ceph_con_workfn+0x329/0x680 [libceph]\n”””\n\nDespués de analizar el archivo coredump, encontramos que la dirección de dc -> sb_bio ha sido liberada. Sabemos que cached_dev solo se libera cuando se detiene.\n\nDado que sb_bio es parte de la estructura cached_dev, en lugar de una asignación cada vez. Si el dispositivo se detiene mientras se escribe en el superbloque, la dirección liberada será accedida en endio.\n\nEste parche espera a que sb_write se complete en cached_dev_free.\n\nCabe señalar que analizamos la causa del problema, luego contamos todos los detalles a QWEN y adoptamos las modificaciones que realizó."}],"id":"CVE-2026-31580","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31580","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T21:39:46.970760Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:32.683","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2d6965581e164fa2ba3f7652ddae5535f6336576"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f71c8ba2dc009042493021d94a9718fbe2ebf27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/81f44ed8c3f54abb7561ece774ea4cca5070b2f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9467d360be70e6ee55b0c1cd2a1f1424f57b5b85"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/add4982510f3b7c318a2dd7438bdc9c63171e753"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f50e7c325ab1207fe941555bcff659f6d7050572"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fec114a98b8735ee89c75216c45a78e28be0f128"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31581.json b/data/2026/CVE-2026-31581.json index f691cd0777..92f62e2bd5 100644 --- a/data/2026/CVE-2026-31581.json +++ b/data/2026/CVE-2026-31581.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/6fire/chip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e719232f4552e29de8027a83918ea94434be87af","status":"affected","version":"f2d06d4e129e2508e356136f99bb20a332ff1a00","versionType":"git"},{"lessThan":"e247a0e01d15ed420f77ec5e2335721bf430a5b3","status":"affected","version":"b889a7d68d7e76b8795b754a75c91a2d561d5e8c","versionType":"git"},{"lessThan":"ba88461f7653636c48321ca993006a74724c2f41","status":"affected","version":"ea8cc56db659cf0ae57073e32a4735ead7bd7ee3","versionType":"git"},{"lessThan":"e88354b381e2006de63d6b052ed7005c9a47d00e","status":"affected","version":"b754e831a94f82f2593af806741392903f359168","versionType":"git"},{"lessThan":"af75b486f7e883e3422ece23c8d727e6815144a0","status":"affected","version":"57860a80f03f9dc69a34a5c37b0941ad032a0a8c","versionType":"git"},{"lessThan":"d21e8a2af4869b5890b34e081d5aeadc93e9cd5c","status":"affected","version":"a0810c3d6dd2d29a9b92604d682eacd2902ce947","versionType":"git"},{"lessThan":"3dc20d1981d6a67d8184498a5da272942dde1e65","status":"affected","version":"a0810c3d6dd2d29a9b92604d682eacd2902ce947","versionType":"git"},{"lessThan":"51f6532790b74ffdd6970bc848358a2838c1c185","status":"affected","version":"a0810c3d6dd2d29a9b92604d682eacd2902ce947","versionType":"git"},{"lessThan":"b9c826916fdce6419b94eb0cd8810fdac18c2386","status":"affected","version":"a0810c3d6dd2d29a9b92604d682eacd2902ce947","versionType":"git"},{"status":"affected","version":"74357d0b5cd3ef544752bc9f21cbeee4902fae6c","versionType":"git"},{"status":"affected","version":"273eec23467dfbfbd0e4c10302579ba441fb1e13","versionType":"git"},{"status":"affected","version":"0df7f4b5cc10f5adf98be0845372e9eef7bb5b09","versionType":"git"},{"lessThan":"5.10.258","status":"affected","version":"5.10.231","versionType":"semver"},{"lessThan":"5.15.209","status":"affected","version":"5.15.174","versionType":"semver"},{"lessThan":"6.1.175","status":"affected","version":"6.1.120","versionType":"semver"},{"lessThan":"6.6.136","status":"affected","version":"6.6.64","versionType":"semver"},{"lessThan":"6.12.83","status":"affected","version":"6.12.2","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.325","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.287","versionType":"semver"},{"lessThan":"6.12","status":"affected","version":"6.11.11","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/usb/6fire/chip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix use-after-free on disconnect\n\nIn usb6fire_chip_abort(), the chip struct is allocated as the card's\nprivate data (via snd_card_new with sizeof(struct sfire_chip)). When\nsnd_card_free_when_closed() is called and no file handles are open, the\ncard and embedded chip are freed synchronously. The subsequent\nchip->card = NULL write then hits freed slab memory.\n\nCall trace:\n usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]\n usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182\n usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458\n ...\n hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953\n\nFix by moving the card lifecycle out of usb6fire_chip_abort() and into\nusb6fire_chip_disconnect(). The card pointer is saved in a local\nbefore any teardown, snd_card_disconnect() is called first to prevent\nnew opens, URBs are aborted while chip is still valid, and\nsnd_card_free_when_closed() is called last so chip is never accessed\nafter the card may be freed."}],"id":"CVE-2026-31581","lastModified":"2026-06-17T10:34:01.257","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:32.797","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3dc20d1981d6a67d8184498a5da272942dde1e65"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51f6532790b74ffdd6970bc848358a2838c1c185"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/af75b486f7e883e3422ece23c8d727e6815144a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b9c826916fdce6419b94eb0cd8810fdac18c2386"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ba88461f7653636c48321ca993006a74724c2f41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d21e8a2af4869b5890b34e081d5aeadc93e9cd5c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e247a0e01d15ed420f77ec5e2335721bf430a5b3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e719232f4552e29de8027a83918ea94434be87af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e88354b381e2006de63d6b052ed7005c9a47d00e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/6fire/chip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e719232f4552e29de8027a83918ea94434be87af","status":"affected","version":"f2d06d4e129e2508e356136f99bb20a332ff1a00","versionType":"git"},{"lessThan":"e247a0e01d15ed420f77ec5e2335721bf430a5b3","status":"affected","version":"b889a7d68d7e76b8795b754a75c91a2d561d5e8c","versionType":"git"},{"lessThan":"ba88461f7653636c48321ca993006a74724c2f41","status":"affected","version":"ea8cc56db659cf0ae57073e32a4735ead7bd7ee3","versionType":"git"},{"lessThan":"e88354b381e2006de63d6b052ed7005c9a47d00e","status":"affected","version":"b754e831a94f82f2593af806741392903f359168","versionType":"git"},{"lessThan":"af75b486f7e883e3422ece23c8d727e6815144a0","status":"affected","version":"57860a80f03f9dc69a34a5c37b0941ad032a0a8c","versionType":"git"},{"lessThan":"d21e8a2af4869b5890b34e081d5aeadc93e9cd5c","status":"affected","version":"a0810c3d6dd2d29a9b92604d682eacd2902ce947","versionType":"git"},{"lessThan":"3dc20d1981d6a67d8184498a5da272942dde1e65","status":"affected","version":"a0810c3d6dd2d29a9b92604d682eacd2902ce947","versionType":"git"},{"lessThan":"51f6532790b74ffdd6970bc848358a2838c1c185","status":"affected","version":"a0810c3d6dd2d29a9b92604d682eacd2902ce947","versionType":"git"},{"lessThan":"b9c826916fdce6419b94eb0cd8810fdac18c2386","status":"affected","version":"a0810c3d6dd2d29a9b92604d682eacd2902ce947","versionType":"git"},{"status":"affected","version":"74357d0b5cd3ef544752bc9f21cbeee4902fae6c","versionType":"git"},{"status":"affected","version":"273eec23467dfbfbd0e4c10302579ba441fb1e13","versionType":"git"},{"status":"affected","version":"0df7f4b5cc10f5adf98be0845372e9eef7bb5b09","versionType":"git"},{"lessThan":"5.10.258","status":"affected","version":"5.10.231","versionType":"semver"},{"lessThan":"5.15.209","status":"affected","version":"5.15.174","versionType":"semver"},{"lessThan":"6.1.175","status":"affected","version":"6.1.120","versionType":"semver"},{"lessThan":"6.6.136","status":"affected","version":"6.6.64","versionType":"semver"},{"lessThan":"6.12.83","status":"affected","version":"6.12.2","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.325","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.287","versionType":"semver"},{"lessThan":"6.12","status":"affected","version":"6.11.11","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/usb/6fire/chip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix use-after-free on disconnect\n\nIn usb6fire_chip_abort(), the chip struct is allocated as the card's\nprivate data (via snd_card_new with sizeof(struct sfire_chip)). When\nsnd_card_free_when_closed() is called and no file handles are open, the\ncard and embedded chip are freed synchronously. The subsequent\nchip->card = NULL write then hits freed slab memory.\n\nCall trace:\n usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]\n usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182\n usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458\n ...\n hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953\n\nFix by moving the card lifecycle out of usb6fire_chip_abort() and into\nusb6fire_chip_disconnect(). The card pointer is saved in a local\nbefore any teardown, snd_card_disconnect() is called first to prevent\nnew opens, URBs are aborted while chip is still valid, and\nsnd_card_free_when_closed() is called last so chip is never accessed\nafter the card may be freed."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: 6fire: corregir uso después de liberación al desconectar\n\nEn usb6fire_chip_abort(), la estructura chip se asigna como datos privados de la tarjeta (a través de snd_card_new con sizeof(struct sfire_chip)). Cuando se llama a snd_card_free_when_closed() y no hay descriptores de archivo abiertos, la tarjeta y el chip incrustado se liberan sincrónicamente. La escritura posterior de chip -> card = NULL entonces accede a memoria slab liberada.\n\nTraza de llamada:\n usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]\n usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182\n usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458\n ...\n hub_event+0x 1a04/0x 4518 drivers/usb/core/hub.c:5953\n\nSolución moviendo el ciclo de vida de la tarjeta fuera de usb6fire_chip_abort() y hacia usb6fire_chip_disconnect(). El puntero de la tarjeta se guarda en una variable local antes de cualquier desmantelamiento, se llama primero a snd_card_disconnect() para evitar nuevas aperturas, los URB se abortan mientras el chip sigue siendo válido, y se llama a snd_card_free_when_closed() al final para que el chip nunca sea accedido después de que la tarjeta pueda ser liberada."}],"id":"CVE-2026-31581","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:32.797","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3dc20d1981d6a67d8184498a5da272942dde1e65"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51f6532790b74ffdd6970bc848358a2838c1c185"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/af75b486f7e883e3422ece23c8d727e6815144a0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b9c826916fdce6419b94eb0cd8810fdac18c2386"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ba88461f7653636c48321ca993006a74724c2f41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d21e8a2af4869b5890b34e081d5aeadc93e9cd5c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e247a0e01d15ed420f77ec5e2335721bf430a5b3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e719232f4552e29de8027a83918ea94434be87af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e88354b381e2006de63d6b052ed7005c9a47d00e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31582.json b/data/2026/CVE-2026-31582.json index f799972b87..0c0a329f83 100644 --- a/data/2026/CVE-2026-31582.json +++ b/data/2026/CVE-2026-31582.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hwmon/powerz.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c78e1d4e48f23792adaa7c94251e22b0d9700a39","status":"affected","version":"4381a36abdf1c5c0323c1c51f869dc000115eb20","versionType":"git"},{"lessThan":"9e1b798257f96d2e2a2639830eb71add545ce749","status":"affected","version":"4381a36abdf1c5c0323c1c51f869dc000115eb20","versionType":"git"},{"lessThan":"7003ae4810ca83f0ddca85b768500e313c4b998c","status":"affected","version":"4381a36abdf1c5c0323c1c51f869dc000115eb20","versionType":"git"},{"lessThan":"61f2aa23b0ce8d7aa5071ed25a7471e246a4fdd4","status":"affected","version":"4381a36abdf1c5c0323c1c51f869dc000115eb20","versionType":"git"},{"lessThan":"08e57f5e1a9067d5fbf33993aa7f51d60b3d13a4","status":"affected","version":"4381a36abdf1c5c0323c1c51f869dc000115eb20","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hwmon/powerz.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5F48A7A3-A02D-414E-944C-F8E2615861D4","versionEndExcluding":"6.12.83","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (powerz) Fix use-after-free on USB disconnect\n\nAfter powerz_disconnect() frees the URB and releases the mutex, a\nsubsequent powerz_read() call can acquire the mutex and call\npowerz_read_data(), which dereferences the freed URB pointer.\n\nFix by:\n - Setting priv->urb to NULL in powerz_disconnect() so that\n powerz_read_data() can detect the disconnected state.\n - Adding a !priv->urb check at the start of powerz_read_data()\n to return -ENODEV on a disconnected device.\n - Moving usb_set_intfdata() before hwmon registration so the\n disconnect handler can always find the priv pointer."}],"id":"CVE-2026-31582","lastModified":"2026-06-17T10:34:01.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:32.903","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08e57f5e1a9067d5fbf33993aa7f51d60b3d13a4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/61f2aa23b0ce8d7aa5071ed25a7471e246a4fdd4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7003ae4810ca83f0ddca85b768500e313c4b998c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e1b798257f96d2e2a2639830eb71add545ce749"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c78e1d4e48f23792adaa7c94251e22b0d9700a39"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hwmon/powerz.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c78e1d4e48f23792adaa7c94251e22b0d9700a39","status":"affected","version":"4381a36abdf1c5c0323c1c51f869dc000115eb20","versionType":"git"},{"lessThan":"9e1b798257f96d2e2a2639830eb71add545ce749","status":"affected","version":"4381a36abdf1c5c0323c1c51f869dc000115eb20","versionType":"git"},{"lessThan":"7003ae4810ca83f0ddca85b768500e313c4b998c","status":"affected","version":"4381a36abdf1c5c0323c1c51f869dc000115eb20","versionType":"git"},{"lessThan":"61f2aa23b0ce8d7aa5071ed25a7471e246a4fdd4","status":"affected","version":"4381a36abdf1c5c0323c1c51f869dc000115eb20","versionType":"git"},{"lessThan":"08e57f5e1a9067d5fbf33993aa7f51d60b3d13a4","status":"affected","version":"4381a36abdf1c5c0323c1c51f869dc000115eb20","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hwmon/powerz.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5F48A7A3-A02D-414E-944C-F8E2615861D4","versionEndExcluding":"6.12.83","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (powerz) Fix use-after-free on USB disconnect\n\nAfter powerz_disconnect() frees the URB and releases the mutex, a\nsubsequent powerz_read() call can acquire the mutex and call\npowerz_read_data(), which dereferences the freed URB pointer.\n\nFix by:\n - Setting priv->urb to NULL in powerz_disconnect() so that\n powerz_read_data() can detect the disconnected state.\n - Adding a !priv->urb check at the start of powerz_read_data()\n to return -ENODEV on a disconnected device.\n - Moving usb_set_intfdata() before hwmon registration so the\n disconnect handler can always find the priv pointer."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nhwmon: (powerz) Corrección de uso después de liberación en desconexión USB\n\nDespués de que powerz_disconnect() libera el URB y libera el mutex, una llamada posterior a powerz_read() puede adquirir el mutex y llamar a powerz_read_data(), que desreferencia el puntero URB liberado.\n\nSe corrige mediante:\n- Establecer priv -> urb a NULL en powerz_disconnect() para que powerz_read_data() pueda detectar el estado desconectado.\n- Añadir una comprobación !priv -> urb al inicio de powerz_read_data() para devolver -ENODEV en un dispositivo desconectado.\n- Mover usb_set_intfdata() antes del registro de hwmon para que el gestor de desconexión siempre pueda encontrar el puntero priv."}],"id":"CVE-2026-31582","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:32.903","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08e57f5e1a9067d5fbf33993aa7f51d60b3d13a4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/61f2aa23b0ce8d7aa5071ed25a7471e246a4fdd4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7003ae4810ca83f0ddca85b768500e313c4b998c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e1b798257f96d2e2a2639830eb71add545ce749"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c78e1d4e48f23792adaa7c94251e22b0d9700a39"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31583.json b/data/2026/CVE-2026-31583.json index e278850af7..e08f95a360 100644 --- a/data/2026/CVE-2026-31583.json +++ b/data/2026/CVE-2026-31583.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/usb/em28xx/em28xx-video.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3c0283a59e36e3707c4a81f4952e362d31f876b8","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"2cbf81f76842e46bdf25823c70e1db4044a65678","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"38a327221f7f765e7d853b7bafe47e342441ec85","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"b5d141ea15f173f15b9f0a72965902f3428c0d92","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"5fb2940327722b4684d2f964b54c1c90aa277324","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"871b8ea8ef39a6c253594649f4339378fad3d0dd","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"6b9e66437cc6123ddedac141e1b8b6fcf57d2972","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"dd2b888e08d3b3d6aacd65d76cd44fac11da750f","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"a66485a934c7187ae8e36517d40615fa2e961cff","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/usb/em28xx/em28xx-video.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.16"},{"lessThan":"3.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: em28xx: fix use-after-free in em28xx_v4l2_open()\n\nem28xx_v4l2_open() reads dev->v4l2 without holding dev->lock,\ncreating a race with em28xx_v4l2_init()'s error path and\nem28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct\nand set dev->v4l2 to NULL under dev->lock.\n\nThis race leads to two issues:\n - use-after-free in v4l2_fh_init() when accessing vdev->ctrl_handler,\n since the video_device is embedded in the freed em28xx_v4l2 struct.\n - NULL pointer dereference in em28xx_resolution_set() when accessing\n v4l2->norm, since dev->v4l2 has been set to NULL.\n\nFix this by moving the mutex_lock() before the dev->v4l2 read and\nadding a NULL check for dev->v4l2 under the lock."}],"id":"CVE-2026-31583","lastModified":"2026-11-06T16:18:01.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31583","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:09.106144Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:33.017","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2cbf81f76842e46bdf25823c70e1db4044a65678"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/38a327221f7f765e7d853b7bafe47e342441ec85"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3c0283a59e36e3707c4a81f4952e362d31f876b8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5fb2940327722b4684d2f964b54c1c90aa277324"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6b9e66437cc6123ddedac141e1b8b6fcf57d2972"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/871b8ea8ef39a6c253594649f4339378fad3d0dd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a66485a934c7187ae8e36517d40615fa2e961cff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5d141ea15f173f15b9f0a72965902f3428c0d92"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dd2b888e08d3b3d6aacd65d76cd44fac11da750f"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/usb/em28xx/em28xx-video.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3c0283a59e36e3707c4a81f4952e362d31f876b8","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"2cbf81f76842e46bdf25823c70e1db4044a65678","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"38a327221f7f765e7d853b7bafe47e342441ec85","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"b5d141ea15f173f15b9f0a72965902f3428c0d92","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"5fb2940327722b4684d2f964b54c1c90aa277324","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"871b8ea8ef39a6c253594649f4339378fad3d0dd","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"6b9e66437cc6123ddedac141e1b8b6fcf57d2972","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"dd2b888e08d3b3d6aacd65d76cd44fac11da750f","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"},{"lessThan":"a66485a934c7187ae8e36517d40615fa2e961cff","status":"affected","version":"8139a4d583abad45eb987b5a99b3281b6d435b7e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/usb/em28xx/em28xx-video.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.16"},{"lessThan":"3.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: em28xx: fix use-after-free in em28xx_v4l2_open()\n\nem28xx_v4l2_open() reads dev->v4l2 without holding dev->lock,\ncreating a race with em28xx_v4l2_init()'s error path and\nem28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct\nand set dev->v4l2 to NULL under dev->lock.\n\nThis race leads to two issues:\n - use-after-free in v4l2_fh_init() when accessing vdev->ctrl_handler,\n since the video_device is embedded in the freed em28xx_v4l2 struct.\n - NULL pointer dereference in em28xx_resolution_set() when accessing\n v4l2->norm, since dev->v4l2 has been set to NULL.\n\nFix this by moving the mutex_lock() before the dev->v4l2 read and\nadding a NULL check for dev->v4l2 under the lock."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: media: em28xx: corregir uso después de liberación en em28xx_v4l2_open() em28xx_v4l2_open() lee dev-mayor que v4l2 sin mantener dev -> lock, creando una condición de carrera con la ruta de error de em28xx_v4l2_init() y em28xx_v4l2_fini(), ambos de los cuales liberan la estructura em28xx_v4l2 y establecen dev-mayor que v4l2 a NULL bajo dev -> lock. Esta condición de carrera conduce a dos problemas:\n- uso después de liberación en v4l2_fh_init() al acceder a vdev -> ctrl_handler, ya que el video_device está incrustado en la estructura em28xx_v4l2 liberada.\n- desreferencia de puntero NULL en em28xx_resolution_set() al acceder a v4l2 -> norm, ya que dev-mayor que v4l2 ha sido establecido a NULL. Solucionar esto moviendo el mutex_lock() antes de la lectura de dev-mayor que v4l2 y añadiendo una comprobación de NULL para dev-mayor que v4l2 bajo el bloqueo."}],"id":"CVE-2026-31583","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31583","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:09.106144Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:33.017","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2cbf81f76842e46bdf25823c70e1db4044a65678"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/38a327221f7f765e7d853b7bafe47e342441ec85"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3c0283a59e36e3707c4a81f4952e362d31f876b8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5fb2940327722b4684d2f964b54c1c90aa277324"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6b9e66437cc6123ddedac141e1b8b6fcf57d2972"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/871b8ea8ef39a6c253594649f4339378fad3d0dd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a66485a934c7187ae8e36517d40615fa2e961cff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5d141ea15f173f15b9f0a72965902f3428c0d92"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dd2b888e08d3b3d6aacd65d76cd44fac11da750f"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31584.json b/data/2026/CVE-2026-31584.json index f01a15efe9..60cfddb288 100644 --- a/data/2026/CVE-2026-31584.json +++ b/data/2026/CVE-2026-31584.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9a9bdaf9dc42ccca50e53f82165292f74a365c11","status":"affected","version":"0934d37596151edce115c6d0843a9ad7d5e5d232","versionType":"git"},{"lessThan":"a8a55913552aed45108525d1851c65e1db0cc25b","status":"affected","version":"0934d37596151edce115c6d0843a9ad7d5e5d232","versionType":"git"},{"lessThan":"f99353cd0e9f58bf17889049137b8d65fb44ebf1","status":"affected","version":"0934d37596151edce115c6d0843a9ad7d5e5d232","versionType":"git"},{"lessThan":"93d9a58961a9e09306857e999b3ee76aa4be67f0","status":"affected","version":"0934d37596151edce115c6d0843a9ad7d5e5d232","versionType":"git"},{"lessThan":"f1692337c6fa26e04f89b22a4d84bf5b7ada50d1","status":"affected","version":"0934d37596151edce115c6d0843a9ad7d5e5d232","versionType":"git"},{"lessThan":"76e35091ffc722ba39b303e48bc5d08abb59dd56","status":"affected","version":"0934d37596151edce115c6d0843a9ad7d5e5d232","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: fix use-after-free in encoder release path\n\nThe fops_vcodec_release() function frees the context structure (ctx)\nwithout first cancelling any pending or running work in ctx->encode_work.\nThis creates a race window where the workqueue handler (mtk_venc_worker)\nmay still be accessing the context memory after it has been freed.\n\nRace condition:\n\n CPU 0 (release path) CPU 1 (workqueue)\n --------------------- ------------------\n fops_vcodec_release()\n v4l2_m2m_ctx_release()\n v4l2_m2m_cancel_job()\n // waits for m2m job \"done\"\n mtk_venc_worker()\n v4l2_m2m_job_finish()\n // m2m job \"done\"\n // BUT worker still running!\n // post-job_finish access:\n other ctx dereferences\n // UAF if ctx already freed\n // returns (job \"done\")\n kfree(ctx) // ctx freed\n\nRoot cause: The v4l2_m2m_ctx_release() only waits for the m2m job\nlifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle.\nAfter v4l2_m2m_job_finish() is called, the m2m framework considers\nthe job complete and v4l2_m2m_ctx_release() returns, but the worker\nfunction continues executing and may still access ctx.\n\nThe work is queued during encode operations via:\n queue_work(ctx->dev->encode_workqueue, &ctx->encode_work)\nThe worker function accesses ctx->m2m_ctx, ctx->dev, and other ctx\nfields even after calling v4l2_m2m_job_finish().\n\nThis vulnerability was confirmed with KASAN by running an instrumented\ntest module that widens the post-job_finish race window. KASAN detected:\n\n BUG: KASAN: slab-use-after-free in mtk_venc_worker+0x159/0x180\n Read of size 4 at addr ffff88800326e000 by task kworker/u8:0/12\n\n Workqueue: mtk_vcodec_enc_wq mtk_venc_worker\n\n Allocated by task 47:\n __kasan_kmalloc+0x7f/0x90\n fops_vcodec_open+0x85/0x1a0\n\n Freed by task 47:\n __kasan_slab_free+0x43/0x70\n kfree+0xee/0x3a0\n fops_vcodec_release+0xb7/0x190\n\nFix this by calling cancel_work_sync(&ctx->encode_work) before kfree(ctx).\nThis ensures the workqueue handler is both cancelled (if pending) and\nsynchronized (waits for any running handler to complete) before the\ncontext is freed.\n\nPlacement rationale: The fix is placed after v4l2_ctrl_handler_free()\nand before list_del_init(&ctx->list). At this point, all m2m operations\nare done (v4l2_m2m_ctx_release() has returned), and we need to ensure\nthe workqueue is synchronized before removing ctx from the list and\nfreeing it.\n\nNote: The open error path does NOT need cancel_work_sync() because\nINIT_WORK() only initializes the work structure - it does not schedule\nit. Work is only scheduled later during device_run() operations."}],"id":"CVE-2026-31584","lastModified":"2026-06-17T10:34:01.643","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:33.117","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76e35091ffc722ba39b303e48bc5d08abb59dd56"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/93d9a58961a9e09306857e999b3ee76aa4be67f0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a9bdaf9dc42ccca50e53f82165292f74a365c11"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a8a55913552aed45108525d1851c65e1db0cc25b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1692337c6fa26e04f89b22a4d84bf5b7ada50d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f99353cd0e9f58bf17889049137b8d65fb44ebf1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9a9bdaf9dc42ccca50e53f82165292f74a365c11","status":"affected","version":"0934d37596151edce115c6d0843a9ad7d5e5d232","versionType":"git"},{"lessThan":"a8a55913552aed45108525d1851c65e1db0cc25b","status":"affected","version":"0934d37596151edce115c6d0843a9ad7d5e5d232","versionType":"git"},{"lessThan":"f99353cd0e9f58bf17889049137b8d65fb44ebf1","status":"affected","version":"0934d37596151edce115c6d0843a9ad7d5e5d232","versionType":"git"},{"lessThan":"93d9a58961a9e09306857e999b3ee76aa4be67f0","status":"affected","version":"0934d37596151edce115c6d0843a9ad7d5e5d232","versionType":"git"},{"lessThan":"f1692337c6fa26e04f89b22a4d84bf5b7ada50d1","status":"affected","version":"0934d37596151edce115c6d0843a9ad7d5e5d232","versionType":"git"},{"lessThan":"76e35091ffc722ba39b303e48bc5d08abb59dd56","status":"affected","version":"0934d37596151edce115c6d0843a9ad7d5e5d232","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/platform/mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.6"},{"lessThan":"6.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14109CEF-714B-4029-A318-97AA58A01833","versionEndExcluding":"6.6.136","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mediatek: vcodec: fix use-after-free in encoder release path\n\nThe fops_vcodec_release() function frees the context structure (ctx)\nwithout first cancelling any pending or running work in ctx->encode_work.\nThis creates a race window where the workqueue handler (mtk_venc_worker)\nmay still be accessing the context memory after it has been freed.\n\nRace condition:\n\n CPU 0 (release path) CPU 1 (workqueue)\n --------------------- ------------------\n fops_vcodec_release()\n v4l2_m2m_ctx_release()\n v4l2_m2m_cancel_job()\n // waits for m2m job \"done\"\n mtk_venc_worker()\n v4l2_m2m_job_finish()\n // m2m job \"done\"\n // BUT worker still running!\n // post-job_finish access:\n other ctx dereferences\n // UAF if ctx already freed\n // returns (job \"done\")\n kfree(ctx) // ctx freed\n\nRoot cause: The v4l2_m2m_ctx_release() only waits for the m2m job\nlifecycle (via TRANS_RUNNING flag), not the workqueue lifecycle.\nAfter v4l2_m2m_job_finish() is called, the m2m framework considers\nthe job complete and v4l2_m2m_ctx_release() returns, but the worker\nfunction continues executing and may still access ctx.\n\nThe work is queued during encode operations via:\n queue_work(ctx->dev->encode_workqueue, &ctx->encode_work)\nThe worker function accesses ctx->m2m_ctx, ctx->dev, and other ctx\nfields even after calling v4l2_m2m_job_finish().\n\nThis vulnerability was confirmed with KASAN by running an instrumented\ntest module that widens the post-job_finish race window. KASAN detected:\n\n BUG: KASAN: slab-use-after-free in mtk_venc_worker+0x159/0x180\n Read of size 4 at addr ffff88800326e000 by task kworker/u8:0/12\n\n Workqueue: mtk_vcodec_enc_wq mtk_venc_worker\n\n Allocated by task 47:\n __kasan_kmalloc+0x7f/0x90\n fops_vcodec_open+0x85/0x1a0\n\n Freed by task 47:\n __kasan_slab_free+0x43/0x70\n kfree+0xee/0x3a0\n fops_vcodec_release+0xb7/0x190\n\nFix this by calling cancel_work_sync(&ctx->encode_work) before kfree(ctx).\nThis ensures the workqueue handler is both cancelled (if pending) and\nsynchronized (waits for any running handler to complete) before the\ncontext is freed.\n\nPlacement rationale: The fix is placed after v4l2_ctrl_handler_free()\nand before list_del_init(&ctx->list). At this point, all m2m operations\nare done (v4l2_m2m_ctx_release() has returned), and we need to ensure\nthe workqueue is synchronized before removing ctx from the list and\nfreeing it.\n\nNote: The open error path does NOT need cancel_work_sync() because\nINIT_WORK() only initializes the work structure - it does not schedule\nit. Work is only scheduled later during device_run() operations."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: mediatek: vcodec: corrección de uso después de liberación en la ruta de liberación del codificador\n\nLa función fops_vcodec_release() libera la estructura de contexto (ctx) sin cancelar primero ningún trabajo pendiente o en ejecución en ctx -> encode_work. Esto crea una ventana de carrera donde el gestor de la cola de trabajo (mtk_venc_worker) aún puede estar accediendo a la memoria de contexto después de que esta haya sido liberada.\n\nCondición de carrera:\n\n CPU 0 (ruta de liberación) CPU 1 (cola de trabajo)\n - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n fops_vcodec_release()\n v4l2_m2m_ctx_release()\n v4l2_m2m_cancel_job()\n // espera a que el trabajo m2m ’terminado’\n mtk_venc_worker()\n v4l2_m2m_job_finish()\n // trabajo m2m ’terminado’\n // ¡PERO el worker sigue en ejecución!\n // acceso post-job_finish:\n otras desreferencias de ctx\n // UAF si ctx ya ha sido liberado\n // retorna (trabajo ’terminado’)\n kfree(ctx) // ctx liberado\n\nCausa raíz: La función v4l2_m2m_ctx_release() solo espera por el ciclo de vida del trabajo m2m (a través del flag TRANS_RUNNING), no por el ciclo de vida de la cola de trabajo. Después de que se llama a v4l2_m2m_job_finish(), el framework m2m considera el trabajo completo y v4l2_m2m_ctx_release() retorna, pero la función worker continúa ejecutándose y aún puede acceder a ctx.\n\nEl trabajo se encola durante las operaciones de codificación a través de:\n queue_work(ctx -> dev -> encode_workqueue, ref:ctx -> encode_work)\nLa función worker accede a ctx -> m2m_ctx, ctx -> dev y otros campos de ctx incluso después de llamar a v4l2_m2m_job_finish().\n\nEsta vulnerabilidad fue confirmada con KASAN ejecutando un módulo de prueba instrumentado que amplía la ventana de carrera post-job_finish. KASAN detectó:\n\n BUG: KASAN: slab-use-after-free en mtk_venc_worker+0x159/0x180\n Lectura de tamaño 4 en la dirección ffff88800326e000 por la tarea kworker/u8:0/12\n\n Cola de trabajo: mtk_vcodec_enc_wq mtk_venc_worker\n\n Asignado por la tarea 47:\n __kasan_kmalloc+0x7f/0x90\n fops_vcodec_open+0x85/0x1a0\n\n Liberado por la tarea 47:\n __kasan_slab_free+0x43/0x70\n kfree+0xee/0x3a0\n fops_vcodec_release+0xb7/0x190\n\nSolucione esto llamando a cancel_work_sync(ref:ctx -> encode_work) antes de kfree(ctx). Esto asegura que el gestor de la cola de trabajo sea tanto cancelado (si está pendiente) como sincronizado (espera a que cualquier gestor en ejecución complete) antes de que el contexto sea liberado.\n\nJustificación de la ubicación: La corrección se ubica después de v4l2_ctrl_handler_free() y antes de list_del_init(ref:ctx -> list). En este punto, todas las operaciones m2m están hechas (v4l2_m2m_ctx_release() ha retornado), y necesitamos asegurar que la cola de trabajo esté sincronizada antes de eliminar ctx de la lista y liberarlo.\n\nNota: La ruta de error de apertura NO necesita cancel_work_sync() porque INIT_WORK() solo inicializa la estructura de trabajo, no la programa. El trabajo solo se programa más tarde durante las operaciones de device_run()."}],"id":"CVE-2026-31584","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:33.117","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76e35091ffc722ba39b303e48bc5d08abb59dd56"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/93d9a58961a9e09306857e999b3ee76aa4be67f0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9a9bdaf9dc42ccca50e53f82165292f74a365c11"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a8a55913552aed45108525d1851c65e1db0cc25b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1692337c6fa26e04f89b22a4d84bf5b7ada50d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f99353cd0e9f58bf17889049137b8d65fb44ebf1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31585.json b/data/2026/CVE-2026-31585.json index 80fbf7a292..039a72f9ba 100644 --- a/data/2026/CVE-2026-31585.json +++ b/data/2026/CVE-2026-31585.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/test-drivers/vidtv/vidtv_bridge.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f8cccb427e65d725fc0ba05e8900b4676eda268e","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"60f768d46df561e06d92ffcacc00909f37a0f23d","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"80900b5424f3454256153ce386388df43b324f63","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"17cb7957c979529cc98ff57f7ac331532f1f7c83","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"98c22210aeadce67d9d20059f0dbbd01ba7fdbba","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"25f19e476ab15defe698504212899fdb9f7cd61b","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"83110c2c8c46c035c2e0fc8ff3e4991183bf9ccd","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"4bf95f797edd63c93330eafb6d6e670982344b9b","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"a0e5a598fe9a4612b852406b51153b881592aede","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/test-drivers/vidtv/vidtv_bridge.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.10"},{"lessThan":"5.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0F98EDB3-BDF6-4821-9197-1BA4A2E056E2","versionEndExcluding":"6.6.136","versionStartIncluding":"5.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vidtv: fix nfeeds state corruption on start_streaming failure\n\nsyzbot reported a memory leak in vidtv_psi_service_desc_init [1].\n\nWhen vidtv_start_streaming() fails inside vidtv_start_feed(), the\nnfeeds counter is left incremented even though no feed was actually\nstarted. This corrupts the driver state: subsequent start_feed calls\nsee nfeeds > 1 and skip starting the mux, while stop_feed calls\neventually try to stop a non-existent stream.\n\nThis state corruption can also lead to memory leaks, since the mux\nand channel resources may be partially allocated during a failed\nstart_streaming but never cleaned up, as the stop path finds\ndvb->streaming == false and returns early.\n\nFix by decrementing nfeeds back when start_streaming fails, keeping\nthe counter in sync with the actual number of active feeds.\n\n[1]\nBUG: memory leak\nunreferenced object 0xffff888145b50820 (size 32):\n comm \"syz.0.17\", pid 6068, jiffies 4294944486\n backtrace (crc 90a0c7d4):\n vidtv_psi_service_desc_init+0x74/0x1b0 drivers/media/test-drivers/vidtv/vidtv_psi.c:288\n vidtv_channel_s302m_init+0xb1/0x2a0 drivers/media/test-drivers/vidtv/vidtv_channel.c:83\n vidtv_channels_init+0x1b/0x40 drivers/media/test-drivers/vidtv/vidtv_channel.c:524\n vidtv_mux_init+0x516/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:518\n vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline]\n vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239"}],"id":"CVE-2026-31585","lastModified":"2026-06-17T10:34:01.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:33.267","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/17cb7957c979529cc98ff57f7ac331532f1f7c83"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25f19e476ab15defe698504212899fdb9f7cd61b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4bf95f797edd63c93330eafb6d6e670982344b9b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/60f768d46df561e06d92ffcacc00909f37a0f23d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/80900b5424f3454256153ce386388df43b324f63"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83110c2c8c46c035c2e0fc8ff3e4991183bf9ccd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98c22210aeadce67d9d20059f0dbbd01ba7fdbba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a0e5a598fe9a4612b852406b51153b881592aede"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f8cccb427e65d725fc0ba05e8900b4676eda268e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/test-drivers/vidtv/vidtv_bridge.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f8cccb427e65d725fc0ba05e8900b4676eda268e","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"60f768d46df561e06d92ffcacc00909f37a0f23d","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"80900b5424f3454256153ce386388df43b324f63","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"17cb7957c979529cc98ff57f7ac331532f1f7c83","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"98c22210aeadce67d9d20059f0dbbd01ba7fdbba","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"25f19e476ab15defe698504212899fdb9f7cd61b","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"83110c2c8c46c035c2e0fc8ff3e4991183bf9ccd","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"4bf95f797edd63c93330eafb6d6e670982344b9b","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"a0e5a598fe9a4612b852406b51153b881592aede","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/test-drivers/vidtv/vidtv_bridge.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.10"},{"lessThan":"5.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0F98EDB3-BDF6-4821-9197-1BA4A2E056E2","versionEndExcluding":"6.6.136","versionStartIncluding":"5.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vidtv: fix nfeeds state corruption on start_streaming failure\n\nsyzbot reported a memory leak in vidtv_psi_service_desc_init [1].\n\nWhen vidtv_start_streaming() fails inside vidtv_start_feed(), the\nnfeeds counter is left incremented even though no feed was actually\nstarted. This corrupts the driver state: subsequent start_feed calls\nsee nfeeds > 1 and skip starting the mux, while stop_feed calls\neventually try to stop a non-existent stream.\n\nThis state corruption can also lead to memory leaks, since the mux\nand channel resources may be partially allocated during a failed\nstart_streaming but never cleaned up, as the stop path finds\ndvb->streaming == false and returns early.\n\nFix by decrementing nfeeds back when start_streaming fails, keeping\nthe counter in sync with the actual number of active feeds.\n\n[1]\nBUG: memory leak\nunreferenced object 0xffff888145b50820 (size 32):\n comm \"syz.0.17\", pid 6068, jiffies 4294944486\n backtrace (crc 90a0c7d4):\n vidtv_psi_service_desc_init+0x74/0x1b0 drivers/media/test-drivers/vidtv/vidtv_psi.c:288\n vidtv_channel_s302m_init+0xb1/0x2a0 drivers/media/test-drivers/vidtv/vidtv_channel.c:83\n vidtv_channels_init+0x1b/0x40 drivers/media/test-drivers/vidtv/vidtv_channel.c:524\n vidtv_mux_init+0x516/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:518\n vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline]\n vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: media: vidtv: corrige la corrupción del estado de nfeeds al fallar start_streaming syzbot informó de una fuga de memoria en vidtv_psi_service_desc_init [1]. Cuando vidtv_start_streaming() falla dentro de vidtv_start_feed(), el contador nfeeds queda incrementado a pesar de que ninguna alimentación fue realmente iniciada. Esto corrompe el estado del controlador: las llamadas posteriores a start_feed ven nfeeds mayor que 1 y omiten iniciar el mux, mientras que las llamadas a stop_feed finalmente intentan detener un flujo inexistente. Esta corrupción de estado también puede provocar fugas de memoria, ya que los recursos del mux y del canal pueden ser asignados parcialmente durante un start_streaming fallido pero nunca se limpian, puesto que la ruta de detención encuentra dvb -> streaming == false y regresa anticipadamente. Se corrige decrementando nfeeds cuando start_streaming falla, manteniendo el contador sincronizado con el número real de alimentaciones activas. [1]\nERROR: fuga de memoria\nobjeto sin referencia 0x ffff888145b50820 (tamaño 32): comm ’syz.0.17’, pid 6068, jiffies 4294944486 rastreo (crc 90a0c7d4): vidtv_psi_service_desc_init+0x74/0x1b0 drivers/media/test-drivers/vidtv/vidtv_psi.c:288 vidtv_channel_s302m_init+0xb1/0x2a0 drivers/media/test-drivers/vidtv/vidtv_channel.c:83 vidtv_channels_init+0x1b/0x40 drivers/media/test-drivers/vidtv/vidtv_channel.c:524 vidtv_mux_init+0x516/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:518 vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline] vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239"}],"id":"CVE-2026-31585","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:33.267","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/17cb7957c979529cc98ff57f7ac331532f1f7c83"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25f19e476ab15defe698504212899fdb9f7cd61b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4bf95f797edd63c93330eafb6d6e670982344b9b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/60f768d46df561e06d92ffcacc00909f37a0f23d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/80900b5424f3454256153ce386388df43b324f63"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/83110c2c8c46c035c2e0fc8ff3e4991183bf9ccd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98c22210aeadce67d9d20059f0dbbd01ba7fdbba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a0e5a598fe9a4612b852406b51153b881592aede"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f8cccb427e65d725fc0ba05e8900b4676eda268e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31586.json b/data/2026/CVE-2026-31586.json index cb03caf8b0..c9f478c665 100644 --- a/data/2026/CVE-2026-31586.json +++ b/data/2026/CVE-2026-31586.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/backing-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"23acef4156c260e8598397a1a2e8b3a23e919893","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"1bd36e93b542d9dd020190c6607c6a3663405195","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"740ba1ebb223f137ff088ab74d533a13f9167bd8","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"115a5266749dcde7fe4127e8623d19c752088f69","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"dfc8292a1d6782c76b626315605e0585a5a18447","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"ea3af09eb87d8f8708c66747fcf1a2762902e839","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"50879a3c1faf06e661090015d59e2127255cff27","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"67cb119d32f35e32acd0393bbeb318b2bb1fdafe","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"8f5857be99f1ed1fa80991c72449541f634626ee","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/backing-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C65C5FE4-6002-4BBA-98A9-87D1F99A643F","versionEndExcluding":"6.6.136","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: blk-cgroup: fix use-after-free in cgwb_release_workfn()\n\ncgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses\nwb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last\nreference, the blkcg can be freed asynchronously (css_free_rwork_fn ->\nblkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the\npointer to access blkcg->online_pin, resulting in a use-after-free:\n\n BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)\n Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531\n Workqueue: cgwb_release cgwb_release_workfn\n Call Trace:\n \n blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)\n cgwb_release_workfn (mm/backing-dev.c:629)\n process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385)\n\n Freed by task 1016:\n kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561)\n css_free_rwork_fn (kernel/cgroup/cgroup.c:5542)\n process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385)\n\n** Stack based on commit 66672af7a095 (\"Add linux-next specific files\nfor 20260410\")\n\nI am seeing this crash sporadically in Meta fleet across multiple kernel\nversions. A full reproducer is available at:\nhttps://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh\n\n(The race window is narrow. To make it easily reproducible, inject a\nmsleep(100) between css_put() and blkcg_unpin_online() in\ncgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the\nreproducer triggers the splat reliably in less than a second.)\n\nFix this by moving blkcg_unpin_online() before css_put(), so the\ncgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online()\naccesses it."}],"id":"CVE-2026-31586","lastModified":"2026-10-19T19:18:00.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:59.894304Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:33.393","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/115a5266749dcde7fe4127e8623d19c752088f69"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1bd36e93b542d9dd020190c6607c6a3663405195"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/23acef4156c260e8598397a1a2e8b3a23e919893"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/50879a3c1faf06e661090015d59e2127255cff27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67cb119d32f35e32acd0393bbeb318b2bb1fdafe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/740ba1ebb223f137ff088ab74d533a13f9167bd8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f5857be99f1ed1fa80991c72449541f634626ee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dfc8292a1d6782c76b626315605e0585a5a18447"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea3af09eb87d8f8708c66747fcf1a2762902e839"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/backing-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"23acef4156c260e8598397a1a2e8b3a23e919893","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"1bd36e93b542d9dd020190c6607c6a3663405195","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"740ba1ebb223f137ff088ab74d533a13f9167bd8","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"115a5266749dcde7fe4127e8623d19c752088f69","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"dfc8292a1d6782c76b626315605e0585a5a18447","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"ea3af09eb87d8f8708c66747fcf1a2762902e839","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"50879a3c1faf06e661090015d59e2127255cff27","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"67cb119d32f35e32acd0393bbeb318b2bb1fdafe","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"},{"lessThan":"8f5857be99f1ed1fa80991c72449541f634626ee","status":"affected","version":"59b57717fff8b562825d9d25e0180ad7e8048ca9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/backing-dev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C65C5FE4-6002-4BBA-98A9-87D1F99A643F","versionEndExcluding":"6.6.136","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: blk-cgroup: fix use-after-free in cgwb_release_workfn()\n\ncgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses\nwb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last\nreference, the blkcg can be freed asynchronously (css_free_rwork_fn ->\nblkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the\npointer to access blkcg->online_pin, resulting in a use-after-free:\n\n BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)\n Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531\n Workqueue: cgwb_release cgwb_release_workfn\n Call Trace:\n \n blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)\n cgwb_release_workfn (mm/backing-dev.c:629)\n process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385)\n\n Freed by task 1016:\n kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561)\n css_free_rwork_fn (kernel/cgroup/cgroup.c:5542)\n process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385)\n\n** Stack based on commit 66672af7a095 (\"Add linux-next specific files\nfor 20260410\")\n\nI am seeing this crash sporadically in Meta fleet across multiple kernel\nversions. A full reproducer is available at:\nhttps://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh\n\n(The race window is narrow. To make it easily reproducible, inject a\nmsleep(100) between css_put() and blkcg_unpin_online() in\ncgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the\nreproducer triggers the splat reliably in less than a second.)\n\nFix this by moving blkcg_unpin_online() before css_put(), so the\ncgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online()\naccesses it."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm: blk-cgroup: corregir uso después de liberación en cgwb_release_workfn()\n\ncgwb_release_workfn() llama a css_put(wb -> blkcg_css) y luego accede a wb -> blkcg_css de nuevo a través de blkcg_unpin_online(). Si css_put() libera la última referencia, el blkcg puede ser liberado asincrónicamente (css_free_rwork_fn -> blkcg_css_free -> kfree) antes de que blkcg_unpin_online() desreferencie el puntero para acceder a blkcg -> online_pin, resultando en un uso después de liberación:\n\n BUG: KASAN: slab-uso-después-de-liberación en blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)\n Escritura de tamaño 4 en la dirección ff11000117aa6160 por la tarea kworker/71:1/531\n Cola de trabajo: cgwb_release cgwb_release_workfn\n Rastro de llamada:\n [TAREA]\n blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)\n cgwb_release_workfn (mm/backing-dev.c:629)\n process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385)\n\n Liberado por la tarea 1016:\n kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561)\n css_free_rwork_fn (kernel/cgroup/cgroup.c:5542)\n process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385)\n\n** Pila basada en el commit 66672af7a095 (’Add linux-next specific files for 20260410’)\n\nEstoy viendo este fallo esporádicamente en la flota de Meta en múltiples versiones del kernel. Un reproductor completo está disponible en:\nhttps://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh\n\n(La ventana de carrera es estrecha. Para que sea fácilmente reproducible, inyecte un msleep(100) entre css_put() y blkcg_unpin_online() en cgwb_release_workfn(). Con ese retraso y un kernel habilitado para KASAN, el reproductor activa el splat de forma fiable en menos de un segundo.)\n\nCorrija esto moviendo blkcg_unpin_online() antes de css_put(), para que la referencia CSS del cgwb mantenga el blkcg activo mientras blkcg_unpin_online() accede a él."}],"id":"CVE-2026-31586","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:10:59.894304Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:33.393","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/115a5266749dcde7fe4127e8623d19c752088f69"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1bd36e93b542d9dd020190c6607c6a3663405195"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/23acef4156c260e8598397a1a2e8b3a23e919893"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/50879a3c1faf06e661090015d59e2127255cff27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67cb119d32f35e32acd0393bbeb318b2bb1fdafe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/740ba1ebb223f137ff088ab74d533a13f9167bd8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f5857be99f1ed1fa80991c72449541f634626ee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dfc8292a1d6782c76b626315605e0585a5a18447"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea3af09eb87d8f8708c66747fcf1a2762902e839"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31587.json b/data/2026/CVE-2026-31587.json index 714737767f..416885dc2e 100644 --- a/data/2026/CVE-2026-31587.json +++ b/data/2026/CVE-2026-31587.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/soc/qcom/qdsp6/q6apm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"110769a9aa51135ac7ce479a47dfb41924f37664","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"},{"lessThan":"887632163b546a8944b46ef465f1d74e838b727a","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"},{"lessThan":"b7412ed789ffb1e59c8d6f5ab6a6a718963c85e2","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"},{"lessThan":"30383b7780ffa140bc124de5b66cae7c84133dbb","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"},{"lessThan":"f7b790531cdad3b2075ab937aa06d7b802403be4","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"},{"lessThan":"a561a55b79a9c55f0443377f2d4dcf6149d057af","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"},{"lessThan":"6ec1235fc941dac6c011b30ee01d9220ff87e0cd","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/soc/qcom/qdsp6/q6apm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8489BED4-A890-4712-813B-8F62B04F503D","versionEndExcluding":"6.6.136","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: q6apm: move component registration to unmanaged version\n\nq6apm component registers dais dynamically from ASoC toplology, which\nare allocated using device managed version apis. Allocating both\ncomponent and dynamic dais using managed version could lead to incorrect\nfree ordering, dai will be freed while component still holding references\nto it.\n\nFix this issue by moving component to unmanged version so\nthat the dai pointers are only freeded after the component is removed.\n\n==================================================================\nBUG: KASAN: slab-use-after-free in snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core]\nRead of size 8 at addr ffff00084493a6e8 by task kworker/u48:0/3426\nTainted: [W]=WARN\nHardware name: LENOVO 21N2ZC5PUS/21N2ZC5PUS, BIOS N42ET57W (1.31 ) 08/08/2024\nWorkqueue: pdr_notifier_wq pdr_notifier_work [pdr_interface]\nCall trace:\n show_stack+0x28/0x7c (C)\n dump_stack_lvl+0x60/0x80\n print_report+0x160/0x4b4\n kasan_report+0xac/0xfc\n __asan_report_load8_noabort+0x20/0x34\n snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core]\n snd_soc_unregister_component_by_driver+0x50/0x88 [snd_soc_core]\n devm_component_release+0x30/0x5c [snd_soc_core]\n devres_release_all+0x13c/0x210\n device_unbind_cleanup+0x20/0x190\n device_release_driver_internal+0x350/0x468\n device_release_driver+0x18/0x30\n bus_remove_device+0x1a0/0x35c\n device_del+0x314/0x7f0\n device_unregister+0x20/0xbc\n apr_remove_device+0x5c/0x7c [apr]\n device_for_each_child+0xd8/0x160\n apr_pd_status+0x7c/0xa8 [apr]\n pdr_notifier_work+0x114/0x240 [pdr_interface]\n process_one_work+0x500/0xb70\n worker_thread+0x630/0xfb0\n kthread+0x370/0x6c0\n ret_from_fork+0x10/0x20\n\nAllocated by task 77:\n kasan_save_stack+0x40/0x68\n kasan_save_track+0x20/0x40\n kasan_save_alloc_info+0x44/0x58\n __kasan_kmalloc+0xbc/0xdc\n __kmalloc_node_track_caller_noprof+0x1f4/0x620\n devm_kmalloc+0x7c/0x1c8\n snd_soc_register_dai+0x50/0x4f0 [snd_soc_core]\n soc_tplg_pcm_elems_load+0x55c/0x1eb8 [snd_soc_core]\n snd_soc_tplg_component_load+0x4f8/0xb60 [snd_soc_core]\n audioreach_tplg_init+0x124/0x1fc [snd_q6apm]\n q6apm_audio_probe+0x10/0x1c [snd_q6apm]\n snd_soc_component_probe+0x5c/0x118 [snd_soc_core]\n soc_probe_component+0x44c/0xaf0 [snd_soc_core]\n snd_soc_bind_card+0xad0/0x2370 [snd_soc_core]\n snd_soc_register_card+0x3b0/0x4c0 [snd_soc_core]\n devm_snd_soc_register_card+0x50/0xc8 [snd_soc_core]\n x1e80100_platform_probe+0x208/0x368 [snd_soc_x1e80100]\n platform_probe+0xc0/0x188\n really_probe+0x188/0x804\n __driver_probe_device+0x158/0x358\n driver_probe_device+0x60/0x190\n __device_attach_driver+0x16c/0x2a8\n bus_for_each_drv+0x100/0x194\n __device_attach+0x174/0x380\n device_initial_probe+0x14/0x20\n bus_probe_device+0x124/0x154\n deferred_probe_work_func+0x140/0x220\n process_one_work+0x500/0xb70\n worker_thread+0x630/0xfb0\n kthread+0x370/0x6c0\n ret_from_fork+0x10/0x20\n\nFreed by task 3426:\n kasan_save_stack+0x40/0x68\n kasan_save_track+0x20/0x40\n __kasan_save_free_info+0x4c/0x80\n __kasan_slab_free+0x78/0xa0\n kfree+0x100/0x4a4\n devres_release_all+0x144/0x210\n device_unbind_cleanup+0x20/0x190\n device_release_driver_internal+0x350/0x468\n device_release_driver+0x18/0x30\n bus_remove_device+0x1a0/0x35c\n device_del+0x314/0x7f0\n device_unregister+0x20/0xbc\n apr_remove_device+0x5c/0x7c [apr]\n device_for_each_child+0xd8/0x160\n apr_pd_status+0x7c/0xa8 [apr]\n pdr_notifier_work+0x114/0x240 [pdr_interface]\n process_one_work+0x500/0xb70\n worker_thread+0x630/0xfb0\n kthread+0x370/0x6c0\n ret_from_fork+0x10/0x20"}],"id":"CVE-2026-31587","lastModified":"2026-06-17T10:34:02.077","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:33.597","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/110769a9aa51135ac7ce479a47dfb41924f37664"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/30383b7780ffa140bc124de5b66cae7c84133dbb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6ec1235fc941dac6c011b30ee01d9220ff87e0cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/887632163b546a8944b46ef465f1d74e838b727a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a561a55b79a9c55f0443377f2d4dcf6149d057af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b7412ed789ffb1e59c8d6f5ab6a6a718963c85e2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7b790531cdad3b2075ab937aa06d7b802403be4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/soc/qcom/qdsp6/q6apm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"110769a9aa51135ac7ce479a47dfb41924f37664","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"},{"lessThan":"887632163b546a8944b46ef465f1d74e838b727a","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"},{"lessThan":"b7412ed789ffb1e59c8d6f5ab6a6a718963c85e2","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"},{"lessThan":"30383b7780ffa140bc124de5b66cae7c84133dbb","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"},{"lessThan":"f7b790531cdad3b2075ab937aa06d7b802403be4","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"},{"lessThan":"a561a55b79a9c55f0443377f2d4dcf6149d057af","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"},{"lessThan":"6ec1235fc941dac6c011b30ee01d9220ff87e0cd","status":"affected","version":"5477518b8a0e8a45239646acd80c9bafc4401522","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/soc/qcom/qdsp6/q6apm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.16"},{"lessThan":"5.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8489BED4-A890-4712-813B-8F62B04F503D","versionEndExcluding":"6.6.136","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: q6apm: move component registration to unmanaged version\n\nq6apm component registers dais dynamically from ASoC toplology, which\nare allocated using device managed version apis. Allocating both\ncomponent and dynamic dais using managed version could lead to incorrect\nfree ordering, dai will be freed while component still holding references\nto it.\n\nFix this issue by moving component to unmanged version so\nthat the dai pointers are only freeded after the component is removed.\n\n==================================================================\nBUG: KASAN: slab-use-after-free in snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core]\nRead of size 8 at addr ffff00084493a6e8 by task kworker/u48:0/3426\nTainted: [W]=WARN\nHardware name: LENOVO 21N2ZC5PUS/21N2ZC5PUS, BIOS N42ET57W (1.31 ) 08/08/2024\nWorkqueue: pdr_notifier_wq pdr_notifier_work [pdr_interface]\nCall trace:\n show_stack+0x28/0x7c (C)\n dump_stack_lvl+0x60/0x80\n print_report+0x160/0x4b4\n kasan_report+0xac/0xfc\n __asan_report_load8_noabort+0x20/0x34\n snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core]\n snd_soc_unregister_component_by_driver+0x50/0x88 [snd_soc_core]\n devm_component_release+0x30/0x5c [snd_soc_core]\n devres_release_all+0x13c/0x210\n device_unbind_cleanup+0x20/0x190\n device_release_driver_internal+0x350/0x468\n device_release_driver+0x18/0x30\n bus_remove_device+0x1a0/0x35c\n device_del+0x314/0x7f0\n device_unregister+0x20/0xbc\n apr_remove_device+0x5c/0x7c [apr]\n device_for_each_child+0xd8/0x160\n apr_pd_status+0x7c/0xa8 [apr]\n pdr_notifier_work+0x114/0x240 [pdr_interface]\n process_one_work+0x500/0xb70\n worker_thread+0x630/0xfb0\n kthread+0x370/0x6c0\n ret_from_fork+0x10/0x20\n\nAllocated by task 77:\n kasan_save_stack+0x40/0x68\n kasan_save_track+0x20/0x40\n kasan_save_alloc_info+0x44/0x58\n __kasan_kmalloc+0xbc/0xdc\n __kmalloc_node_track_caller_noprof+0x1f4/0x620\n devm_kmalloc+0x7c/0x1c8\n snd_soc_register_dai+0x50/0x4f0 [snd_soc_core]\n soc_tplg_pcm_elems_load+0x55c/0x1eb8 [snd_soc_core]\n snd_soc_tplg_component_load+0x4f8/0xb60 [snd_soc_core]\n audioreach_tplg_init+0x124/0x1fc [snd_q6apm]\n q6apm_audio_probe+0x10/0x1c [snd_q6apm]\n snd_soc_component_probe+0x5c/0x118 [snd_soc_core]\n soc_probe_component+0x44c/0xaf0 [snd_soc_core]\n snd_soc_bind_card+0xad0/0x2370 [snd_soc_core]\n snd_soc_register_card+0x3b0/0x4c0 [snd_soc_core]\n devm_snd_soc_register_card+0x50/0xc8 [snd_soc_core]\n x1e80100_platform_probe+0x208/0x368 [snd_soc_x1e80100]\n platform_probe+0xc0/0x188\n really_probe+0x188/0x804\n __driver_probe_device+0x158/0x358\n driver_probe_device+0x60/0x190\n __device_attach_driver+0x16c/0x2a8\n bus_for_each_drv+0x100/0x194\n __device_attach+0x174/0x380\n device_initial_probe+0x14/0x20\n bus_probe_device+0x124/0x154\n deferred_probe_work_func+0x140/0x220\n process_one_work+0x500/0xb70\n worker_thread+0x630/0xfb0\n kthread+0x370/0x6c0\n ret_from_fork+0x10/0x20\n\nFreed by task 3426:\n kasan_save_stack+0x40/0x68\n kasan_save_track+0x20/0x40\n __kasan_save_free_info+0x4c/0x80\n __kasan_slab_free+0x78/0xa0\n kfree+0x100/0x4a4\n devres_release_all+0x144/0x210\n device_unbind_cleanup+0x20/0x190\n device_release_driver_internal+0x350/0x468\n device_release_driver+0x18/0x30\n bus_remove_device+0x1a0/0x35c\n device_del+0x314/0x7f0\n device_unregister+0x20/0xbc\n apr_remove_device+0x5c/0x7c [apr]\n device_for_each_child+0xd8/0x160\n apr_pd_status+0x7c/0xa8 [apr]\n pdr_notifier_work+0x114/0x240 [pdr_interface]\n process_one_work+0x500/0xb70\n worker_thread+0x630/0xfb0\n kthread+0x370/0x6c0\n ret_from_fork+0x10/0x20"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nASoC: qcom: q6apm: mover el registro de componentes a la versión no gestionada\n\nEl componente q6apm registra dais dinámicamente desde la topología ASoC, los cuales se asignan utilizando las APIs de la versión gestionada por el dispositivo. La asignación tanto del componente como de los dais dinámicos utilizando la versión gestionada podría llevar a un orden de liberación incorrecto; el dai será liberado mientras el componente aún mantiene referencias a él.\n\nSolucione este problema moviendo el componente a la versión no gestionada para que los punteros dai solo se liberen después de que el componente sea eliminado.\n\n==================================================================\nERROR: KASAN: uso después de liberación de slab en snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core]\nLectura de tamaño 8 en la dirección ffff00084493a6e8 por la tarea kworker/u48:0/3426\nContaminado: [W]=ADVERTENCIA\nNombre del hardware: LENOVO 21N2ZC5PUS/21N2ZC5PUS, BIOS N42ET57W (1.31 ) 08/08/2024\nCola de trabajo: pdr_notifier_wq pdr_notifier_work [pdr_interface]\nTraza de llamada:\n show_stack+0x28/0x7c (C)\n dump_stack_lvl+0x60/0x80\n print_report+0x160/0x4b4\n kasan_report+0xac/0xfc\n __asan_report_load8_noabort+0x20/0x34\n snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core]\n snd_soc_unregister_component_by_driver+0x50/0x88 [snd_soc_core]\n devm_component_release+0x30/0x5c [snd_soc_core]\n devres_release_all+0x13c/0x210\n device_unbind_cleanup+0x20/0x190\n device_release_driver_internal+0x350/0x468\n device_release_driver+0x18/0x30\n bus_remove_device+0x1a0/0x35c\n device_del+0x314/0x7f0\n device_unregister+0x20/0xbc\n apr_remove_device+0x5c/0x7c [apr]\n device_for_each_child+0xd8/0x160\n apr_pd_status+0x7c/0xa8 [apr]\n pdr_notifier_work+0x114/0x240 [pdr_interface]\n process_one_work+0x500/0xb70\n worker_thread+0x630/0xfb0\n kthread+0x370/0x6c0\n ret_from_fork+0x10/0x20\n\nAsignado por la tarea 77:\n kasan_save_stack+0x40/0x68\n kasan_save_track+0x20/0x40\n kasan_save_alloc_info+0x44/0x58\n __kasan_kmalloc+0xbc/0xdc\n __kmalloc_node_track_caller_noprof+0x1f4/0x620\n devm_kmalloc+0x7c/0x1c8\n snd_soc_register_dai+0x50/0x4f0 [snd_soc_core]\n soc_tplg_pcm_elems_load+0x55c/0x 1eb8 [snd_soc_core]\n snd_soc_tplg_component_load+0x4f8/0xb60 [snd_soc_core]\n audioreach_tplg_init+0x124/0x1fc [snd_q6apm]\n q6apm_audio_probe+0x10/0x1c [snd_q6apm]\n snd_soc_component_probe+0x5c/0x118 [snd_soc_core]\n soc_probe_component+0x44c/0xaf0 [snd_soc_core]\n snd_soc_bind_card+0xad0/0x 2370 [snd_soc_core]\n snd_soc_register_card+0x3b0/0x4c0 [snd_soc_core]\n devm_snd_soc_register_card+0x50/0xc8 [snd_soc_core]\n x1e80100_platform_probe+0x208/0x368 [snd_soc_x1e80100]\n platform_probe+0xc0/0x188\n really_probe+0x188/0x804\n __driver_probe_device+0x158/0x358\n driver_probe_device+0x60/0x190\n __device_attach_driver+0x16c/0x2a8\n bus_for_each_drv+0x100/0x194\n __device_attach+0x174/0x380\n device_initial_probe+0x14/0x20\n bus_probe_device+0x124/0x154\n deferred_probe_work_func+0x140/0x220\n process_one_work+0x500/0xb70\n worker_thread+0x630/0xfb0\n kthread+0x370/0x6c0\n ret_from_fork+0x10/0x20\n\nLiberado por la tarea 3426:\n kasan_save_stack+0x40/0x68\n kasan_save_track+0x20/0x40\n __kasan_save_free_info+0x4c/0x80\n __kasan_slab_free+0x78/0xa0\n kfree+0x100/0x4a4\n devres_release_all+0x144/0x210\n device_unbind_cleanup+0x20/0x190\n device_release_driver_internal+0x350/0x468\n device_release_driver+0x18/0x30\n bus_remove_device+0x1a0/0x35c\n device_del+0x314/0x7f0\n device_unregister+0x20/0xbc\n apr_remove_device+0x5c/0x7c [apr]\n device_for_each_child+0xd8/0x160\n apr_pd_status+0x7c/0xa8 [apr]\n pdr_notifier_work+0x114/0x240 [pdr_interface]\n process_one_work+0x500/0xb70\n worker_thread+0x630/0xfb0\n kthread+0x370/0x6c0\n ret_from_fork+0x10/0x20"}],"id":"CVE-2026-31587","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:33.597","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/110769a9aa51135ac7ce479a47dfb41924f37664"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/30383b7780ffa140bc124de5b66cae7c84133dbb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6ec1235fc941dac6c011b30ee01d9220ff87e0cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/887632163b546a8944b46ef465f1d74e838b727a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a561a55b79a9c55f0443377f2d4dcf6149d057af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b7412ed789ffb1e59c8d6f5ab6a6a718963c85e2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f7b790531cdad3b2075ab937aa06d7b802403be4"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31588.json b/data/2026/CVE-2026-31588.json index 95e916327b..d1018d294e 100644 --- a/data/2026/CVE-2026-31588.json +++ b/data/2026/CVE-2026-31588.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/x86.c","include/linux/kvm_host.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"019d0bd32b9a4646ba35d904907452039e2db700","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"4569c66dd9e94a22cd0796b6514a8b25ffff16a1","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"52570e73d48f1c73836d37e594667117b4c2a5a8","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"dc6a6c3db3a4eca7e747cfc46e22c08d016c68f7","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"b5a02d37eb0739f462fa12df449ab9b3480c783b","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"22d2ff69d487a32a8b88f9c970120fc2daa08a77","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"2b83d91e9ae92fe1258d7040a32430bbb3bb7d6e","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"3a7b6d75c8f85b09dea893f64a85a356bcf6c3fe","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"0b16e69d17d8c35c5c9d5918bf596c75a44655d3","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/x86.c","include/linux/kvm_host.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.5"},{"lessThan":"3.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5EC33E99-3133-4E9B-AAE4-A37179621C1E","versionEndExcluding":"6.6.136","versionStartIncluding":"3.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use scratch field in MMIO fragment to hold small write values\n\nWhen exiting to userspace to service an emulated MMIO write, copy the\nto-be-written value to a scratch field in the MMIO fragment if the size\nof the data payload is 8 bytes or less, i.e. can fit in a single chunk,\ninstead of pointing the fragment directly at the source value.\n\nThis fixes a class of use-after-free bugs that occur when the emulator\ninitiates a write using an on-stack, local variable as the source, the\nwrite splits a page boundary, *and* both pages are MMIO pages. Because\nKVM's ABI only allows for physically contiguous MMIO requests, accesses\nthat split MMIO pages are separated into two fragments, and are sent to\nuserspace one at a time. When KVM attempts to complete userspace MMIO in\nresponse to KVM_RUN after the first fragment, KVM will detect the second\nfragment and generate a second userspace exit, and reference the on-stack\nvariable.\n\nThe issue is most visible if the second KVM_RUN is performed by a separate\ntask, in which case the stack of the initiating task can show up as truly\nfreed data.\n\n ==================================================================\n BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420\n Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984\n\n CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:\n dump_stack+0xbe/0xfd\n print_address_description.constprop.0+0x19/0x170\n __kasan_report.cold+0x6c/0x84\n kasan_report+0x3a/0x50\n check_memory_region+0xfd/0x1f0\n memcpy+0x20/0x60\n complete_emulated_mmio+0x305/0x420\n kvm_arch_vcpu_ioctl_run+0x63f/0x6d0\n kvm_vcpu_ioctl+0x413/0xb20\n __se_sys_ioctl+0x111/0x160\n do_syscall_64+0x30/0x40\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n RIP: 0033:0x42477d\n Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\n RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d\n RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005\n RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c\n R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720\n\n The buggy address belongs to the page:\n page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37\n flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)\n raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n >ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ^\n ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ==================================================================\n\nThe bug can also be reproduced with a targeted KVM-Unit-Test by hacking\nKVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by\noverwrite the data value with garbage.\n\nLimit the use of the scratch fields to 8-byte or smaller accesses, and to\njust writes, as larger accesses and reads are not affected thanks to\nimplementation details in the emulator, but add a sanity check to ensure\nthose details don't change in the future. Specifically, KVM never uses\non-stack variables for accesses larger that 8 bytes, e.g. uses an operand\nin the emulator context, and *al\n---truncated---"}],"id":"CVE-2026-31588","lastModified":"2026-10-19T19:18:00.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:04.414089Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:33.733","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/019d0bd32b9a4646ba35d904907452039e2db700"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b16e69d17d8c35c5c9d5918bf596c75a44655d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/22d2ff69d487a32a8b88f9c970120fc2daa08a77"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b83d91e9ae92fe1258d7040a32430bbb3bb7d6e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a7b6d75c8f85b09dea893f64a85a356bcf6c3fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4569c66dd9e94a22cd0796b6514a8b25ffff16a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/52570e73d48f1c73836d37e594667117b4c2a5a8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5a02d37eb0739f462fa12df449ab9b3480c783b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dc6a6c3db3a4eca7e747cfc46e22c08d016c68f7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/x86.c","include/linux/kvm_host.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"019d0bd32b9a4646ba35d904907452039e2db700","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"4569c66dd9e94a22cd0796b6514a8b25ffff16a1","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"52570e73d48f1c73836d37e594667117b4c2a5a8","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"dc6a6c3db3a4eca7e747cfc46e22c08d016c68f7","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"b5a02d37eb0739f462fa12df449ab9b3480c783b","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"22d2ff69d487a32a8b88f9c970120fc2daa08a77","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"2b83d91e9ae92fe1258d7040a32430bbb3bb7d6e","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"3a7b6d75c8f85b09dea893f64a85a356bcf6c3fe","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"},{"lessThan":"0b16e69d17d8c35c5c9d5918bf596c75a44655d3","status":"affected","version":"f78146b0f9230765c6315b2e14f56112513389ad","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/x86.c","include/linux/kvm_host.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.5"},{"lessThan":"3.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5EC33E99-3133-4E9B-AAE4-A37179621C1E","versionEndExcluding":"6.6.136","versionStartIncluding":"3.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Use scratch field in MMIO fragment to hold small write values\n\nWhen exiting to userspace to service an emulated MMIO write, copy the\nto-be-written value to a scratch field in the MMIO fragment if the size\nof the data payload is 8 bytes or less, i.e. can fit in a single chunk,\ninstead of pointing the fragment directly at the source value.\n\nThis fixes a class of use-after-free bugs that occur when the emulator\ninitiates a write using an on-stack, local variable as the source, the\nwrite splits a page boundary, *and* both pages are MMIO pages. Because\nKVM's ABI only allows for physically contiguous MMIO requests, accesses\nthat split MMIO pages are separated into two fragments, and are sent to\nuserspace one at a time. When KVM attempts to complete userspace MMIO in\nresponse to KVM_RUN after the first fragment, KVM will detect the second\nfragment and generate a second userspace exit, and reference the on-stack\nvariable.\n\nThe issue is most visible if the second KVM_RUN is performed by a separate\ntask, in which case the stack of the initiating task can show up as truly\nfreed data.\n\n ==================================================================\n BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420\n Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984\n\n CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace:\n dump_stack+0xbe/0xfd\n print_address_description.constprop.0+0x19/0x170\n __kasan_report.cold+0x6c/0x84\n kasan_report+0x3a/0x50\n check_memory_region+0xfd/0x1f0\n memcpy+0x20/0x60\n complete_emulated_mmio+0x305/0x420\n kvm_arch_vcpu_ioctl_run+0x63f/0x6d0\n kvm_vcpu_ioctl+0x413/0xb20\n __se_sys_ioctl+0x111/0x160\n do_syscall_64+0x30/0x40\n entry_SYSCALL_64_after_hwframe+0x67/0xd1\n RIP: 0033:0x42477d\n Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\n RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d\n RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005\n RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c\n R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720\n\n The buggy address belongs to the page:\n page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c37\n flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)\n raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n >ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ^\n ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff\n ==================================================================\n\nThe bug can also be reproduced with a targeted KVM-Unit-Test by hacking\nKVM to fill a large on-stack variable in complete_emulated_mmio(), i.e. by\noverwrite the data value with garbage.\n\nLimit the use of the scratch fields to 8-byte or smaller accesses, and to\njust writes, as larger accesses and reads are not affected thanks to\nimplementation details in the emulator, but add a sanity check to ensure\nthose details don't change in the future. Specifically, KVM never uses\non-stack variables for accesses larger that 8 bytes, e.g. uses an operand\nin the emulator context, and *al\n---truncated---"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: KVM: x86: Usar campo temporal en fragmento MMIO para contener valores de escritura pequeños Al salir al espacio de usuario para atender una escritura MMIO emulada, copiar el valor a escribir a un campo temporal en el fragmento MMIO si el tamaño de la carga útil de datos es de 8 bytes o menos, es decir, puede caber en un solo bloque, en lugar de apuntar el fragmento directamente al valor de origen. Esto corrige una clase de errores de uso después de liberación que ocurren cuando el emulador inicia una escritura usando una variable local en la pila como origen, la escritura divide un límite de página, y ambas páginas son páginas MMIO. Debido a que la ABI de KVM solo permite solicitudes MMIO físicamente contiguas, los accesos que dividen páginas MMIO se separan en dos fragmentos y se envían al espacio de usuario uno a la vez. Cuando KVM intenta completar MMIO del espacio de usuario en respuesta a KVM_RUN después del primer fragmento, KVM detectará el segundo fragmento y generará una segunda salida al espacio de usuario, y hará referencia a la variable en la pila. El problema es más visible si el segundo KVM_RUN es realizado por una tarea separada, en cuyo caso la pila de la tarea iniciadora puede aparecer como datos verdaderamente liberados. ================================================================== BUG: KASAN: use-after-free in complete_emulated_mmio+0x305/0x420 Read of size 1 at addr ffff888009c378d1 by task syz-executor417/984 CPU: 1 PID: 984 Comm: syz-executor417 Not tainted 5.10.0-182.0.0.95.h2627.eulerosv2r13.x86_64 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack+0xbe/0xfd print_address_description.constprop.0+0x19/0x170 __kasan_report.cold+0x6c/0x84 kasan_report+0x3a/0x50 check_memory_region+0xfd/0x1f0 memcpy+0x20/0x60 complete_emulated_mmio+0x305/0x420 kvm_arch_vcpu_ioctl_run+0x63f/0x6d0 kvm_vcpu_ioctl+0x413/0xb20 __se_sys_ioctl+0x111/0x160 do_syscall_64+0x30/0x40 entry_SYSCALL_64_after_hwframe+0x67/0xd1 RIP: 0033:0x 42477d Code: menor que 48mayor que 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007faa8e6890e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000004d7338 RCX: 000000000042477d RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005 RBP: 00000000004d7330 R08: 00007fff28d546df R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d733c R13: 0000000000000000 R14: 000000000040a200 R15: 00007fff28d54720 The buggy address belongs to the page: page:0000000029f6a428 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x 9c37 flags: 0x fffffc0000000(node=0|zone=1|lastcpupid=0x 1fffff) raw: 000fffffc0000000 0000000000000000 ffffea0000270dc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888009c37780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888009c37800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888009c37880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888009c37900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888009c37980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== El error también puede reproducirse con una prueba unitaria de KVM dirigida modificando KVM para llenar una variable grande en la pila en complete_emulated_mmio(), es decir, sobrescribiendo el valor de los datos con basura. Limitar el uso de los campos temporales a accesos de 8 bytes o menos, y solo a escrituras, ya que los accesos y lecturas más grandes no se ven afectados gracias a detalles de implementación en el emulador, pero añadir una comprobación de cordura para asegurar --TRUNCADO--"}],"id":"CVE-2026-31588","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.0,"impactScore":6.0,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:04.414089Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:33.733","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/019d0bd32b9a4646ba35d904907452039e2db700"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b16e69d17d8c35c5c9d5918bf596c75a44655d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/22d2ff69d487a32a8b88f9c970120fc2daa08a77"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b83d91e9ae92fe1258d7040a32430bbb3bb7d6e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a7b6d75c8f85b09dea893f64a85a356bcf6c3fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4569c66dd9e94a22cd0796b6514a8b25ffff16a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/52570e73d48f1c73836d37e594667117b4c2a5a8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5a02d37eb0739f462fa12df449ab9b3480c783b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dc6a6c3db3a4eca7e747cfc46e22c08d016c68f7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31589.json b/data/2026/CVE-2026-31589.json index fe8b5a56d7..f0f072cf5c 100644 --- a/data/2026/CVE-2026-31589.json +++ b/data/2026/CVE-2026-31589.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/filemap.c","mm/internal.h","mm/truncate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"efc52947247a21bbf79059539bbbd40f4ea76f00","status":"affected","version":"fb7d3bc4149395c1ae99029c852eab6c28fc3c88","versionType":"git"},{"lessThan":"b667df39d98a7a24be7c2a40ff0863dac1ad2cd7","status":"affected","version":"fb7d3bc4149395c1ae99029c852eab6c28fc3c88","versionType":"git"},{"lessThan":"c330e65ea59c4805d6ab6757c4ddfe8c63acef31","status":"affected","version":"fb7d3bc4149395c1ae99029c852eab6c28fc3c88","versionType":"git"},{"lessThan":"615d9bb2ccad42f9e21d837431e401db2e471195","status":"affected","version":"fb7d3bc4149395c1ae99029c852eab6c28fc3c88","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/filemap.c","mm/internal.h","mm/truncate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.27","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"24221FC1-03CA-4C3B-99B7-27AFF9FC5FAE","versionEndExcluding":"6.19.14","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call ->free_folio() directly in folio_unmap_invalidate()\n\nWe can only call filemap_free_folio() if we have a reference to (or hold a\nlock on) the mapping. Otherwise, we've already removed the folio from the\nmapping so it no longer pins the mapping and the mapping can be removed,\ncausing a use-after-free when accessing mapping->a_ops.\n\nFollow the same pattern as __remove_mapping() and load the free_folio\nfunction pointer before dropping the lock on the mapping. That lets us\nmake filemap_free_folio() static as this was the only caller outside\nfilemap.c."}],"id":"CVE-2026-31589","lastModified":"2026-06-17T10:34:02.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:34.700","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/615d9bb2ccad42f9e21d837431e401db2e471195"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b667df39d98a7a24be7c2a40ff0863dac1ad2cd7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c330e65ea59c4805d6ab6757c4ddfe8c63acef31"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/efc52947247a21bbf79059539bbbd40f4ea76f00"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/filemap.c","mm/internal.h","mm/truncate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"efc52947247a21bbf79059539bbbd40f4ea76f00","status":"affected","version":"fb7d3bc4149395c1ae99029c852eab6c28fc3c88","versionType":"git"},{"lessThan":"b667df39d98a7a24be7c2a40ff0863dac1ad2cd7","status":"affected","version":"fb7d3bc4149395c1ae99029c852eab6c28fc3c88","versionType":"git"},{"lessThan":"c330e65ea59c4805d6ab6757c4ddfe8c63acef31","status":"affected","version":"fb7d3bc4149395c1ae99029c852eab6c28fc3c88","versionType":"git"},{"lessThan":"615d9bb2ccad42f9e21d837431e401db2e471195","status":"affected","version":"fb7d3bc4149395c1ae99029c852eab6c28fc3c88","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/filemap.c","mm/internal.h","mm/truncate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.27","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"24221FC1-03CA-4C3B-99B7-27AFF9FC5FAE","versionEndExcluding":"6.19.14","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call ->free_folio() directly in folio_unmap_invalidate()\n\nWe can only call filemap_free_folio() if we have a reference to (or hold a\nlock on) the mapping. Otherwise, we've already removed the folio from the\nmapping so it no longer pins the mapping and the mapping can be removed,\ncausing a use-after-free when accessing mapping->a_ops.\n\nFollow the same pattern as __remove_mapping() and load the free_folio\nfunction pointer before dropping the lock on the mapping. That lets us\nmake filemap_free_folio() static as this was the only caller outside\nfilemap.c."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm: llamar a -> free_folio() directamente en folio_unmap_invalidate()\n\nSolo podemos llamar a filemap_free_folio() si tenemos una referencia a (o mantenemos un bloqueo sobre) el mapeo. De lo contrario, ya hemos eliminado el folio del mapeo, por lo que ya no fija el mapeo y el mapeo puede ser eliminado, causando un uso después de liberación al acceder a mapping -> a_ops.\n\nSiga el mismo patrón que __remove_mapping() y cargue el puntero de función free_folio antes de liberar el bloqueo sobre el mapeo. Eso nos permite hacer filemap_free_folio() estática, ya que este era el único llamador fuera de filemap.c."}],"id":"CVE-2026-31589","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:34.700","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/615d9bb2ccad42f9e21d837431e401db2e471195"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b667df39d98a7a24be7c2a40ff0863dac1ad2cd7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c330e65ea59c4805d6ab6757c4ddfe8c63acef31"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/efc52947247a21bbf79059539bbbd40f4ea76f00"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31590.json b/data/2026/CVE-2026-31590.json index 3bf3547966..4a1e17728e 100644 --- a/data/2026/CVE-2026-31590.json +++ b/data/2026/CVE-2026-31590.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6a8e3c82122737529b25ef2a048fbcc569d8c055","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"a703933bcfa5cc76ca10e2048464600e74136099","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"abcd43ff579abd0a654bb4636086e78819dd5f4c","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"b670833749ffd8681361db2bb047c6f2e3075f3a","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"ab423e5892826202a660b5ac85d1125b0e8301a5","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"28cc13ca20431b127d42d84ba10898d03e2c8267","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"c29ff288a2d97a6f4640a498a367cf0eb91312eb","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"1cba4dcd795daf6d257122779fb6a349edf03914","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"8acffeef5ef720c35e513e322ab08e32683f32f2","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5F07F4AC-C44A-486A-9422-D8975351BA25","versionEndExcluding":"6.6.136","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION\n\nDrop the WARN in sev_pin_memory() on npages overflowing an int, as the\nWARN is comically trivially to trigger from userspace, e.g. by doing:\n\n struct kvm_enc_region range = {\n .addr = 0,\n .size = -1ul,\n };\n\n __vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, &range);\n\nNote, the checks in sev_mem_enc_register_region() that presumably exist to\nverify the incoming address+size are completely worthless, as both \"addr\"\nand \"size\" are u64s and SEV is 64-bit only, i.e. they _can't_ be greater\nthan ULONG_MAX. That wart will be cleaned up in the near future.\n\n\tif (range->addr > ULONG_MAX || range->size > ULONG_MAX)\n\t\treturn -EINVAL;\n\nOpportunistically add a comment to explain why the code calculates the\nnumber of pages the \"hard\" way, e.g. instead of just shifting @ulen."}],"id":"CVE-2026-31590","lastModified":"2026-11-06T16:18:02.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:14.418696Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:36.170","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1cba4dcd795daf6d257122779fb6a349edf03914"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/28cc13ca20431b127d42d84ba10898d03e2c8267"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6a8e3c82122737529b25ef2a048fbcc569d8c055"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8acffeef5ef720c35e513e322ab08e32683f32f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a703933bcfa5cc76ca10e2048464600e74136099"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ab423e5892826202a660b5ac85d1125b0e8301a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/abcd43ff579abd0a654bb4636086e78819dd5f4c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b670833749ffd8681361db2bb047c6f2e3075f3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c29ff288a2d97a6f4640a498a367cf0eb91312eb"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6a8e3c82122737529b25ef2a048fbcc569d8c055","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"a703933bcfa5cc76ca10e2048464600e74136099","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"abcd43ff579abd0a654bb4636086e78819dd5f4c","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"b670833749ffd8681361db2bb047c6f2e3075f3a","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"ab423e5892826202a660b5ac85d1125b0e8301a5","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"28cc13ca20431b127d42d84ba10898d03e2c8267","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"c29ff288a2d97a6f4640a498a367cf0eb91312eb","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"1cba4dcd795daf6d257122779fb6a349edf03914","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"},{"lessThan":"8acffeef5ef720c35e513e322ab08e32683f32f2","status":"affected","version":"78824fabc72e5e37d51e6e567fde70a4fc41a6d7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5F07F4AC-C44A-486A-9422-D8975351BA25","versionEndExcluding":"6.6.136","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION\n\nDrop the WARN in sev_pin_memory() on npages overflowing an int, as the\nWARN is comically trivially to trigger from userspace, e.g. by doing:\n\n struct kvm_enc_region range = {\n .addr = 0,\n .size = -1ul,\n };\n\n __vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, &range);\n\nNote, the checks in sev_mem_enc_register_region() that presumably exist to\nverify the incoming address+size are completely worthless, as both \"addr\"\nand \"size\" are u64s and SEV is 64-bit only, i.e. they _can't_ be greater\nthan ULONG_MAX. That wart will be cleaned up in the near future.\n\n\tif (range->addr > ULONG_MAX || range->size > ULONG_MAX)\n\t\treturn -EINVAL;\n\nOpportunistically add a comment to explain why the code calculates the\nnumber of pages the \"hard\" way, e.g. instead of just shifting @ulen."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nKVM: SEV: Eliminar WARN en tamaño grande para KVM_MEMORY_ENCRYPT_REG_REGION\n\nEliminar el WARN en sev_pin_memory() sobre npages desbordando un int, ya que el WARN es cómicamente trivial de activar desde el espacio de usuario, p. ej., haciendo:\n\n struct kvm_enc_region range = {\n .addr = 0,\n .size = -1ul,\n };\n\n __vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, ref:range);\n\nTenga en cuenta que las comprobaciones en sev_mem_enc_register_region() que presumiblemente existen para verificar la dirección+tamaño entrantes son completamente inútiles, ya que tanto ’addr’ como ’size’ son u64 y SEV es solo de 64 bits, es decir, _no pueden_ ser mayores que ULONG_MAX. Esa imperfección será corregida en un futuro cercano.\n\n\tif (range -> addr > ULONG_MAX || range -> size > ULONG_MAX)\n\t\treturn -EINVAL;\n\nSe añade oportunistamente un comentario para explicar por qué el código calcula el número de páginas de la manera ’difícil’, p. ej., en lugar de simplemente desplazar @ulen."}],"id":"CVE-2026-31590","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:14.418696Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:36.170","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1cba4dcd795daf6d257122779fb6a349edf03914"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/28cc13ca20431b127d42d84ba10898d03e2c8267"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6a8e3c82122737529b25ef2a048fbcc569d8c055"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8acffeef5ef720c35e513e322ab08e32683f32f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a703933bcfa5cc76ca10e2048464600e74136099"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ab423e5892826202a660b5ac85d1125b0e8301a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/abcd43ff579abd0a654bb4636086e78819dd5f4c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b670833749ffd8681361db2bb047c6f2e3075f3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c29ff288a2d97a6f4640a498a367cf0eb91312eb"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31591.json b/data/2026/CVE-2026-31591.json index 0f25c1c169..e4420342d6 100644 --- a/data/2026/CVE-2026-31591.json +++ b/data/2026/CVE-2026-31591.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"30fd9d8c82087742168db779929d8be0459b0716","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"4df77742e8b9a6b935bdf46f02fd0aca4d4ee7f5","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"c87938fc7d99a06a7e5477c45b4e5a4148f85d66","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"cb923ee6a80f4e604e6242a4702b59251e61a380","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"869D463B-A4DE-4ED4-8FBA-396042335402","versionEndExcluding":"6.18.24","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish\n\nLock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as\nallowing userspace to manipulate and/or run a vCPU while its state is being\nsynchronized would at best corrupt vCPU state, and at worst crash the host\nkernel.\n\nOpportunistically assert that vcpu->mutex is held when synchronizing its\nVMSA (the SEV-ES path already locks vCPUs)."}],"id":"CVE-2026-31591","lastModified":"2026-11-06T16:18:02.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31591","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:18.787773Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:36.480","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/30fd9d8c82087742168db779929d8be0459b0716"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4df77742e8b9a6b935bdf46f02fd0aca4d4ee7f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c87938fc7d99a06a7e5477c45b4e5a4148f85d66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cb923ee6a80f4e604e6242a4702b59251e61a380"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"30fd9d8c82087742168db779929d8be0459b0716","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"4df77742e8b9a6b935bdf46f02fd0aca4d4ee7f5","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"c87938fc7d99a06a7e5477c45b4e5a4148f85d66","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"cb923ee6a80f4e604e6242a4702b59251e61a380","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"869D463B-A4DE-4ED4-8FBA-396042335402","versionEndExcluding":"6.18.24","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish\n\nLock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as\nallowing userspace to manipulate and/or run a vCPU while its state is being\nsynchronized would at best corrupt vCPU state, and at worst crash the host\nkernel.\n\nOpportunistically assert that vcpu->mutex is held when synchronizing its\nVMSA (the SEV-ES path already locks vCPUs)."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nKVM: SEV: Bloquear todas las vCPU al sincronizar las VMSA para la finalización del lanzamiento de SNP\n\nBloquear todas las vCPU al sincronizar y cifrar las VMSA para los invitados SNP, ya que permitir que el espacio de usuario manipule y/o ejecute una vCPU mientras su estado está siendo sincronizado, en el mejor de los casos corrompería el estado de la vCPU, y en el peor de los casos, provocaría un fallo en el kernel del host.\n\nAfirmar de forma oportunista que vcpu -> mutex está retenido al sincronizar su VMSA (la ruta SEV-ES ya bloquea las vCPU)."}],"id":"CVE-2026-31591","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31591","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:18.787773Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:36.480","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/30fd9d8c82087742168db779929d8be0459b0716"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4df77742e8b9a6b935bdf46f02fd0aca4d4ee7f5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c87938fc7d99a06a7e5477c45b4e5a4148f85d66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cb923ee6a80f4e604e6242a4702b59251e61a380"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31592.json b/data/2026/CVE-2026-31592.json index 53436456fb..a1151b1941 100644 --- a/data/2026/CVE-2026-31592.json +++ b/data/2026/CVE-2026-31592.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c506405f438b3e739fa43d509d367d1946ad9ffe","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"},{"lessThan":"777a8ebd2da3529a455af022ed929408fdbb161f","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"},{"lessThan":"25c85d5831201391fb920d51067c6d93cce55348","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"},{"lessThan":"35a0963d361f98bba798fd15d229dcb166c04684","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"},{"lessThan":"ab725ac3022469ecd4d7aa7d5646712e98b249d8","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"},{"lessThan":"0ff93ff0ba82e9511770e175fa50682a1ab14fb6","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"},{"lessThan":"b6408b6cec5df76a165575777800ef2aba12b109","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4B2F764F-84E7-49EF-8E7A-C811DB6A0345","versionEndExcluding":"6.18.24","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock\n\nTake and hold kvm->lock for before checking sev_guest() in\nsev_mem_enc_register_region(), as sev_guest() isn't stable unless kvm->lock\nis held (or KVM can guarantee KVM_SEV_INIT{2} has completed and can't\nrollack state). If KVM_SEV_INIT{2} fails, KVM can end up trying to add to\na not-yet-initialized sev->regions_list, e.g. triggering a #GP\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n CPU: 110 UID: 0 PID: 72717 Comm: syz.15.11462 Tainted: G U W O 6.16.0-smp-DEV #1 NONE\n Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024\n RIP: 0010:sev_mem_enc_register_region+0x3f0/0x4f0 ../include/linux/list.h:83\n Code: <41> 80 3c 04 00 74 08 4c 89 ff e8 f1 c7 a2 00 49 39 ed 0f 84 c6 00\n RSP: 0018:ffff88838647fbb8 EFLAGS: 00010256\n RAX: dffffc0000000000 RBX: 1ffff92015cf1e0b RCX: dffffc0000000000\n RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff888367870000\n RBP: ffffc900ae78f050 R08: ffffea000d9e0007 R09: 1ffffd4001b3c000\n R10: dffffc0000000000 R11: fffff94001b3c001 R12: 0000000000000000\n R13: ffff8982ab0bde00 R14: ffffc900ae78f058 R15: 0000000000000000\n FS: 00007f34e9dc66c0(0000) GS:ffff89ee64d33000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fe180adef98 CR3: 000000047210e000 CR4: 0000000000350ef0\n Call Trace:\n \n kvm_arch_vm_ioctl+0xa72/0x1240 ../arch/x86/kvm/x86.c:7371\n kvm_vm_ioctl+0x649/0x990 ../virt/kvm/kvm_main.c:5363\n __se_sys_ioctl+0x101/0x170 ../fs/ioctl.c:51\n do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x6f/0x1f0 ../arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f34e9f7e9a9\n Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\n RSP: 002b:00007f34e9dc6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 00007f34ea1a6080 RCX: 00007f34e9f7e9a9\n RDX: 0000200000000280 RSI: 000000008010aebb RDI: 0000000000000007\n RBP: 00007f34ea000d69 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n R13: 0000000000000000 R14: 00007f34ea1a6080 R15: 00007ffce77197a8\n \n\nwith a syzlang reproducer that looks like:\n\n syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000180)=ANY=[], 0x70}) (async)\n syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000180)=ANY=[@ANYBLOB=\"...\"], 0x4f}) (async)\n r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)\n r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)\n r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)\n r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)\n ioctl$KVM_SET_CLOCK(r3, 0xc008aeba, &(0x7f0000000040)={0x1, 0x8, 0x0, 0x5625e9b0}) (async)\n ioctl$KVM_SET_PIT2(r3, 0x8010aebb, &(0x7f0000000280)={[...], 0x5}) (async)\n ioctl$KVM_SET_PIT2(r1, 0x4070aea0, 0x0) (async)\n r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)\n openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async)\n ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) (async)\n r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2)\n close(r0) (async)\n openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) (async)\n ioctl$KVM_SET_GUEST_DEBUG(r5, 0x4048ae9b, &(0x7f0000000300)={0x4376ea830d46549b, 0x0, [0x46, 0x0, 0x0, 0x0, 0x0, 0x1000]}) (async)\n ioctl$KVM_RUN(r5, 0xae80, 0x0)\n\nOpportunistically use guard() to avoid having to define a new error label\nand goto usage."}],"id":"CVE-2026-31592","lastModified":"2026-11-06T16:18:02.577","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31592","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:24.681502Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:36.667","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0ff93ff0ba82e9511770e175fa50682a1ab14fb6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/25c85d5831201391fb920d51067c6d93cce55348"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/35a0963d361f98bba798fd15d229dcb166c04684"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/777a8ebd2da3529a455af022ed929408fdbb161f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ab725ac3022469ecd4d7aa7d5646712e98b249d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b6408b6cec5df76a165575777800ef2aba12b109"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c506405f438b3e739fa43d509d367d1946ad9ffe"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c506405f438b3e739fa43d509d367d1946ad9ffe","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"},{"lessThan":"777a8ebd2da3529a455af022ed929408fdbb161f","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"},{"lessThan":"25c85d5831201391fb920d51067c6d93cce55348","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"},{"lessThan":"35a0963d361f98bba798fd15d229dcb166c04684","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"},{"lessThan":"ab725ac3022469ecd4d7aa7d5646712e98b249d8","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"},{"lessThan":"0ff93ff0ba82e9511770e175fa50682a1ab14fb6","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"},{"lessThan":"b6408b6cec5df76a165575777800ef2aba12b109","status":"affected","version":"1e80fdc09d121d8327cdf62eefbb5abadddca792","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.16"},{"lessThan":"4.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4B2F764F-84E7-49EF-8E7A-C811DB6A0345","versionEndExcluding":"6.18.24","versionStartIncluding":"4.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock\n\nTake and hold kvm->lock for before checking sev_guest() in\nsev_mem_enc_register_region(), as sev_guest() isn't stable unless kvm->lock\nis held (or KVM can guarantee KVM_SEV_INIT{2} has completed and can't\nrollack state). If KVM_SEV_INIT{2} fails, KVM can end up trying to add to\na not-yet-initialized sev->regions_list, e.g. triggering a #GP\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n CPU: 110 UID: 0 PID: 72717 Comm: syz.15.11462 Tainted: G U W O 6.16.0-smp-DEV #1 NONE\n Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE\n Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024\n RIP: 0010:sev_mem_enc_register_region+0x3f0/0x4f0 ../include/linux/list.h:83\n Code: <41> 80 3c 04 00 74 08 4c 89 ff e8 f1 c7 a2 00 49 39 ed 0f 84 c6 00\n RSP: 0018:ffff88838647fbb8 EFLAGS: 00010256\n RAX: dffffc0000000000 RBX: 1ffff92015cf1e0b RCX: dffffc0000000000\n RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff888367870000\n RBP: ffffc900ae78f050 R08: ffffea000d9e0007 R09: 1ffffd4001b3c000\n R10: dffffc0000000000 R11: fffff94001b3c001 R12: 0000000000000000\n R13: ffff8982ab0bde00 R14: ffffc900ae78f058 R15: 0000000000000000\n FS: 00007f34e9dc66c0(0000) GS:ffff89ee64d33000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fe180adef98 CR3: 000000047210e000 CR4: 0000000000350ef0\n Call Trace:\n \n kvm_arch_vm_ioctl+0xa72/0x1240 ../arch/x86/kvm/x86.c:7371\n kvm_vm_ioctl+0x649/0x990 ../virt/kvm/kvm_main.c:5363\n __se_sys_ioctl+0x101/0x170 ../fs/ioctl.c:51\n do_syscall_x64 ../arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x6f/0x1f0 ../arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f34e9f7e9a9\n Code: <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\n RSP: 002b:00007f34e9dc6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 00007f34ea1a6080 RCX: 00007f34e9f7e9a9\n RDX: 0000200000000280 RSI: 000000008010aebb RDI: 0000000000000007\n RBP: 00007f34ea000d69 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n R13: 0000000000000000 R14: 00007f34ea1a6080 R15: 00007ffce77197a8\n \n\nwith a syzlang reproducer that looks like:\n\n syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000180)=ANY=[], 0x70}) (async)\n syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000180)=ANY=[@ANYBLOB=\"...\"], 0x4f}) (async)\n r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)\n r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)\n r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)\n r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)\n ioctl$KVM_SET_CLOCK(r3, 0xc008aeba, &(0x7f0000000040)={0x1, 0x8, 0x0, 0x5625e9b0}) (async)\n ioctl$KVM_SET_PIT2(r3, 0x8010aebb, &(0x7f0000000280)={[...], 0x5}) (async)\n ioctl$KVM_SET_PIT2(r1, 0x4070aea0, 0x0) (async)\n r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)\n openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async)\n ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) (async)\n r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2)\n close(r0) (async)\n openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) (async)\n ioctl$KVM_SET_GUEST_DEBUG(r5, 0x4048ae9b, &(0x7f0000000300)={0x4376ea830d46549b, 0x0, [0x46, 0x0, 0x0, 0x0, 0x0, 0x1000]}) (async)\n ioctl$KVM_RUN(r5, 0xae80, 0x0)\n\nOpportunistically use guard() to avoid having to define a new error label\nand goto usage."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: KVM: SEV: Proteger toda sev_mem_enc_register_region() con kvm -> lock Tomar y mantener kvm -> lock antes de verificar sev_guest() en sev_mem_enc_register_region(), ya que sev_guest() no es estable a menos que kvm -> lock esté mantenido (o KVM pueda garantizar que KVM_SEV_INIT{2} se ha completado y no puede revertir el estado). Si KVM_SEV_INIT{2} falla, KVM puede terminar intentando añadir a una sev -> regions_list aún no inicializada, p. ej., desencadenando un #GP Oops: fallo de protección general, probablemente para la dirección no canónica 0x dffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: desreferencia de puntero nulo en el rango [0x 0000000000000000-0x 0000000000000007] CPU: 110 UID: 0 PID: 72717 Comando: syz.15.11462 Contaminado: G U W O 6.16.0-smp-DEV #1 NONE Contaminado: [U]=USER, [W]=WARN, [O]=OOT_MODULE Nombre del hardware: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.52.0-0 10/28/2024 RIP: 0010:sev_mem_enc_register_region+0x3f0/0x4f0 .. / include/linux/list.h:83 Code: menor que 41mayor que 80 3c 04 00 74 08 4c 89 ff e8 f1 c7 a2 00 49 39 ed 0f 84 c6 00 RSP: 0018:ffff88838647fbb8 EFLAGS: 00010256 RAX: dffffc0000000000 RBX: 1ffff92015cf1e0b RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff888367870000 RBP: ffffc900ae78f050 R08: ffffea000d9e0007 R09: 1ffffd4001b3c000 R10: dffffc0000000000 R11: fffff94001b3c001 R12: 0000000000000000 R13: ffff8982ab0bde00 R14: ffffc900ae78f058 R15: 0000000000000000 FS: 00007f34e9dc66c0(0000) GS:ffff89ee64d33000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe180adef98 CR3: 000000047210e000 CR4: 0000000000350ef0 Rastro de llamadas: [TAREA] kvm_arch_vm_ioctl+0xa72/0x 1240 .. / arch/x86/kvm/x86.c:7371 kvm_vm_ioctl+0x649/0x990 .. / virt/kvm/kvm_main.c:5363 __se_sys_ioctl+0x101/0x170 .. / fs/ioctl.c:51 do_syscall_x64 .. / arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x6f/0x1f0 .. / arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x 7f34e9f7e9a9 Code: menor que 48mayor que 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f34e9dc6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f34ea1a6080 RCX: 00007f34e9f7e9a9 RDX: 0000200000000280 RSI: 000000008010aebb RDI: 0000000000000007 RBP: 00007f34ea000d69 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f34ea1a6080 R15: 00007ffce77197a8 [/TAREA] con un reproductor syzlang que se ve así: syz_kvm_add_vcpu$x86(0x0, y (0x 7f0000000040)={0x0, y (0x 7f0000000180)=ANY=[], 0x70}) (async) syz_kvm_add_vcpu$x86(0x0, y (0x 7f0000000080)={0x0, y (0x 7f0000000180)=ANY=[@ANYBLOB=“...”], 0x4f}) (async) r0 = openat$kvm(0x ffffffffffffff9c, y (0x 7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0x ae01, 0x0) r2 = openat$kvm(0x ffffffffffffff9c, y (0x 7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0x ae01, 0x0) ioctl$KVM_SET_CLOCK(r3, 0x c008aeba, y (0x 7f0000000040)={0x1, 0x8, 0x0, 0x 5625e9b0}) (async) ioctl$KVM_SET_PIT2(r3, 0x 8010aebb, y (0x 7f0000000280)={[...], 0x5}) (async) ioctl$KVM_SET_PIT2(r1, 0x 4070aea0, 0x0) (async) r4 = ioctl$KVM_CREATE_VM(0x ffffffffffffffff, 0x ae01, 0x0) openat$kvm(0x ffffffffffffff9c, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x 4020ae46, y (0x 7f0000000400)={0x0, 0x0, 0x0, 0x 2000, y (0x 7f0000001000/0x 2000)=nil}) (async) r5 = ioctl$KVM_CREATE_VCPU(r4, 0x ae41, 0x2) close(r0) (async) openat$kvm(0x ffffffffffffff9c, y (0x 7f0000000000), 0x 8000, 0x0) (async) ioctl$KVM_SET_GUEST_DEBUG(r5, 0x 4048ae9b, y (0x 7f0000000300)={0x 4376ea830d46549b, 0x0, [0x46, 0x0, 0x0, 0x0, 0x0, 0x 1000]}) (async) ioctl$KVM_RUN(r5, 0x ae80, 0x0) Usar guard() de forma oportunista para evitar tener que definir una nueva etiqueta de error y el uso de goto."}],"id":"CVE-2026-31592","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31592","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:24.681502Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:36.667","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0ff93ff0ba82e9511770e175fa50682a1ab14fb6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/25c85d5831201391fb920d51067c6d93cce55348"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/35a0963d361f98bba798fd15d229dcb166c04684"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/777a8ebd2da3529a455af022ed929408fdbb161f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ab725ac3022469ecd4d7aa7d5646712e98b249d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b6408b6cec5df76a165575777800ef2aba12b109"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c506405f438b3e739fa43d509d367d1946ad9ffe"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31593.json b/data/2026/CVE-2026-31593.json index 0abad38b82..64851481cb 100644 --- a/data/2026/CVE-2026-31593.json +++ b/data/2026/CVE-2026-31593.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c9609847ae65ca36233077c2b6cb2bc0fb37c77a","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"692fdf05e55fa03960a1278afdc2478c12daea13","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"6ef109e01e1d35199e1a97ea68bdfd3cf3fbf9ab","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"8f85a4885eee8cb495961ffa371a91828afb9445","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"9b9f7962e3e879d12da2bf47e02a24ec51690e3d","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ABF3F6D0-27D6-43E7-BF38-1B493B03EC1F","versionEndExcluding":"6.12.83","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU\n\nReject synchronizing vCPU state to its associated VMSA if the vCPU has\nalready been launched, i.e. if the VMSA has already been encrypted. On a\nhost with SNP enabled, accessing guest-private memory generates an RMP #PF\nand panics the host.\n\n BUG: unable to handle page fault for address: ff1276cbfdf36000\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x80000003) - RMP violation\n PGD 5a31801067 P4D 5a31802067 PUD 40ccfb5063 PMD 40e5954063 PTE 80000040fdf36163\n SEV-SNP: PFN 0x40fdf36, RMP entry: [0x6010fffffffff001 - 0x000000000000001f]\n Oops: Oops: 0003 [#1] SMP NOPTI\n CPU: 33 UID: 0 PID: 996180 Comm: qemu-system-x86 Tainted: G OE\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Hardware name: Dell Inc. PowerEdge R7625/0H1TJT, BIOS 1.5.8 07/21/2023\n RIP: 0010:sev_es_sync_vmsa+0x54/0x4c0 [kvm_amd]\n Call Trace:\n \n snp_launch_update_vmsa+0x19d/0x290 [kvm_amd]\n snp_launch_finish+0xb6/0x380 [kvm_amd]\n sev_mem_enc_ioctl+0x14e/0x720 [kvm_amd]\n kvm_arch_vm_ioctl+0x837/0xcf0 [kvm]\n kvm_vm_ioctl+0x3fd/0xcc0 [kvm]\n __x64_sys_ioctl+0xa3/0x100\n x64_sys_call+0xfe0/0x2350\n do_syscall_64+0x81/0x10f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7ffff673287d\n \n\nNote, the KVM flaw has been present since commit ad73109ae7ec (\"KVM: SVM:\nProvide support to launch and run an SEV-ES guest\"), but has only been\nactively dangerous for the host since SNP support was added. With SEV-ES,\nKVM would \"just\" clobber guest state, which is totally fine from a host\nkernel perspective since userspace can clobber guest state any time before\nsev_launch_update_vmsa()."}],"id":"CVE-2026-31593","lastModified":"2026-11-06T16:18:02.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31593","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:29.586532Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:36.957","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/692fdf05e55fa03960a1278afdc2478c12daea13"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6ef109e01e1d35199e1a97ea68bdfd3cf3fbf9ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f85a4885eee8cb495961ffa371a91828afb9445"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b9f7962e3e879d12da2bf47e02a24ec51690e3d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c9609847ae65ca36233077c2b6cb2bc0fb37c77a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c9609847ae65ca36233077c2b6cb2bc0fb37c77a","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"692fdf05e55fa03960a1278afdc2478c12daea13","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"6ef109e01e1d35199e1a97ea68bdfd3cf3fbf9ab","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"8f85a4885eee8cb495961ffa371a91828afb9445","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"},{"lessThan":"9b9f7962e3e879d12da2bf47e02a24ec51690e3d","status":"affected","version":"ad27ce155566f2b4400fa865859834592bd18777","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/kvm/svm/sev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.11"},{"lessThan":"6.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ABF3F6D0-27D6-43E7-BF38-1B493B03EC1F","versionEndExcluding":"6.12.83","versionStartIncluding":"6.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU\n\nReject synchronizing vCPU state to its associated VMSA if the vCPU has\nalready been launched, i.e. if the VMSA has already been encrypted. On a\nhost with SNP enabled, accessing guest-private memory generates an RMP #PF\nand panics the host.\n\n BUG: unable to handle page fault for address: ff1276cbfdf36000\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x80000003) - RMP violation\n PGD 5a31801067 P4D 5a31802067 PUD 40ccfb5063 PMD 40e5954063 PTE 80000040fdf36163\n SEV-SNP: PFN 0x40fdf36, RMP entry: [0x6010fffffffff001 - 0x000000000000001f]\n Oops: Oops: 0003 [#1] SMP NOPTI\n CPU: 33 UID: 0 PID: 996180 Comm: qemu-system-x86 Tainted: G OE\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Hardware name: Dell Inc. PowerEdge R7625/0H1TJT, BIOS 1.5.8 07/21/2023\n RIP: 0010:sev_es_sync_vmsa+0x54/0x4c0 [kvm_amd]\n Call Trace:\n \n snp_launch_update_vmsa+0x19d/0x290 [kvm_amd]\n snp_launch_finish+0xb6/0x380 [kvm_amd]\n sev_mem_enc_ioctl+0x14e/0x720 [kvm_amd]\n kvm_arch_vm_ioctl+0x837/0xcf0 [kvm]\n kvm_vm_ioctl+0x3fd/0xcc0 [kvm]\n __x64_sys_ioctl+0xa3/0x100\n x64_sys_call+0xfe0/0x2350\n do_syscall_64+0x81/0x10f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7ffff673287d\n \n\nNote, the KVM flaw has been present since commit ad73109ae7ec (\"KVM: SVM:\nProvide support to launch and run an SEV-ES guest\"), but has only been\nactively dangerous for the host since SNP support was added. With SEV-ES,\nKVM would \"just\" clobber guest state, which is totally fine from a host\nkernel perspective since userspace can clobber guest state any time before\nsev_launch_update_vmsa()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nKVM: SEV: Rechazar intentos de sincronizar la VMSA de una vCPU ya iniciada/cifrada\n\nRechazar la sincronización del estado de la vCPU con su VMSA asociada si la vCPU ya ha sido iniciada, es decir, si la VMSA ya ha sido cifrada. En un host con SNP habilitado, acceder a la memoria privada del invitado genera un RMP #PF y provoca un pánico en el host.\n\n ERROR: no se puede manejar el fallo de página para la dirección: ff1276cbfdf36000\n #PF: acceso de escritura de supervisor en modo kernel\n #PF: error_code(0x 80000003) - violación de RMP\n PGD 5a31801067 P4D 5a31802067 PUD 40ccfb5063 PMD 40e5954063 PTE 80000040fdf36163\n SEV-SNP: PFN 0x 40fdf36, RMP entry: [0x 6010fffffffff001 - 0x 000000000000001f]\n Oops: Oops: 0003 [#1] SMP NOPTI\n CPU: 33 UID: 0 PID: 996180 Comm: qemu-system-x86 Tainted: G OE\n Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\n Nombre del hardware: Dell Inc. PowerEdge R7625/0H1TJT, BIOS 1.5.8 07/21/2023\n RIP: 0010:sev_es_sync_vmsa+0x54/0x4c0 [kvm_amd]\n Rastro de Llamada:\n [TAREA]\n snp_launch_update_vmsa+0x19d/0x290 [kvm_amd]\n snp_launch_finish+0xb6/0x380 [kvm_amd]\n sev_mem_enc_ioctl+0x14e/0x720 [kvm_amd]\n kvm_arch_vm_ioctl+0x837/0xcf0 [kvm]\n kvm_vm_ioctl+0x3fd/0xcc0 [kvm]\n __x64_sys_ioctl+0xa3/0x100\n x64_sys_call+0xfe0/0x 2350\n do_syscall_64+0x81/0x 10f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x 7ffff673287d\n [/TAREA]\n\nTenga en cuenta que el fallo de KVM ha estado presente desde el commit ad73109ae7ec (’KVM: SVM: Proporcionar soporte para iniciar y ejecutar un invitado SEV-ES’), pero solo ha sido activamente peligroso para el host desde que se añadió el soporte para SNP. Con SEV-ES, KVM ’simplemente’ sobrescribiría el estado del invitado, lo cual está totalmente bien desde la perspectiva del kernel del host ya que el espacio de usuario puede sobrescribir el estado del invitado en cualquier momento antes de sev_launch_update_vmsa()."}],"id":"CVE-2026-31593","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31593","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:29.586532Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:36.957","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/692fdf05e55fa03960a1278afdc2478c12daea13"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6ef109e01e1d35199e1a97ea68bdfd3cf3fbf9ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f85a4885eee8cb495961ffa371a91828afb9445"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b9f7962e3e879d12da2bf47e02a24ec51690e3d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c9609847ae65ca36233077c2b6cb2bc0fb37c77a"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31594.json b/data/2026/CVE-2026-31594.json index 4b70c3a17a..89634f3aa8 100644 --- a/data/2026/CVE-2026-31594.json +++ b/data/2026/CVE-2026-31594.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pci/endpoint/functions/pci-epf-vntb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"305a0674bc552bfcc3231e23fb91cf4f62aec168","status":"affected","version":"e2b6ef72b7aea9d7d480d2df499bcd1c93247abb","versionType":"git"},{"lessThan":"b261027a1a235d8925e332363f23135a0eff2b35","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"e238ab12556b00f3b4d8b870b32ba1e4f4d4ebc2","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"73bf218de28d039126dc64281d2b47dd3c46a0a3","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"cec9ead73ab154a7953f6ab8dd5127e0d6bbf95a","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"478e776101592eb63298714e96823ef78a3295ec","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"a7a3cab4d33fd8a8aed864c447d0d7c99e85404e","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"0da63230d3ec1ec5fcc443a2314233e95bfece54","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"5.15.209","status":"affected","version":"5.15.153","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pci/endpoint/functions/pci-epf-vntb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.0"},{"lessThan":"6.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"32F2F3AC-7267-4B2D-B7B6-883A16558607","versionEndExcluding":"6.6.136","versionStartIncluding":"6.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown\n\nepf_ntb_epc_destroy() duplicates the teardown that the caller is\nsupposed to perform later. This leads to an oops when .allow_link fails\nor when .drop_link is performed. The following is an example oops of the\nformer case:\n\n Unable to handle kernel paging request at virtual address dead000000000108\n [...]\n [dead000000000108] address between user and kernel address ranges\n Internal error: Oops: 0000000096000044 [#1] SMP\n [...]\n Call trace:\n pci_epc_remove_epf+0x78/0xe0 (P)\n pci_primary_epc_epf_link+0x88/0xa8\n configfs_symlink+0x1f4/0x5a0\n vfs_symlink+0x134/0x1d8\n do_symlinkat+0x88/0x138\n __arm64_sys_symlinkat+0x74/0xe0\n [...]\n\nRemove the helper, and drop pci_epc_put(). EPC device refcounting is\ntied to the configfs EPC group lifetime, and pci_epc_put() in the\n.drop_link path is sufficient."}],"id":"CVE-2026-31594","lastModified":"2026-06-17T10:34:03.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:37.087","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0da63230d3ec1ec5fcc443a2314233e95bfece54"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/305a0674bc552bfcc3231e23fb91cf4f62aec168"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/478e776101592eb63298714e96823ef78a3295ec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/73bf218de28d039126dc64281d2b47dd3c46a0a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7a3cab4d33fd8a8aed864c447d0d7c99e85404e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b261027a1a235d8925e332363f23135a0eff2b35"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cec9ead73ab154a7953f6ab8dd5127e0d6bbf95a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e238ab12556b00f3b4d8b870b32ba1e4f4d4ebc2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pci/endpoint/functions/pci-epf-vntb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"305a0674bc552bfcc3231e23fb91cf4f62aec168","status":"affected","version":"e2b6ef72b7aea9d7d480d2df499bcd1c93247abb","versionType":"git"},{"lessThan":"b261027a1a235d8925e332363f23135a0eff2b35","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"e238ab12556b00f3b4d8b870b32ba1e4f4d4ebc2","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"73bf218de28d039126dc64281d2b47dd3c46a0a3","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"cec9ead73ab154a7953f6ab8dd5127e0d6bbf95a","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"478e776101592eb63298714e96823ef78a3295ec","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"a7a3cab4d33fd8a8aed864c447d0d7c99e85404e","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"0da63230d3ec1ec5fcc443a2314233e95bfece54","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"5.15.209","status":"affected","version":"5.15.153","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pci/endpoint/functions/pci-epf-vntb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.0"},{"lessThan":"6.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"32F2F3AC-7267-4B2D-B7B6-883A16558607","versionEndExcluding":"6.6.136","versionStartIncluding":"6.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown\n\nepf_ntb_epc_destroy() duplicates the teardown that the caller is\nsupposed to perform later. This leads to an oops when .allow_link fails\nor when .drop_link is performed. The following is an example oops of the\nformer case:\n\n Unable to handle kernel paging request at virtual address dead000000000108\n [...]\n [dead000000000108] address between user and kernel address ranges\n Internal error: Oops: 0000000096000044 [#1] SMP\n [...]\n Call trace:\n pci_epc_remove_epf+0x78/0xe0 (P)\n pci_primary_epc_epf_link+0x88/0xa8\n configfs_symlink+0x1f4/0x5a0\n vfs_symlink+0x134/0x1d8\n do_symlinkat+0x88/0x138\n __arm64_sys_symlinkat+0x74/0xe0\n [...]\n\nRemove the helper, and drop pci_epc_put(). EPC device refcounting is\ntied to the configfs EPC group lifetime, and pci_epc_put() in the\n.drop_link path is sufficient."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nPCI: endpoint: pci-epf-vntb: Eliminar la desasignación duplicada de recursos\n\nepf_ntb_epc_destroy() duplica la desasignación que se supone que el llamador debe realizar más tarde. Esto provoca un ’oops’ cuando .allow_link falla o cuando se realiza .drop_link. El siguiente es un ejemplo de ’oops’ del primer caso:\n\n No se puede manejar la solicitud de paginación del kernel en la dirección virtual dead000000000108\n [...]\n [dead000000000108] dirección entre los rangos de direcciones de usuario y kernel\n Error interno: Oops: 0000000096000044 [#1] SMP\n [...]\n Traza de llamadas:\n pci_epc_remove_epf+0x78/0xe0 (P)\n pci_primary_epc_epf_link+0x88/0xa8\n configfs_symlink+0x1f4/0x5a0\n vfs_symlink+0x134/0x1d8\n do_symlinkat+0x88/0x138\n __arm64_sys_symlinkat+0x74/0xe0\n [...]\n\nEliminar la función auxiliar y eliminar pci_epc_put(). El conteo de referencias del dispositivo EPC está ligado a la vida útil del grupo EPC de configfs, y pci_epc_put() en la ruta .drop_link es suficiente."}],"id":"CVE-2026-31594","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:37.087","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0da63230d3ec1ec5fcc443a2314233e95bfece54"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/305a0674bc552bfcc3231e23fb91cf4f62aec168"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/478e776101592eb63298714e96823ef78a3295ec"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/73bf218de28d039126dc64281d2b47dd3c46a0a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7a3cab4d33fd8a8aed864c447d0d7c99e85404e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b261027a1a235d8925e332363f23135a0eff2b35"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cec9ead73ab154a7953f6ab8dd5127e0d6bbf95a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e238ab12556b00f3b4d8b870b32ba1e4f4d4ebc2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31595.json b/data/2026/CVE-2026-31595.json index 7cc6e93d37..64689b49be 100644 --- a/data/2026/CVE-2026-31595.json +++ b/data/2026/CVE-2026-31595.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pci/endpoint/functions/pci-epf-vntb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b2eb405bbced3a6e772545e1b74dbde37cee1f8f","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"ceb73484e7204f661f770069ecdf35f6e941879c","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"6773cc24c004930903a57761132c1e7728907f8f","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"9921cce25bfe4021f6e55ca995351eb967165297","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"5999067140c67530a6cb6f41a8471596e60452cb","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"fbb6c353fa2fb5f5f990eda034a1074b0356127e","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"d799984233a50abd2667a7d17a9a710a3f10ebe2","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"status":"affected","version":"e2b6ef72b7aea9d7d480d2df499bcd1c93247abb","versionType":"git"},{"lessThan":"5.16","status":"affected","version":"5.15.153","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pci/endpoint/functions/pci-epf-vntb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.0"},{"lessThan":"6.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"32F2F3AC-7267-4B2D-B7B6-883A16558607","versionEndExcluding":"6.6.136","versionStartIncluding":"6.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup\n\nDisable the delayed work before clearing BAR mappings and doorbells to\navoid running the handler after resources have been torn down.\n\n Unable to handle kernel paging request at virtual address ffff800083f46004\n [...]\n Internal error: Oops: 0000000096000007 [#1] SMP\n [...]\n Call trace:\n epf_ntb_cmd_handler+0x54/0x200 [pci_epf_vntb] (P)\n process_one_work+0x154/0x3b0\n worker_thread+0x2c8/0x400\n kthread+0x148/0x210\n ret_from_fork+0x10/0x20"}],"id":"CVE-2026-31595","lastModified":"2026-06-17T10:34:03.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:37.237","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5999067140c67530a6cb6f41a8471596e60452cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6773cc24c004930903a57761132c1e7728907f8f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9921cce25bfe4021f6e55ca995351eb967165297"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b2eb405bbced3a6e772545e1b74dbde37cee1f8f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ceb73484e7204f661f770069ecdf35f6e941879c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d799984233a50abd2667a7d17a9a710a3f10ebe2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbb6c353fa2fb5f5f990eda034a1074b0356127e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pci/endpoint/functions/pci-epf-vntb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b2eb405bbced3a6e772545e1b74dbde37cee1f8f","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"ceb73484e7204f661f770069ecdf35f6e941879c","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"6773cc24c004930903a57761132c1e7728907f8f","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"9921cce25bfe4021f6e55ca995351eb967165297","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"5999067140c67530a6cb6f41a8471596e60452cb","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"fbb6c353fa2fb5f5f990eda034a1074b0356127e","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"lessThan":"d799984233a50abd2667a7d17a9a710a3f10ebe2","status":"affected","version":"e35f56bb03304abc92c928b641af41ca372966bb","versionType":"git"},{"status":"affected","version":"e2b6ef72b7aea9d7d480d2df499bcd1c93247abb","versionType":"git"},{"lessThan":"5.16","status":"affected","version":"5.15.153","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pci/endpoint/functions/pci-epf-vntb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.0"},{"lessThan":"6.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"32F2F3AC-7267-4B2D-B7B6-883A16558607","versionEndExcluding":"6.6.136","versionStartIncluding":"6.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup\n\nDisable the delayed work before clearing BAR mappings and doorbells to\navoid running the handler after resources have been torn down.\n\n Unable to handle kernel paging request at virtual address ffff800083f46004\n [...]\n Internal error: Oops: 0000000096000007 [#1] SMP\n [...]\n Call trace:\n epf_ntb_cmd_handler+0x54/0x200 [pci_epf_vntb] (P)\n process_one_work+0x154/0x3b0\n worker_thread+0x2c8/0x400\n kthread+0x148/0x210\n ret_from_fork+0x10/0x20"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nPCI: endpoint: pci-epf-vntb: Detener el trabajo de cmd_handler en epf_ntb_epc_cleanup\n\nDeshabilitar el trabajo retrasado antes de limpiar las asignaciones BAR y los doorbells para evitar ejecutar el gestor después de que los recursos hayan sido desmantelados.\n\n Incapaz de manejar la solicitud de paginación del kernel en la dirección virtual ffff800083f46004\n [...]\n Error interno: Oops: 0000000096000007 [#1] SMP\n [...]\n Traza de llamada:\n epf_ntb_cmd_handler+0x54/0x200 [pci_epf_vntb] (P)\n process_one_work+0x154/0x3b0\n worker_thread+0x2c8/0x400\n kthread+0x148/0x210\n ret_from_fork+0x10/0x20"}],"id":"CVE-2026-31595","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:37.237","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5999067140c67530a6cb6f41a8471596e60452cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6773cc24c004930903a57761132c1e7728907f8f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9921cce25bfe4021f6e55ca995351eb967165297"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b2eb405bbced3a6e772545e1b74dbde37cee1f8f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ceb73484e7204f661f770069ecdf35f6e941879c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d799984233a50abd2667a7d17a9a710a3f10ebe2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbb6c353fa2fb5f5f990eda034a1074b0356127e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31596.json b/data/2026/CVE-2026-31596.json index e31f4ac0f5..aafa12242c 100644 --- a/data/2026/CVE-2026-31596.json +++ b/data/2026/CVE-2026-31596.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ocfs2/resize.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7eafcf507fbd68f3276c00f6c02ef155ad69f79b","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"fabfa6b81bd386154d7e59f8cd8f760f9e68b48c","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"b328d8e7c437d0f026ba2c13788af6eae77700f1","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"6575f9fbf084502b7118a628425bf7866666498d","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"911b557dd7817460881fd51a03069b539c674d0e","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"e384a850a3370d89a7a446cdeccd964bfba2a302","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"10fb72c47aac446f12a4ccd962c7daa60cc890a1","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"41c6e9bc3a09539deab43957a3211d902a4818f0","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"4a1c0ddc6e7bcf2e9db0eeaab9340dcfe97f448f","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ocfs2/resize.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.29"},{"lessThan":"2.6.29","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"61A18ECC-DBBE-4804-B80E-C799CC05CD13","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: handle invalid dinode in ocfs2_group_extend\n\n[BUG]\nkernel BUG at fs/ocfs2/resize.c:308!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308\nCode: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe\nCall Trace:\n ...\n ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n ...\n\n[CAUSE]\nocfs2_group_extend() assumes that the global bitmap inode block\nreturned from ocfs2_inode_lock() has already been validated and\nBUG_ONs when the signature is not a dinode. That assumption is too\nstrong for crafted filesystems because the JBD2-managed buffer path\ncan bypass structural validation and return an invalid dinode to the\nresize ioctl.\n\n[FIX]\nValidate the dinode explicitly in ocfs2_group_extend(). If the global\nbitmap buffer does not contain a valid dinode, report filesystem\ncorruption with ocfs2_error() and fail the resize operation instead of\ncrashing the kernel."}],"id":"CVE-2026-31596","lastModified":"2026-06-17T10:34:03.260","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:37.340","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10fb72c47aac446f12a4ccd962c7daa60cc890a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/41c6e9bc3a09539deab43957a3211d902a4818f0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4a1c0ddc6e7bcf2e9db0eeaab9340dcfe97f448f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6575f9fbf084502b7118a628425bf7866666498d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7eafcf507fbd68f3276c00f6c02ef155ad69f79b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/911b557dd7817460881fd51a03069b539c674d0e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b328d8e7c437d0f026ba2c13788af6eae77700f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e384a850a3370d89a7a446cdeccd964bfba2a302"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fabfa6b81bd386154d7e59f8cd8f760f9e68b48c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ocfs2/resize.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7eafcf507fbd68f3276c00f6c02ef155ad69f79b","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"fabfa6b81bd386154d7e59f8cd8f760f9e68b48c","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"b328d8e7c437d0f026ba2c13788af6eae77700f1","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"6575f9fbf084502b7118a628425bf7866666498d","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"911b557dd7817460881fd51a03069b539c674d0e","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"e384a850a3370d89a7a446cdeccd964bfba2a302","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"10fb72c47aac446f12a4ccd962c7daa60cc890a1","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"41c6e9bc3a09539deab43957a3211d902a4818f0","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"},{"lessThan":"4a1c0ddc6e7bcf2e9db0eeaab9340dcfe97f448f","status":"affected","version":"10995aa2451afa20b721cc7de856cae1a13dba57","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ocfs2/resize.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.29"},{"lessThan":"2.6.29","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"61A18ECC-DBBE-4804-B80E-C799CC05CD13","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.29","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: handle invalid dinode in ocfs2_group_extend\n\n[BUG]\nkernel BUG at fs/ocfs2/resize.c:308!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308\nCode: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe\nCall Trace:\n ...\n ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n ...\n\n[CAUSE]\nocfs2_group_extend() assumes that the global bitmap inode block\nreturned from ocfs2_inode_lock() has already been validated and\nBUG_ONs when the signature is not a dinode. That assumption is too\nstrong for crafted filesystems because the JBD2-managed buffer path\ncan bypass structural validation and return an invalid dinode to the\nresize ioctl.\n\n[FIX]\nValidate the dinode explicitly in ocfs2_group_extend(). If the global\nbitmap buffer does not contain a valid dinode, report filesystem\ncorruption with ocfs2_error() and fail the resize operation instead of\ncrashing the kernel."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nocfs2: manejar dinodo inválido en ocfs2_group_extend\n\n[BUG]\nBUG del kernel en fs/ocfs2/resize.c:308!\nOops: código de operación inválido: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:ocfs2_group_extend+0x 10aa/0x 1ae0 fs/ocfs2/resize.c:308\nCódigo: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe\nTraza de Llamada:\n ...\n ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n x64_sys_call+0x 1144/0x 26a0 arch/x86/include/generated/asm/syscalls_64.h:17\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n ...\n\n[CAUSA]\nocfs2_group_extend() asume que el bloque de inodo de mapa de bits global devuelto por ocfs2_inode_lock() ya ha sido validado y activa un BUG_ON cuando la firma no es un dinodo. Esa suposición es demasiado fuerte para sistemas de archivos manipulados porque la ruta del búfer gestionada por JBD2 puede omitir la validación estructural y devolver un dinodo inválido al ioctl de redimensionamiento.\n\n[SOLUCIÓN]\nValidar el dinodo explícitamente en ocfs2_group_extend(). Si el búfer de mapa de bits global no contiene un dinodo válido, informar de corrupción del sistema de archivos con ocfs2_error() y fallar la operación de redimensionamiento en lugar de bloquear el kernel."}],"id":"CVE-2026-31596","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:37.340","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10fb72c47aac446f12a4ccd962c7daa60cc890a1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/41c6e9bc3a09539deab43957a3211d902a4818f0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4a1c0ddc6e7bcf2e9db0eeaab9340dcfe97f448f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6575f9fbf084502b7118a628425bf7866666498d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7eafcf507fbd68f3276c00f6c02ef155ad69f79b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/911b557dd7817460881fd51a03069b539c674d0e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b328d8e7c437d0f026ba2c13788af6eae77700f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e384a850a3370d89a7a446cdeccd964bfba2a302"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fabfa6b81bd386154d7e59f8cd8f760f9e68b48c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31597.json b/data/2026/CVE-2026-31597.json index 1d7c72c81a..376185a8cf 100644 --- a/data/2026/CVE-2026-31597.json +++ b/data/2026/CVE-2026-31597.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ocfs2/mmap.c","fs/ocfs2/ocfs2_trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"36539c4d536f851a3b346a6ebb27b51bc3d77a94","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"35c2c05261d6f6d84aaa1355afa201d507943e76","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"3f5e74b5db9353b01ed50f4de84e75b755f8fbc2","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"6f072daefcab1d84ce37c073645615f63be91006","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"4cf2768a0291a0cdd0dae801ea0eafa3878a349d","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"d45ff441b416d4aa1af72b1db23d959601c04da2","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"76a602fdbb78dd05b2da06f74a988cebc97e82d0","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"925bf22c1b823e231b1baea761fe8a1512e442f2","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"7de554cabf160e331e4442e2a9ad874ca9875921","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ocfs2/mmap.c","fs/ocfs2/ocfs2_trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.39"},{"lessThan":"2.6.39","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"860F82EF-76BF-492E-B7CE-559EC99F9C95","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.39","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY\n\nfilemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY,\nas documented in mm/filemap.c:\n\n \"If our return value has VM_FAULT_RETRY set, it's because the mmap_lock\n may be dropped before doing I/O or by lock_folio_maybe_drop_mmap().\"\n\nWhen this happens, a concurrent munmap() can call remove_vma() and free\nthe vm_area_struct via RCU. The saved 'vma' pointer in ocfs2_fault() then\nbecomes a dangling pointer, and the subsequent trace_ocfs2_fault() call\ndereferences it -- a use-after-free.\n\nFix this by saving ip_blkno as a plain integer before calling\nfilemap_fault(), and removing vma from the trace event. Since\nip_blkno is copied by value before the lock can be dropped, it\nremains valid regardless of what happens to the vma or inode\nafterward."}],"id":"CVE-2026-31597","lastModified":"2026-06-17T10:34:03.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:37.457","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/35c2c05261d6f6d84aaa1355afa201d507943e76"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/36539c4d536f851a3b346a6ebb27b51bc3d77a94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3f5e74b5db9353b01ed50f4de84e75b755f8fbc2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cf2768a0291a0cdd0dae801ea0eafa3878a349d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6f072daefcab1d84ce37c073645615f63be91006"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76a602fdbb78dd05b2da06f74a988cebc97e82d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7de554cabf160e331e4442e2a9ad874ca9875921"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/925bf22c1b823e231b1baea761fe8a1512e442f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d45ff441b416d4aa1af72b1db23d959601c04da2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ocfs2/mmap.c","fs/ocfs2/ocfs2_trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"36539c4d536f851a3b346a6ebb27b51bc3d77a94","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"35c2c05261d6f6d84aaa1355afa201d507943e76","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"3f5e74b5db9353b01ed50f4de84e75b755f8fbc2","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"6f072daefcab1d84ce37c073645615f63be91006","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"4cf2768a0291a0cdd0dae801ea0eafa3878a349d","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"d45ff441b416d4aa1af72b1db23d959601c04da2","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"76a602fdbb78dd05b2da06f74a988cebc97e82d0","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"925bf22c1b823e231b1baea761fe8a1512e442f2","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"},{"lessThan":"7de554cabf160e331e4442e2a9ad874ca9875921","status":"affected","version":"614a9e849ca6ea24843795251cb30af525d5336b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ocfs2/mmap.c","fs/ocfs2/ocfs2_trace.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.39"},{"lessThan":"2.6.39","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"860F82EF-76BF-492E-B7CE-559EC99F9C95","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.39","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY\n\nfilemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY,\nas documented in mm/filemap.c:\n\n \"If our return value has VM_FAULT_RETRY set, it's because the mmap_lock\n may be dropped before doing I/O or by lock_folio_maybe_drop_mmap().\"\n\nWhen this happens, a concurrent munmap() can call remove_vma() and free\nthe vm_area_struct via RCU. The saved 'vma' pointer in ocfs2_fault() then\nbecomes a dangling pointer, and the subsequent trace_ocfs2_fault() call\ndereferences it -- a use-after-free.\n\nFix this by saving ip_blkno as a plain integer before calling\nfilemap_fault(), and removing vma from the trace event. Since\nip_blkno is copied by value before the lock can be dropped, it\nremains valid regardless of what happens to the vma or inode\nafterward."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nocfs2: corrección de uso después de liberación en ocfs2_fault() cuando VM_FAULT_RETRY\n\nfilemap_fault() puede liberar el mmap_lock antes de devolver VM_FAULT_RETRY, como se documenta en mm/filemap.c:\n\n’Si nuestro valor de retorno tiene VM_FAULT_RETRY establecido, es porque el mmap_lock puede ser liberado antes de realizar E/S o por lock_folio_maybe_drop_mmap().’\n\nCuando esto sucede, un munmap() concurrente puede llamar a remove_vma() y liberar el vm_area_struct a través de RCU. El puntero ’vma’ guardado en ocfs2_fault() entonces se convierte en un puntero colgante, y la subsiguiente llamada a trace_ocfs2_fault() lo desreferencia - - un uso después de liberación.\n\nSolucione esto al guardar ip_blkno como un entero simple antes de llamar a filemap_fault(), y eliminando vma del evento de traza. Dado que ip_blkno se copia por valor antes de que el bloqueo pueda ser liberado, permanece válido independientemente de lo que suceda con el vma o el inodo después."}],"id":"CVE-2026-31597","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:37.457","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/35c2c05261d6f6d84aaa1355afa201d507943e76"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/36539c4d536f851a3b346a6ebb27b51bc3d77a94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3f5e74b5db9353b01ed50f4de84e75b755f8fbc2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cf2768a0291a0cdd0dae801ea0eafa3878a349d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6f072daefcab1d84ce37c073645615f63be91006"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76a602fdbb78dd05b2da06f74a988cebc97e82d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7de554cabf160e331e4442e2a9ad874ca9875921"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/925bf22c1b823e231b1baea761fe8a1512e442f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d45ff441b416d4aa1af72b1db23d959601c04da2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31598.json b/data/2026/CVE-2026-31598.json index 0ddadc3074..5dae0db279 100644 --- a/data/2026/CVE-2026-31598.json +++ b/data/2026/CVE-2026-31598.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ocfs2/aops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"297d8d7bb6a2bf133d3a3636edbdf94101cbd719","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"32630dee18c6bb2175c8a865a474749492eaf19c","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"93f35419eb84d58820040642cb6e7528fe4aba7a","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"4b80b5a838a32437f2cae0662578bac216a2c51a","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"2b884d52273c60c298bd570163e8053657bbaff6","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"bc0fb5c7d54c78be43a536df0e20dee32adb27d3","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"f9fb1a7b635849322e1d7b7b6b26389778ec8e82","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"e049f7a9bd80b7319590789ea5e1c523d6339d91","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"b02da26a992db0c0e2559acbda0fc48d4a2fd337","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ocfs2/aops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.6"},{"lessThan":"4.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7A6CE177-C7BA-4E34-9D61-035565B5FFF5","versionEndExcluding":"6.6.136","versionStartIncluding":"4.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix possible deadlock between unlink and dio_end_io_write\n\nocfs2_unlink takes orphan dir inode_lock first and then ip_alloc_sem,\nwhile in ocfs2_dio_end_io_write, it acquires these locks in reverse order.\nThis creates an ABBA lock ordering violation on lock classes\nocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE] and\nocfs2_file_ip_alloc_sem_key.\n\nLock Chain #0 (orphan dir inode_lock -> ip_alloc_sem):\nocfs2_unlink\n ocfs2_prepare_orphan_dir\n ocfs2_lookup_lock_orphan_dir\n inode_lock(orphan_dir_inode) <- lock A\n __ocfs2_prepare_orphan_dir\n ocfs2_prepare_dir_for_insert\n ocfs2_extend_dir\n\t ocfs2_expand_inline_dir\n\t down_write(&oi->ip_alloc_sem) <- Lock B\n\nLock Chain #1 (ip_alloc_sem -> orphan dir inode_lock):\nocfs2_dio_end_io_write\n down_write(&oi->ip_alloc_sem) <- Lock B\n ocfs2_del_inode_from_orphan()\n inode_lock(orphan_dir_inode) <- Lock A\n\nDeadlock Scenario:\n CPU0 (unlink) CPU1 (dio_end_io_write)\n ------ ------\n inode_lock(orphan_dir_inode)\n down_write(ip_alloc_sem)\n down_write(ip_alloc_sem)\n inode_lock(orphan_dir_inode)\n\nSince ip_alloc_sem is to protect allocation changes, which is unrelated\nwith operations in ocfs2_del_inode_from_orphan. So move\nocfs2_del_inode_from_orphan out of ip_alloc_sem to fix the deadlock."}],"id":"CVE-2026-31598","lastModified":"2026-10-19T19:18:00.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31598","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:06.751234Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:37.560","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/297d8d7bb6a2bf133d3a3636edbdf94101cbd719"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b884d52273c60c298bd570163e8053657bbaff6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/32630dee18c6bb2175c8a865a474749492eaf19c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b80b5a838a32437f2cae0662578bac216a2c51a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/93f35419eb84d58820040642cb6e7528fe4aba7a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b02da26a992db0c0e2559acbda0fc48d4a2fd337"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bc0fb5c7d54c78be43a536df0e20dee32adb27d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e049f7a9bd80b7319590789ea5e1c523d6339d91"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f9fb1a7b635849322e1d7b7b6b26389778ec8e82"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ocfs2/aops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"297d8d7bb6a2bf133d3a3636edbdf94101cbd719","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"32630dee18c6bb2175c8a865a474749492eaf19c","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"93f35419eb84d58820040642cb6e7528fe4aba7a","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"4b80b5a838a32437f2cae0662578bac216a2c51a","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"2b884d52273c60c298bd570163e8053657bbaff6","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"bc0fb5c7d54c78be43a536df0e20dee32adb27d3","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"f9fb1a7b635849322e1d7b7b6b26389778ec8e82","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"e049f7a9bd80b7319590789ea5e1c523d6339d91","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"},{"lessThan":"b02da26a992db0c0e2559acbda0fc48d4a2fd337","status":"affected","version":"a86a72a4a4e0ec109a98e2737948864ed6794bf7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ocfs2/aops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.6"},{"lessThan":"4.6","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7A6CE177-C7BA-4E34-9D61-035565B5FFF5","versionEndExcluding":"6.6.136","versionStartIncluding":"4.6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix possible deadlock between unlink and dio_end_io_write\n\nocfs2_unlink takes orphan dir inode_lock first and then ip_alloc_sem,\nwhile in ocfs2_dio_end_io_write, it acquires these locks in reverse order.\nThis creates an ABBA lock ordering violation on lock classes\nocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE] and\nocfs2_file_ip_alloc_sem_key.\n\nLock Chain #0 (orphan dir inode_lock -> ip_alloc_sem):\nocfs2_unlink\n ocfs2_prepare_orphan_dir\n ocfs2_lookup_lock_orphan_dir\n inode_lock(orphan_dir_inode) <- lock A\n __ocfs2_prepare_orphan_dir\n ocfs2_prepare_dir_for_insert\n ocfs2_extend_dir\n\t ocfs2_expand_inline_dir\n\t down_write(&oi->ip_alloc_sem) <- Lock B\n\nLock Chain #1 (ip_alloc_sem -> orphan dir inode_lock):\nocfs2_dio_end_io_write\n down_write(&oi->ip_alloc_sem) <- Lock B\n ocfs2_del_inode_from_orphan()\n inode_lock(orphan_dir_inode) <- Lock A\n\nDeadlock Scenario:\n CPU0 (unlink) CPU1 (dio_end_io_write)\n ------ ------\n inode_lock(orphan_dir_inode)\n down_write(ip_alloc_sem)\n down_write(ip_alloc_sem)\n inode_lock(orphan_dir_inode)\n\nSince ip_alloc_sem is to protect allocation changes, which is unrelated\nwith operations in ocfs2_del_inode_from_orphan. So move\nocfs2_del_inode_from_orphan out of ip_alloc_sem to fix the deadlock."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nocfs2: soluciona un posible interbloqueo entre unlink y dio_end_io_write\n\nocfs2_unlink toma primero inode_lock del directorio huérfano y luego ip_alloc_sem,\nmientras que en ocfs2_dio_end_io_write, adquiere estos bloqueos en orden inverso.\nEsto crea una violación del orden de bloqueo ABBA en las clases de bloqueo\nocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE] y\nocfs2_file_ip_alloc_sem_key.\n\nCadena de Bloqueo #0 (inode_lock del directorio huérfano -> ip_alloc_sem):\nocfs2_unlink\n ocfs2_prepare_orphan_dir\n ocfs2_lookup_lock_orphan_dir\n inode_lock(orphan_dir_inode) <- bloqueo A\n __ocfs2_prepare_orphan_dir\n ocfs2_prepare_dir_for_insert\n ocfs2_extend_dir\n\t ocfs2_expand_inline_dir\n\t down_write(ref:oi -> ip_alloc_sem) <- Bloqueo B\n\nCadena de Bloqueo #1 (ip_alloc_sem -> inode_lock del directorio huérfano):\nocfs2_dio_end_io_write\n down_write(ref:oi -> ip_alloc_sem) <- Bloqueo B\n ocfs2_del_inode_from_orphan()\n inode_lock(orphan_dir_inode) <- Bloqueo A\n\nEscenario de Interbloqueo:\n CPU0 (unlink) CPU1 (dio_end_io_write)\n - - - - - - - - - - - -\n inode_lock(orphan_dir_inode)\n down_write(ip_alloc_sem)\n down_write(ip_alloc_sem)\n inode_lock(orphan_dir_inode)\n\nDado que ip_alloc_sem está destinado a proteger los cambios de asignación, lo cual no está relacionado\ncon las operaciones en ocfs2_del_inode_from_orphan. Por lo tanto, se mueve\nocfs2_del_inode_from_orphan fuera de ip_alloc_sem para solucionar el interbloqueo."}],"id":"CVE-2026-31598","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31598","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:06.751234Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:37.560","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/297d8d7bb6a2bf133d3a3636edbdf94101cbd719"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b884d52273c60c298bd570163e8053657bbaff6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/32630dee18c6bb2175c8a865a474749492eaf19c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b80b5a838a32437f2cae0662578bac216a2c51a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/93f35419eb84d58820040642cb6e7528fe4aba7a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b02da26a992db0c0e2559acbda0fc48d4a2fd337"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bc0fb5c7d54c78be43a536df0e20dee32adb27d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e049f7a9bd80b7319590789ea5e1c523d6339d91"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f9fb1a7b635849322e1d7b7b6b26389778ec8e82"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31599.json b/data/2026/CVE-2026-31599.json index ec03b08816..698054c4f2 100644 --- a/data/2026/CVE-2026-31599.json +++ b/data/2026/CVE-2026-31599.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/test-drivers/vidtv/vidtv_channel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"54e18a23e62e81b8335cec3e8e9c5cb33fd88665","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"5c986b77200b5ea754ba6636deacc7e0942fec9b","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"93d9e747a9e8a5ca9e3c5e37dcff76b40399139f","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"b7efb4c94797c504a1c678edb48c2aa311d3309f","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"e589de36da106ef739ba98f66f5a5c2023370706","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"2dff11fb5098ae453651f8f77e94ad499c078022","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"b832cfd516b8504e95884622cee60bf9a39b7945","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"07c1e474cf9acf777f09d14a8f8dfcef5b84e46f","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"f8e1fc918a9fe67103bcda01d20d745f264d00a7","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/test-drivers/vidtv/vidtv_channel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.10"},{"lessThan":"5.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0F98EDB3-BDF6-4821-9197-1BA4A2E056E2","versionEndExcluding":"6.6.136","versionStartIncluding":"5.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections\n\nsyzbot reported a general protection fault in vidtv_psi_desc_assign [1].\n\nvidtv_psi_pmt_stream_init() can return NULL on memory allocation\nfailure, but vidtv_channel_pmt_match_sections() does not check for\nthis. When tail is NULL, the subsequent call to\nvidtv_psi_desc_assign(&tail->descriptor, desc) dereferences a NULL\npointer offset, causing a general protection fault.\n\nAdd a NULL check after vidtv_psi_pmt_stream_init(). On failure, clean\nup the already-allocated stream chain and return.\n\n[1]\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nRIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629\nCall Trace:\n \n vidtv_channel_pmt_match_sections drivers/media/test-drivers/vidtv/vidtv_channel.c:349 [inline]\n vidtv_channel_si_init+0x1445/0x1a50 drivers/media/test-drivers/vidtv/vidtv_channel.c:479\n vidtv_mux_init+0x526/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:519\n vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline]\n vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239"}],"id":"CVE-2026-31599","lastModified":"2026-06-17T10:34:03.670","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:38.777","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07c1e474cf9acf777f09d14a8f8dfcef5b84e46f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2dff11fb5098ae453651f8f77e94ad499c078022"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/54e18a23e62e81b8335cec3e8e9c5cb33fd88665"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5c986b77200b5ea754ba6636deacc7e0942fec9b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/93d9e747a9e8a5ca9e3c5e37dcff76b40399139f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b7efb4c94797c504a1c678edb48c2aa311d3309f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b832cfd516b8504e95884622cee60bf9a39b7945"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e589de36da106ef739ba98f66f5a5c2023370706"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f8e1fc918a9fe67103bcda01d20d745f264d00a7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/media/test-drivers/vidtv/vidtv_channel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"54e18a23e62e81b8335cec3e8e9c5cb33fd88665","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"5c986b77200b5ea754ba6636deacc7e0942fec9b","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"93d9e747a9e8a5ca9e3c5e37dcff76b40399139f","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"b7efb4c94797c504a1c678edb48c2aa311d3309f","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"e589de36da106ef739ba98f66f5a5c2023370706","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"2dff11fb5098ae453651f8f77e94ad499c078022","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"b832cfd516b8504e95884622cee60bf9a39b7945","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"07c1e474cf9acf777f09d14a8f8dfcef5b84e46f","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"},{"lessThan":"f8e1fc918a9fe67103bcda01d20d745f264d00a7","status":"affected","version":"f90cf6079bf67988f8b1ad1ade70fc89d0080905","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/media/test-drivers/vidtv/vidtv_channel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.10"},{"lessThan":"5.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0F98EDB3-BDF6-4821-9197-1BA4A2E056E2","versionEndExcluding":"6.6.136","versionStartIncluding":"5.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections\n\nsyzbot reported a general protection fault in vidtv_psi_desc_assign [1].\n\nvidtv_psi_pmt_stream_init() can return NULL on memory allocation\nfailure, but vidtv_channel_pmt_match_sections() does not check for\nthis. When tail is NULL, the subsequent call to\nvidtv_psi_desc_assign(&tail->descriptor, desc) dereferences a NULL\npointer offset, causing a general protection fault.\n\nAdd a NULL check after vidtv_psi_pmt_stream_init(). On failure, clean\nup the already-allocated stream chain and return.\n\n[1]\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nRIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629\nCall Trace:\n \n vidtv_channel_pmt_match_sections drivers/media/test-drivers/vidtv/vidtv_channel.c:349 [inline]\n vidtv_channel_si_init+0x1445/0x1a50 drivers/media/test-drivers/vidtv/vidtv_channel.c:479\n vidtv_mux_init+0x526/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:519\n vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline]\n vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmedia: vidtv: corregir desreferencia de puntero NULL en vidtv_channel_pmt_match_sections\n\nsyzbot informó un fallo de protección general en vidtv_psi_desc_assign [1].\n\nvidtv_psi_pmt_stream_init() puede devolver NULL en caso de fallo de asignación de memoria, pero vidtv_channel_pmt_match_sections() no comprueba esto. Cuando tail es NULL, la llamada subsiguiente a vidtv_psi_desc_assign(ref:tail -> descriptor, desc) desreferencia un desplazamiento de puntero NULL, causando un fallo de protección general.\n\nAñadir una comprobación de NULL después de vidtv_psi_pmt_stream_init(). En caso de fallo, limpiar la cadena de flujo ya asignada y retornar.\n\n[1]\nOops: fallo de protección general, probablemente para dirección no canónica 0x dffffc0000000000: 0000 [#1] SMP KASAN PTI\nKASAN: desreferencia de puntero nulo en el rango [0x 0000000000000000-0x 0000000000000007]\nRIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629\nTraza de Llamada:\n [TASK]\n vidtv_channel_pmt_match_sections drivers/media/test-drivers/vidtv/vidtv_channel.c:349 [inline]\n vidtv_channel_si_init+0x 1445/0x 1a50 drivers/media/test-drivers/vidtv/vidtv_channel.c:479\n vidtv_mux_init+0x526/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:519\n vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline]\n vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239"}],"id":"CVE-2026-31599","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:38.777","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07c1e474cf9acf777f09d14a8f8dfcef5b84e46f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2dff11fb5098ae453651f8f77e94ad499c078022"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/54e18a23e62e81b8335cec3e8e9c5cb33fd88665"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5c986b77200b5ea754ba6636deacc7e0942fec9b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/93d9e747a9e8a5ca9e3c5e37dcff76b40399139f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b7efb4c94797c504a1c678edb48c2aa311d3309f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b832cfd516b8504e95884622cee60bf9a39b7945"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e589de36da106ef739ba98f66f5a5c2023370706"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f8e1fc918a9fe67103bcda01d20d745f264d00a7"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31600.json b/data/2026/CVE-2026-31600.json index 7c2bb4523d..3a2dfbaf8b 100644 --- a/data/2026/CVE-2026-31600.json +++ b/data/2026/CVE-2026-31600.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/arm64/include/asm/pgtable-prot.h","arch/arm64/include/asm/pgtable.h","arch/arm64/mm/mmu.c","arch/arm64/mm/pageattr.c","arch/arm64/mm/trans_pgd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8140b21d19015227a28c255404462f2d3e6edc9a","status":"affected","version":"a166563e7ec375b38a0fd3a58f7b77e50a6bc6a8","versionType":"git"},{"lessThan":"747b6482e4e227fd351197dde6f64a97107a9e52","status":"affected","version":"a166563e7ec375b38a0fd3a58f7b77e50a6bc6a8","versionType":"git"},{"lessThan":"cbea627ea634f41c79d18f0c6d20db66fa93514c","status":"affected","version":"a166563e7ec375b38a0fd3a58f7b77e50a6bc6a8","versionType":"git"},{"lessThan":"15bfba1ad77fad8e45a37aae54b3c813b33fe27c","status":"affected","version":"a166563e7ec375b38a0fd3a58f7b77e50a6bc6a8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/arm64/include/asm/pgtable-prot.h","arch/arm64/include/asm/pgtable.h","arch/arm64/mm/mmu.c","arch/arm64/mm/pageattr.c","arch/arm64/mm/trans_pgd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4C4EAA6A-7949-4B29-BD69-5BB05C4D1A6B","versionEndExcluding":"6.18.24","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: Handle invalid large leaf mappings correctly\n\nIt has been possible for a long time to mark ptes in the linear map as\ninvalid. This is done for secretmem, kfence, realm dma memory un/share,\nand others, by simply clearing the PTE_VALID bit. But until commit\na166563e7ec37 (\"arm64: mm: support large block mapping when\nrodata=full\") large leaf mappings were never made invalid in this way.\n\nIt turns out various parts of the code base are not equipped to handle\ninvalid large leaf mappings (in the way they are currently encoded) and\nI've observed a kernel panic while booting a realm guest on a\nBBML2_NOABORT system as a result:\n\n[ 15.432706] software IO TLB: Memory encryption is active and system is using DMA bounce buffers\n[ 15.476896] Unable to handle kernel paging request at virtual address ffff000019600000\n[ 15.513762] Mem abort info:\n[ 15.527245] ESR = 0x0000000096000046\n[ 15.548553] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 15.572146] SET = 0, FnV = 0\n[ 15.592141] EA = 0, S1PTW = 0\n[ 15.612694] FSC = 0x06: level 2 translation fault\n[ 15.640644] Data abort info:\n[ 15.661983] ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000\n[ 15.694875] CM = 0, WnR = 1, TnD = 0, TagAccess = 0\n[ 15.723740] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[ 15.755776] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081f3f000\n[ 15.800410] [ffff000019600000] pgd=0000000000000000, p4d=180000009ffff403, pud=180000009fffe403, pmd=00e8000199600704\n[ 15.855046] Internal error: Oops: 0000000096000046 [#1] SMP\n[ 15.886394] Modules linked in:\n[ 15.900029] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-rc4-dirty #4 PREEMPT\n[ 15.935258] Hardware name: linux,dummy-virt (DT)\n[ 15.955612] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 15.986009] pc : __pi_memcpy_generic+0x128/0x22c\n[ 16.006163] lr : swiotlb_bounce+0xf4/0x158\n[ 16.024145] sp : ffff80008000b8f0\n[ 16.038896] x29: ffff80008000b8f0 x28: 0000000000000000 x27: 0000000000000000\n[ 16.069953] x26: ffffb3976d261ba8 x25: 0000000000000000 x24: ffff000019600000\n[ 16.100876] x23: 0000000000000001 x22: ffff0000043430d0 x21: 0000000000007ff0\n[ 16.131946] x20: 0000000084570010 x19: 0000000000000000 x18: ffff00001ffe3fcc\n[ 16.163073] x17: 0000000000000000 x16: 00000000003fffff x15: 646e612065766974\n[ 16.194131] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n[ 16.225059] x11: 0000000000000000 x10: 0000000000000010 x9 : 0000000000000018\n[ 16.256113] x8 : 0000000000000018 x7 : 0000000000000000 x6 : 0000000000000000\n[ 16.287203] x5 : ffff000019607ff0 x4 : ffff000004578000 x3 : ffff000019600000\n[ 16.318145] x2 : 0000000000007ff0 x1 : ffff000004570010 x0 : ffff000019600000\n[ 16.349071] Call trace:\n[ 16.360143] __pi_memcpy_generic+0x128/0x22c (P)\n[ 16.380310] swiotlb_tbl_map_single+0x154/0x2b4\n[ 16.400282] swiotlb_map+0x5c/0x228\n[ 16.415984] dma_map_phys+0x244/0x2b8\n[ 16.432199] dma_map_page_attrs+0x44/0x58\n[ 16.449782] virtqueue_map_page_attrs+0x38/0x44\n[ 16.469596] virtqueue_map_single_attrs+0xc0/0x130\n[ 16.490509] virtnet_rq_alloc.isra.0+0xa4/0x1fc\n[ 16.510355] try_fill_recv+0x2a4/0x584\n[ 16.526989] virtnet_open+0xd4/0x238\n[ 16.542775] __dev_open+0x110/0x24c\n[ 16.558280] __dev_change_flags+0x194/0x20c\n[ 16.576879] netif_change_flags+0x24/0x6c\n[ 16.594489] dev_change_flags+0x48/0x7c\n[ 16.611462] ip_auto_config+0x258/0x1114\n[ 16.628727] do_one_initcall+0x80/0x1c8\n[ 16.645590] kernel_init_freeable+0x208/0x2f0\n[ 16.664917] kernel_init+0x24/0x1e0\n[ 16.680295] ret_from_fork+0x10/0x20\n[ 16.696369] Code: 927cec03 cb0e0021 8b0e0042 a9411c26 (a900340c)\n[ 16.723106] ---[ end trace 0000000000000000 ]---\n[ 16.752866] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\n[ 16.792556] Kernel Offset: 0x3396ea200000 from 0xffff8000800000\n---truncated---"}],"id":"CVE-2026-31600","lastModified":"2026-10-19T19:18:01.070","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31600","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:08.993132Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:38.920","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/15bfba1ad77fad8e45a37aae54b3c813b33fe27c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/747b6482e4e227fd351197dde6f64a97107a9e52"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8140b21d19015227a28c255404462f2d3e6edc9a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cbea627ea634f41c79d18f0c6d20db66fa93514c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-476"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/arm64/include/asm/pgtable-prot.h","arch/arm64/include/asm/pgtable.h","arch/arm64/mm/mmu.c","arch/arm64/mm/pageattr.c","arch/arm64/mm/trans_pgd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8140b21d19015227a28c255404462f2d3e6edc9a","status":"affected","version":"a166563e7ec375b38a0fd3a58f7b77e50a6bc6a8","versionType":"git"},{"lessThan":"747b6482e4e227fd351197dde6f64a97107a9e52","status":"affected","version":"a166563e7ec375b38a0fd3a58f7b77e50a6bc6a8","versionType":"git"},{"lessThan":"cbea627ea634f41c79d18f0c6d20db66fa93514c","status":"affected","version":"a166563e7ec375b38a0fd3a58f7b77e50a6bc6a8","versionType":"git"},{"lessThan":"15bfba1ad77fad8e45a37aae54b3c813b33fe27c","status":"affected","version":"a166563e7ec375b38a0fd3a58f7b77e50a6bc6a8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/arm64/include/asm/pgtable-prot.h","arch/arm64/include/asm/pgtable.h","arch/arm64/mm/mmu.c","arch/arm64/mm/pageattr.c","arch/arm64/mm/trans_pgd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4C4EAA6A-7949-4B29-BD69-5BB05C4D1A6B","versionEndExcluding":"6.18.24","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: Handle invalid large leaf mappings correctly\n\nIt has been possible for a long time to mark ptes in the linear map as\ninvalid. This is done for secretmem, kfence, realm dma memory un/share,\nand others, by simply clearing the PTE_VALID bit. But until commit\na166563e7ec37 (\"arm64: mm: support large block mapping when\nrodata=full\") large leaf mappings were never made invalid in this way.\n\nIt turns out various parts of the code base are not equipped to handle\ninvalid large leaf mappings (in the way they are currently encoded) and\nI've observed a kernel panic while booting a realm guest on a\nBBML2_NOABORT system as a result:\n\n[ 15.432706] software IO TLB: Memory encryption is active and system is using DMA bounce buffers\n[ 15.476896] Unable to handle kernel paging request at virtual address ffff000019600000\n[ 15.513762] Mem abort info:\n[ 15.527245] ESR = 0x0000000096000046\n[ 15.548553] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 15.572146] SET = 0, FnV = 0\n[ 15.592141] EA = 0, S1PTW = 0\n[ 15.612694] FSC = 0x06: level 2 translation fault\n[ 15.640644] Data abort info:\n[ 15.661983] ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000\n[ 15.694875] CM = 0, WnR = 1, TnD = 0, TagAccess = 0\n[ 15.723740] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[ 15.755776] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081f3f000\n[ 15.800410] [ffff000019600000] pgd=0000000000000000, p4d=180000009ffff403, pud=180000009fffe403, pmd=00e8000199600704\n[ 15.855046] Internal error: Oops: 0000000096000046 [#1] SMP\n[ 15.886394] Modules linked in:\n[ 15.900029] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-rc4-dirty #4 PREEMPT\n[ 15.935258] Hardware name: linux,dummy-virt (DT)\n[ 15.955612] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 15.986009] pc : __pi_memcpy_generic+0x128/0x22c\n[ 16.006163] lr : swiotlb_bounce+0xf4/0x158\n[ 16.024145] sp : ffff80008000b8f0\n[ 16.038896] x29: ffff80008000b8f0 x28: 0000000000000000 x27: 0000000000000000\n[ 16.069953] x26: ffffb3976d261ba8 x25: 0000000000000000 x24: ffff000019600000\n[ 16.100876] x23: 0000000000000001 x22: ffff0000043430d0 x21: 0000000000007ff0\n[ 16.131946] x20: 0000000084570010 x19: 0000000000000000 x18: ffff00001ffe3fcc\n[ 16.163073] x17: 0000000000000000 x16: 00000000003fffff x15: 646e612065766974\n[ 16.194131] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\n[ 16.225059] x11: 0000000000000000 x10: 0000000000000010 x9 : 0000000000000018\n[ 16.256113] x8 : 0000000000000018 x7 : 0000000000000000 x6 : 0000000000000000\n[ 16.287203] x5 : ffff000019607ff0 x4 : ffff000004578000 x3 : ffff000019600000\n[ 16.318145] x2 : 0000000000007ff0 x1 : ffff000004570010 x0 : ffff000019600000\n[ 16.349071] Call trace:\n[ 16.360143] __pi_memcpy_generic+0x128/0x22c (P)\n[ 16.380310] swiotlb_tbl_map_single+0x154/0x2b4\n[ 16.400282] swiotlb_map+0x5c/0x228\n[ 16.415984] dma_map_phys+0x244/0x2b8\n[ 16.432199] dma_map_page_attrs+0x44/0x58\n[ 16.449782] virtqueue_map_page_attrs+0x38/0x44\n[ 16.469596] virtqueue_map_single_attrs+0xc0/0x130\n[ 16.490509] virtnet_rq_alloc.isra.0+0xa4/0x1fc\n[ 16.510355] try_fill_recv+0x2a4/0x584\n[ 16.526989] virtnet_open+0xd4/0x238\n[ 16.542775] __dev_open+0x110/0x24c\n[ 16.558280] __dev_change_flags+0x194/0x20c\n[ 16.576879] netif_change_flags+0x24/0x6c\n[ 16.594489] dev_change_flags+0x48/0x7c\n[ 16.611462] ip_auto_config+0x258/0x1114\n[ 16.628727] do_one_initcall+0x80/0x1c8\n[ 16.645590] kernel_init_freeable+0x208/0x2f0\n[ 16.664917] kernel_init+0x24/0x1e0\n[ 16.680295] ret_from_fork+0x10/0x20\n[ 16.696369] Code: 927cec03 cb0e0021 8b0e0042 a9411c26 (a900340c)\n[ 16.723106] ---[ end trace 0000000000000000 ]---\n[ 16.752866] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\n[ 16.792556] Kernel Offset: 0x3396ea200000 from 0xffff8000800000\n---truncated---"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\narm64: mm: Manejar correctamente las asignaciones de hoja grandes no válidas\n\nHa sido posible durante mucho tiempo marcar las ptes en el mapa lineal como no válidas. Esto se hace para secretmem, kfence, la memoria dma de realm para des/compartir, y otros, simplemente borrando el bit PTE_VALID. Pero hasta el commit a166563e7ec37 (’arm64: mm: soporte de asignación de bloques grandes cuando rodata=full’) las asignaciones de hoja grandes nunca se invalidaron de esta manera.\n\nResulta que varias partes de la base de código no están equipadas para manejar asignaciones de hoja grandes no válidas (de la forma en que están actualmente codificadas) y he observado un pánico del kernel mientras se iniciaba un invitado de realm en un sistema BBML2_NOABORT como resultado:\n\n[ 15.432706] software IO TLB: El cifrado de memoria está activo y el sistema está usando búferes de rebote DMA\n[ 15.476896] No se puede manejar la solicitud de paginación del kernel en la dirección virtual ffff000019600000\n[ 15.513762] Información de aborto de memoria:\n[ 15.527245] ESR = 0x 0000000096000046\n[ 15.548553] EC = 0x25: DABT (EL actual), IL = 32 bits\n[ 15.572146] SET = 0, FnV = 0\n[ 15.592141] EA = 0, S1PTW = 0\n[ 15.612694] FSC"}],"id":"CVE-2026-31600","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31600","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:08.993132Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:38.920","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/15bfba1ad77fad8e45a37aae54b3c813b33fe27c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/747b6482e4e227fd351197dde6f64a97107a9e52"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8140b21d19015227a28c255404462f2d3e6edc9a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cbea627ea634f41c79d18f0c6d20db66fa93514c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-476"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31601.json b/data/2026/CVE-2026-31601.json index 91e523270c..04b27b3f0f 100644 --- a/data/2026/CVE-2026-31601.json +++ b/data/2026/CVE-2026-31601.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/vfio/pci/xe/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8fa4113fc65b8b29a30fbbca5fd82221dc6e146e","status":"affected","version":"1f5556ec8b9efbb784aeb3536e147182dee73d0f","versionType":"git"},{"lessThan":"73e53ff144a538f1843b3dea1e2740a755031cdc","status":"affected","version":"1f5556ec8b9efbb784aeb3536e147182dee73d0f","versionType":"git"},{"lessThan":"1b81ed612e12ea9df8c5cb6f0ddd4419fd0b8ac8","status":"affected","version":"1f5556ec8b9efbb784aeb3536e147182dee73d0f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/vfio/pci/xe/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/xe: Reorganize the init to decouple migration from reset\n\nAttempting to issue reset on VF devices that don't support migration\nleads to the following:\n\n BUG: unable to handle page fault for address: 00000000000011f8\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 2 UID: 0 PID: 7443 Comm: xe_sriov_flr Tainted: G S U 7.0.0-rc1-lgci-xe-xe-4588-cec43d5c2696af219-nodebug+ #1 PREEMPT(lazy)\n Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023\n RIP: 0010:xe_sriov_vfio_wait_flr_done+0xc/0x80 [xe]\n Code: ff c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 54 53 <83> bf f8 11 00 00 02 75 61 41 89 f4 85 f6 74 52 48 8b 47 08 48 89\n RSP: 0018:ffffc9000f7c39b8 EFLAGS: 00010202\n RAX: ffffffffa04d8660 RBX: ffff88813e3e4000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffffc9000f7c39c8 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffff888101a48800\n R13: ffff88813e3e4150 R14: ffff888130d0d008 R15: ffff88813e3e40d0\n FS: 00007877d3d0d940(0000) GS:ffff88890b6d3000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00000000000011f8 CR3: 000000015a762000 CR4: 0000000000f52ef0\n PKRU: 55555554\n Call Trace:\n \n xe_vfio_pci_reset_done+0x49/0x120 [xe_vfio_pci]\n pci_dev_restore+0x3b/0x80\n pci_reset_function+0x109/0x140\n reset_store+0x5c/0xb0\n dev_attr_store+0x17/0x40\n sysfs_kf_write+0x72/0x90\n kernfs_fop_write_iter+0x161/0x1f0\n vfs_write+0x261/0x440\n ksys_write+0x69/0xf0\n __x64_sys_write+0x19/0x30\n x64_sys_call+0x259/0x26e0\n do_syscall_64+0xcb/0x1500\n ? __fput+0x1a2/0x2d0\n ? fput_close_sync+0x3d/0xa0\n ? __x64_sys_close+0x3e/0x90\n ? x64_sys_call+0x1b7c/0x26e0\n ? do_syscall_64+0x109/0x1500\n ? __task_pid_nr_ns+0x68/0x100\n ? __do_sys_getpid+0x1d/0x30\n ? x64_sys_call+0x10b5/0x26e0\n ? do_syscall_64+0x109/0x1500\n ? putname+0x41/0x90\n ? do_faccessat+0x1e8/0x300\n ? __x64_sys_access+0x1c/0x30\n ? x64_sys_call+0x1822/0x26e0\n ? do_syscall_64+0x109/0x1500\n ? tick_program_event+0x43/0xa0\n ? hrtimer_interrupt+0x126/0x260\n ? irqentry_exit+0xb2/0x710\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7877d5f1c5a4\n Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d a5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89\n RSP: 002b:00007fff48e5f908 EFLAGS: 00000202 ORIG_RAX: 0000000000000001\n RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007877d5f1c5a4\n RDX: 0000000000000001 RSI: 00007877d621b0c9 RDI: 0000000000000009\n RBP: 0000000000000001 R08: 00005fb49113b010 R09: 0000000000000007\n R10: 0000000000000000 R11: 0000000000000202 R12: 00007877d621b0c9\n R13: 0000000000000009 R14: 00007fff48e5fac0 R15: 00007fff48e5fac0\n \n\nThis is caused by the fact that some of the xe_vfio_pci_core_device\nmembers needed for handling reset are only initialized as part of\nmigration init.\n\nFix the problem by reorganizing the code to decouple VF init from\nmigration init."}],"id":"CVE-2026-31601","lastModified":"2026-06-17T10:34:03.957","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:39.090","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1b81ed612e12ea9df8c5cb6f0ddd4419fd0b8ac8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/73e53ff144a538f1843b3dea1e2740a755031cdc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8fa4113fc65b8b29a30fbbca5fd82221dc6e146e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/vfio/pci/xe/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8fa4113fc65b8b29a30fbbca5fd82221dc6e146e","status":"affected","version":"1f5556ec8b9efbb784aeb3536e147182dee73d0f","versionType":"git"},{"lessThan":"73e53ff144a538f1843b3dea1e2740a755031cdc","status":"affected","version":"1f5556ec8b9efbb784aeb3536e147182dee73d0f","versionType":"git"},{"lessThan":"1b81ed612e12ea9df8c5cb6f0ddd4419fd0b8ac8","status":"affected","version":"1f5556ec8b9efbb784aeb3536e147182dee73d0f","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/vfio/pci/xe/main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/xe: Reorganize the init to decouple migration from reset\n\nAttempting to issue reset on VF devices that don't support migration\nleads to the following:\n\n BUG: unable to handle page fault for address: 00000000000011f8\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 2 UID: 0 PID: 7443 Comm: xe_sriov_flr Tainted: G S U 7.0.0-rc1-lgci-xe-xe-4588-cec43d5c2696af219-nodebug+ #1 PREEMPT(lazy)\n Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023\n RIP: 0010:xe_sriov_vfio_wait_flr_done+0xc/0x80 [xe]\n Code: ff c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 54 53 <83> bf f8 11 00 00 02 75 61 41 89 f4 85 f6 74 52 48 8b 47 08 48 89\n RSP: 0018:ffffc9000f7c39b8 EFLAGS: 00010202\n RAX: ffffffffa04d8660 RBX: ffff88813e3e4000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffffc9000f7c39c8 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000000 R12: ffff888101a48800\n R13: ffff88813e3e4150 R14: ffff888130d0d008 R15: ffff88813e3e40d0\n FS: 00007877d3d0d940(0000) GS:ffff88890b6d3000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00000000000011f8 CR3: 000000015a762000 CR4: 0000000000f52ef0\n PKRU: 55555554\n Call Trace:\n \n xe_vfio_pci_reset_done+0x49/0x120 [xe_vfio_pci]\n pci_dev_restore+0x3b/0x80\n pci_reset_function+0x109/0x140\n reset_store+0x5c/0xb0\n dev_attr_store+0x17/0x40\n sysfs_kf_write+0x72/0x90\n kernfs_fop_write_iter+0x161/0x1f0\n vfs_write+0x261/0x440\n ksys_write+0x69/0xf0\n __x64_sys_write+0x19/0x30\n x64_sys_call+0x259/0x26e0\n do_syscall_64+0xcb/0x1500\n ? __fput+0x1a2/0x2d0\n ? fput_close_sync+0x3d/0xa0\n ? __x64_sys_close+0x3e/0x90\n ? x64_sys_call+0x1b7c/0x26e0\n ? do_syscall_64+0x109/0x1500\n ? __task_pid_nr_ns+0x68/0x100\n ? __do_sys_getpid+0x1d/0x30\n ? x64_sys_call+0x10b5/0x26e0\n ? do_syscall_64+0x109/0x1500\n ? putname+0x41/0x90\n ? do_faccessat+0x1e8/0x300\n ? __x64_sys_access+0x1c/0x30\n ? x64_sys_call+0x1822/0x26e0\n ? do_syscall_64+0x109/0x1500\n ? tick_program_event+0x43/0xa0\n ? hrtimer_interrupt+0x126/0x260\n ? irqentry_exit+0xb2/0x710\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7877d5f1c5a4\n Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d a5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89\n RSP: 002b:00007fff48e5f908 EFLAGS: 00000202 ORIG_RAX: 0000000000000001\n RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007877d5f1c5a4\n RDX: 0000000000000001 RSI: 00007877d621b0c9 RDI: 0000000000000009\n RBP: 0000000000000001 R08: 00005fb49113b010 R09: 0000000000000007\n R10: 0000000000000000 R11: 0000000000000202 R12: 00007877d621b0c9\n R13: 0000000000000009 R14: 00007fff48e5fac0 R15: 00007fff48e5fac0\n \n\nThis is caused by the fact that some of the xe_vfio_pci_core_device\nmembers needed for handling reset are only initialized as part of\nmigration init.\n\nFix the problem by reorganizing the code to decouple VF init from\nmigration init."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: vfio/xe: Reorganizar la inicialización para desacoplar la migración del reinicio Intentar emitir un reinicio en dispositivos VF que no soportan la migración conduce a lo siguiente: BUG: unable to handle page fault for address: 00000000000011f8 #PF: supervisor read access in kernel mode #PF: error_code(0x 0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 7443 Comm: xe_sriov_flr Tainted: G S U 7.0.0-rc1-lgci-xe-xe-4588-cec43d5c2696af219-nodebug+ #1 PREEMPT(lazy) Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023 RIP: 0010:xe_sriov_vfio_wait_flr_done+0xc/0x80 [xe] Code: ff c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 54 53 menor que 83> bf f8 11 00 00 02 75 61 41 89 f4 85 f6 74 52 48 8b 47 08 48 89 RSP: 0018:ffffc9000f7c39b8 EFLAGS: 00010202 RAX: ffffffffa04d8660 RBX: ffff88813e3e4000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000f7c39c8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888101a48800 R13: ffff88813e3e4150 R14: ffff888130d0d008 R15: ffff88813e3e40d0 FS: 00007877d3d0d940(0000) GS:ffff88890b6d3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000011f8 CR3: 000000015a762000 CR4: 0000000000f52ef0 PKRU: 55555554 Call Trace: [TASK] xe_vfio_pci_reset_done+0x49/0x120 [xe_vfio_pci] pci_dev_restore+0x3b/0x80 pci_reset_function+0x109/0x140 reset_store+0x5c/0xb0 dev_attr_store+0x17/0x40 sysfs_kf_write+0x72/0x90 kernfs_fop_write_iter+0x161/0x1f0 vfs_write+0x261/0x440 ksys_write+0x69/0xf0 __x64_sys_write+0x19/0x30 x64_sys_call+0x259/0x 26e0 do_syscall_64+0xcb/0x 1500 ? __fput+0x1a2/0x2d0 ? fput_close_sync+0x3d/0xa0 ? __x64_sys_close+0x3e/0x90 ? x64_sys_call+0x 1b7c/0x 26e0 ? do_syscall_64+0x109/0x 1500 ? __task_pid_nr_ns+0x68/0x100 ? __do_sys_getpid+0x1d/0x30 ? x64_sys_call+0x 10b5/0x 26e0 ? do_syscall_64+0x109/0x 1500 ? putname+0x41/0x90 ? do_faccessat+0x1e8/0x300 ? __x64_sys_access+0x1c/0x30 ? x64_sys_call+0x 1822/0x 26e0 ? do_syscall_64+0x109/0x 1500 ? tick_program_event+0x43/0xa0 ? hrtimer_interrupt+0x126/0x260 ? irqentry_exit+0xb2/0x710 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x 7877d5f1c5a4 Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d a5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 menor que 48mayor que 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89 RSP: 002b:00007fff48e5f908 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007877d5f1c5a4 RDX: 0000000000000001 RSI: 00007877d621b0c9 RDI: 0000000000000009 RBP: 0000000000000001 R08: 00005fb49113b010 R09: 0000000000000007 R10: 0000000000000000 R11: 0000000000000202 R12: 00007877d621b0c9 R13: 0000000000000009 R14: 00007fff48e5fac0 R15: 00007fff48e5fac0 [/TASK] Esto es causado por el hecho de que algunos de los miembros de xe_vfio_pci_core_device necesarios para manejar el reinicio solo se inicializan como parte de la inicialización de la migración. Solucionar el problema reorganizando el código para desacoplar la inicialización de VF de la inicialización de la migración."}],"id":"CVE-2026-31601","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:39.090","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1b81ed612e12ea9df8c5cb6f0ddd4419fd0b8ac8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/73e53ff144a538f1843b3dea1e2740a755031cdc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8fa4113fc65b8b29a30fbbca5fd82221dc6e146e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31602.json b/data/2026/CVE-2026-31602.json index c833556f3b..f57db2177a 100644 --- a/data/2026/CVE-2026-31602.json +++ b/data/2026/CVE-2026-31602.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/pci/ctxfi/ctvmem.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c5908160e17cb56e1f61fbaee08adc21083f4933","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"de8016fb0904d68ac886e375069535996baa42ee","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"2b4331c08c0b385598b4d8ccd71e93ab3f4b2578","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"452894005b4abe141b11fe01e7bfe152e6d3860f","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"365c36e1a126c6aa1aecedd3a351bcabc66f0c29","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"3fd0685d7fef68c2d8a04876bcf9eaa0724ad6a5","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"b7f5ecd13cce8c2f8fa5a84c9aab65997142577e","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"ad9011a795407093dcf507f6e5da1828987b4b47","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"e9418da50d9e5c496c22fe392e4ad74c038a94eb","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/pci/ctxfi/ctvmem.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6F4D7A8C-6CA6-44EE-B516-3E57BDDB63C2","versionEndExcluding":"6.6.136","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Limit PTP to a single page\n\nCommit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256\nplayback streams, but the additional pages are not used by the card\ncorrectly. The CT20K2 hardware already has multiple VMEM_PTPAL\nregisters, but using them separately would require refactoring the\nentire virtual memory allocation logic.\n\nct_vm_map() always uses PTEs in vm->ptp[0].area regardless of\nCT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When\naggregate memory allocations exceed this limit, ct_vm_map() tries to\naccess beyond the allocated space and causes a page fault:\n\n BUG: unable to handle page fault for address: ffffd4ae8a10a000\n Oops: Oops: 0002 [#1] SMP PTI\n RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi]\n Call Trace:\n atc_pcm_playback_prepare+0x225/0x3b0\n ct_pcm_playback_prepare+0x38/0x60\n snd_pcm_do_prepare+0x2f/0x50\n snd_pcm_action_single+0x36/0x90\n snd_pcm_action_nonatomic+0xbf/0xd0\n snd_pcm_ioctl+0x28/0x40\n __x64_sys_ioctl+0x97/0xe0\n do_syscall_64+0x81/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nRevert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count\nremain unchanged."}],"id":"CVE-2026-31602","lastModified":"2026-06-17T10:34:04.087","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:39.263","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2b4331c08c0b385598b4d8ccd71e93ab3f4b2578"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/365c36e1a126c6aa1aecedd3a351bcabc66f0c29"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3fd0685d7fef68c2d8a04876bcf9eaa0724ad6a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/452894005b4abe141b11fe01e7bfe152e6d3860f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ad9011a795407093dcf507f6e5da1828987b4b47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b7f5ecd13cce8c2f8fa5a84c9aab65997142577e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c5908160e17cb56e1f61fbaee08adc21083f4933"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/de8016fb0904d68ac886e375069535996baa42ee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e9418da50d9e5c496c22fe392e4ad74c038a94eb"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/pci/ctxfi/ctvmem.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c5908160e17cb56e1f61fbaee08adc21083f4933","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"de8016fb0904d68ac886e375069535996baa42ee","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"2b4331c08c0b385598b4d8ccd71e93ab3f4b2578","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"452894005b4abe141b11fe01e7bfe152e6d3860f","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"365c36e1a126c6aa1aecedd3a351bcabc66f0c29","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"3fd0685d7fef68c2d8a04876bcf9eaa0724ad6a5","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"b7f5ecd13cce8c2f8fa5a84c9aab65997142577e","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"ad9011a795407093dcf507f6e5da1828987b4b47","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"},{"lessThan":"e9418da50d9e5c496c22fe392e4ad74c038a94eb","status":"affected","version":"391e69143d0a05f960e3ab39a8c26b7b230bb8a9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/pci/ctxfi/ctvmem.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6F4D7A8C-6CA6-44EE-B516-3E57BDDB63C2","versionEndExcluding":"6.6.136","versionStartIncluding":"3.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Limit PTP to a single page\n\nCommit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256\nplayback streams, but the additional pages are not used by the card\ncorrectly. The CT20K2 hardware already has multiple VMEM_PTPAL\nregisters, but using them separately would require refactoring the\nentire virtual memory allocation logic.\n\nct_vm_map() always uses PTEs in vm->ptp[0].area regardless of\nCT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When\naggregate memory allocations exceed this limit, ct_vm_map() tries to\naccess beyond the allocated space and causes a page fault:\n\n BUG: unable to handle page fault for address: ffffd4ae8a10a000\n Oops: Oops: 0002 [#1] SMP PTI\n RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi]\n Call Trace:\n atc_pcm_playback_prepare+0x225/0x3b0\n ct_pcm_playback_prepare+0x38/0x60\n snd_pcm_do_prepare+0x2f/0x50\n snd_pcm_action_single+0x36/0x90\n snd_pcm_action_nonatomic+0xbf/0xd0\n snd_pcm_ioctl+0x28/0x40\n __x64_sys_ioctl+0x97/0xe0\n do_syscall_64+0x81/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nRevert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count\nremain unchanged."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: ctxfi: Limitar PTP a una sola página\n\nEl commit 391e69143d0a aumentó CT_PTP_NUM de 1 a 4 para soportar 256 flujos de reproducción, pero las páginas adicionales no son utilizadas correctamente por la tarjeta. El hardware CT20K2 ya tiene múltiples registros VMEM_PTPAL, pero usarlos por separado requeriría refactorizar toda la lógica de asignación de memoria virtual.\n\nct_vm_map() siempre usa PTEs en vm -> ptp[0].area independientemente de CT_PTP_NUM. En sistemas AMD64, un solo PTP cubre 512 PTEs (2M). Cuando las asignaciones de memoria agregadas exceden este límite, ct_vm_map() intenta acceder más allá del espacio asignado y causa un fallo de página:\n\n BUG: no se puede manejar el fallo de página para la dirección: ffffd4ae8a10a000\n Oops: Oops: 0002 [#1] SMP PTI\n RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi]\n Traza de Llamada:\n atc_pcm_playback_prepare+0x225/0x3b0\n ct_pcm_playback_prepare+0x38/0x60\n snd_pcm_do_prepare+0x2f/0x50\n snd_pcm_action_single+0x36/0x90\n snd_pcm_action_nonatomic+0xbf/0xd0\n snd_pcm_ioctl+0x28/0x40\n __x64_sys_ioctl+0x97/0xe0\n do_syscall_64+0x81/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nRevertir CT_PTP_NUM a 1. Los 256 SRC_RESOURCE_NUM y playback_count permanecen sin cambios."}],"id":"CVE-2026-31602","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:39.263","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2b4331c08c0b385598b4d8ccd71e93ab3f4b2578"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/365c36e1a126c6aa1aecedd3a351bcabc66f0c29"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3fd0685d7fef68c2d8a04876bcf9eaa0724ad6a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/452894005b4abe141b11fe01e7bfe152e6d3860f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ad9011a795407093dcf507f6e5da1828987b4b47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b7f5ecd13cce8c2f8fa5a84c9aab65997142577e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c5908160e17cb56e1f61fbaee08adc21083f4933"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/de8016fb0904d68ac886e375069535996baa42ee"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e9418da50d9e5c496c22fe392e4ad74c038a94eb"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31603.json b/data/2026/CVE-2026-31603.json index f63b7d8c67..ae45325d95 100644 --- a/data/2026/CVE-2026-31603.json +++ b/data/2026/CVE-2026-31603.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/staging/sm750fb/sm750.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"124a43550db8a74eef080cd4573a4904efe67029","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"b285a8f3bbb821a93eb37c2740a68ca1d7112a59","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"3300b049693138852a4c6738b5f1194a1ee91ddd","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"779412e0e391fd4a0d12e1d1adaa7bf043de62d7","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"2f640c6043aeab31a2f607d7605271860c3b11df","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"1412ba36597a82e928f20047f41d6c6582dafe8a","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"6144895a4335a2491c282931f1f2fa610b86339f","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"daf6733bd7c4c5015b431739ac29b0e29021096b","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"75a1621e4f91310673c9acbcbb25c2a7ff821cd3","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/staging/sm750fb/sm750.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.1"},{"lessThan":"4.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"82B577FA-0D16-462A-8DB4-F6416AE147D0","versionEndExcluding":"6.6.136","versionStartIncluding":"4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: sm750fb: fix division by zero in ps_to_hz()\n\nps_to_hz() is called from hw_sm750_crtc_set_mode() without validating\nthat pixclock is non-zero. A zero pixclock passed via FBIOPUT_VSCREENINFO\ncauses a division by zero.\n\nFix by rejecting zero pixclock in lynxfb_ops_check_var(), consistent\nwith other framebuffer drivers."}],"id":"CVE-2026-31603","lastModified":"2026-06-17T10:34:04.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:39.453","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/124a43550db8a74eef080cd4573a4904efe67029"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1412ba36597a82e928f20047f41d6c6582dafe8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2f640c6043aeab31a2f607d7605271860c3b11df"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3300b049693138852a4c6738b5f1194a1ee91ddd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6144895a4335a2491c282931f1f2fa610b86339f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75a1621e4f91310673c9acbcbb25c2a7ff821cd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/779412e0e391fd4a0d12e1d1adaa7bf043de62d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b285a8f3bbb821a93eb37c2740a68ca1d7112a59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/daf6733bd7c4c5015b431739ac29b0e29021096b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/staging/sm750fb/sm750.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"124a43550db8a74eef080cd4573a4904efe67029","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"b285a8f3bbb821a93eb37c2740a68ca1d7112a59","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"3300b049693138852a4c6738b5f1194a1ee91ddd","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"779412e0e391fd4a0d12e1d1adaa7bf043de62d7","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"2f640c6043aeab31a2f607d7605271860c3b11df","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"1412ba36597a82e928f20047f41d6c6582dafe8a","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"6144895a4335a2491c282931f1f2fa610b86339f","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"daf6733bd7c4c5015b431739ac29b0e29021096b","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"},{"lessThan":"75a1621e4f91310673c9acbcbb25c2a7ff821cd3","status":"affected","version":"81dee67e215b23f0c98182eece122b906d35765a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/staging/sm750fb/sm750.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.1"},{"lessThan":"4.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"82B577FA-0D16-462A-8DB4-F6416AE147D0","versionEndExcluding":"6.6.136","versionStartIncluding":"4.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: sm750fb: fix division by zero in ps_to_hz()\n\nps_to_hz() is called from hw_sm750_crtc_set_mode() without validating\nthat pixclock is non-zero. A zero pixclock passed via FBIOPUT_VSCREENINFO\ncauses a division by zero.\n\nFix by rejecting zero pixclock in lynxfb_ops_check_var(), consistent\nwith other framebuffer drivers."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nstaging: sm750fb: corregir división por cero en ps_to_hz()\n\nps_to_hz() es llamada desde hw_sm750_crtc_set_mode() sin validar que pixclock no es cero. Un pixclock cero pasado a través de FBIOPUT_VSCREENINFO causa una división por cero.\n\nSolución rechazando pixclock cero en lynxfb_ops_check_var(), consistente con otros controladores de framebuffer."}],"id":"CVE-2026-31603","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:39.453","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/124a43550db8a74eef080cd4573a4904efe67029"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1412ba36597a82e928f20047f41d6c6582dafe8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2f640c6043aeab31a2f607d7605271860c3b11df"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3300b049693138852a4c6738b5f1194a1ee91ddd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6144895a4335a2491c282931f1f2fa610b86339f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75a1621e4f91310673c9acbcbb25c2a7ff821cd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/779412e0e391fd4a0d12e1d1adaa7bf043de62d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b285a8f3bbb821a93eb37c2740a68ca1d7112a59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/daf6733bd7c4c5015b431739ac29b0e29021096b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31604.json b/data/2026/CVE-2026-31604.json index aba5d0a494..df4cccf608 100644 --- a/data/2026/CVE-2026-31604.json +++ b/data/2026/CVE-2026-31604.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/realtek/rtw88/usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f632987306bce9242cdfcf911ee0b2c9455e05a3","status":"affected","version":"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98","versionType":"git"},{"lessThan":"a4f4371d194dfa5473cc961f86194084b1b13a69","status":"affected","version":"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98","versionType":"git"},{"lessThan":"89a9c1bc7d797120bcc290864e0cb10a440a677f","status":"affected","version":"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98","versionType":"git"},{"lessThan":"af7307e96dad00bcc2675dac650d8558a52f2c6f","status":"affected","version":"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98","versionType":"git"},{"lessThan":"25a827b7e1d5747a255bdc757f1d3e9e1e8a4e2a","status":"affected","version":"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98","versionType":"git"},{"lessThan":"bbb15e71156cd9f5e1869eee7207a06ea8e96c39","status":"affected","version":"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/realtek/rtw88/usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A0F1E9A-F127-4699-A014-9E08441C9A14","versionEndExcluding":"6.6.136","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix device leak on probe failure\n\nDriver core holds a reference to the USB interface and its parent USB\ndevice while the interface is bound to a driver and there is no need to\ntake additional references unless the structures are needed after\ndisconnect.\n\nThis driver takes a reference to the USB device during probe but does\nnot to release it on all probe errors (e.g. when descriptor parsing\nfails).\n\nDrop the redundant device reference to fix the leak, reduce cargo\nculting, make it easier to spot drivers where an extra reference is\nneeded, and reduce the risk of further memory leaks."}],"id":"CVE-2026-31604","lastModified":"2026-11-06T16:18:03.043","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:34.016881Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:39.627","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25a827b7e1d5747a255bdc757f1d3e9e1e8a4e2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/89a9c1bc7d797120bcc290864e0cb10a440a677f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a4f4371d194dfa5473cc961f86194084b1b13a69"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/af7307e96dad00bcc2675dac650d8558a52f2c6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bbb15e71156cd9f5e1869eee7207a06ea8e96c39"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f632987306bce9242cdfcf911ee0b2c9455e05a3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/realtek/rtw88/usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f632987306bce9242cdfcf911ee0b2c9455e05a3","status":"affected","version":"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98","versionType":"git"},{"lessThan":"a4f4371d194dfa5473cc961f86194084b1b13a69","status":"affected","version":"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98","versionType":"git"},{"lessThan":"89a9c1bc7d797120bcc290864e0cb10a440a677f","status":"affected","version":"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98","versionType":"git"},{"lessThan":"af7307e96dad00bcc2675dac650d8558a52f2c6f","status":"affected","version":"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98","versionType":"git"},{"lessThan":"25a827b7e1d5747a255bdc757f1d3e9e1e8a4e2a","status":"affected","version":"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98","versionType":"git"},{"lessThan":"bbb15e71156cd9f5e1869eee7207a06ea8e96c39","status":"affected","version":"a82dfd33d1237f6c0fb8a7077022189d1fc7ec98","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/realtek/rtw88/usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A0F1E9A-F127-4699-A014-9E08441C9A14","versionEndExcluding":"6.6.136","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix device leak on probe failure\n\nDriver core holds a reference to the USB interface and its parent USB\ndevice while the interface is bound to a driver and there is no need to\ntake additional references unless the structures are needed after\ndisconnect.\n\nThis driver takes a reference to the USB device during probe but does\nnot to release it on all probe errors (e.g. when descriptor parsing\nfails).\n\nDrop the redundant device reference to fix the leak, reduce cargo\nculting, make it easier to spot drivers where an extra reference is\nneeded, and reduce the risk of further memory leaks."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: rtw88: corregir fuga de dispositivo en fallo de sondeo\n\nEl núcleo del controlador mantiene una referencia a la interfaz USB y a su dispositivo USB padre mientras la interfaz está vinculada a un controlador y no hay necesidad de tomar referencias adicionales a menos que las estructuras sean necesarias después de la desconexión.\n\nEste controlador toma una referencia al dispositivo USB durante el sondeo, pero no la libera en todos los errores de sondeo (p. ej., cuando falla el análisis del descriptor).\n\nEliminar la referencia redundante del dispositivo para corregir la fuga, reducir el culto al cargamento, facilitar la identificación de controladores donde se necesita una referencia adicional y reducir el riesgo de futuras fugas de memoria."}],"id":"CVE-2026-31604","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:34.016881Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:39.627","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25a827b7e1d5747a255bdc757f1d3e9e1e8a4e2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/89a9c1bc7d797120bcc290864e0cb10a440a677f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a4f4371d194dfa5473cc961f86194084b1b13a69"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/af7307e96dad00bcc2675dac650d8558a52f2c6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bbb15e71156cd9f5e1869eee7207a06ea8e96c39"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f632987306bce9242cdfcf911ee0b2c9455e05a3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31605.json b/data/2026/CVE-2026-31605.json index d3eb3a62fb..606f2c5c72 100644 --- a/data/2026/CVE-2026-31605.json +++ b/data/2026/CVE-2026-31605.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/video/fbdev/udlfb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9981de9fb5ae0d3d6bc5ff5ca63350c2a3cdc564","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"fd50ab7dd4ee5bbb4aebffa76ae18484b03a8ea5","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"828ce54b27de93bd9c67991bca5a2c76c76742de","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"cce24f70090e0decb597b88bc52e8ef8efed6105","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"03797cdee38ef19c87785622d423aabaafb71c5f","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"6de048d78f3029744778b7a2891745f3ca7c209a","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"cccbf9b7fdab48ce4feb69c24f7f928aa8e4e8b8","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"afaaaa38579f1252bb42b145f6e88a955c4f73f3","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"a31e4518bec70333a0a98f2946a12b53b45fe5b9","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/video/fbdev/udlfb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.34"},{"lessThan":"2.6.34","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BC733B39-C7FC-46A8-9E89-D10969EC8C99","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO\n\nMuch like commit 19f953e74356 (\"fbdev: fb_pm2fb: Avoid potential divide\nby zero error\"), we also need to prevent that same crash from happening\nin the udlfb driver as it uses pixclock directly when dividing, which\nwill crash."}],"id":"CVE-2026-31605","lastModified":"2026-06-17T10:34:04.470","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:39.730","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03797cdee38ef19c87785622d423aabaafb71c5f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6de048d78f3029744778b7a2891745f3ca7c209a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/828ce54b27de93bd9c67991bca5a2c76c76742de"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9981de9fb5ae0d3d6bc5ff5ca63350c2a3cdc564"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a31e4518bec70333a0a98f2946a12b53b45fe5b9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/afaaaa38579f1252bb42b145f6e88a955c4f73f3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cccbf9b7fdab48ce4feb69c24f7f928aa8e4e8b8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cce24f70090e0decb597b88bc52e8ef8efed6105"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fd50ab7dd4ee5bbb4aebffa76ae18484b03a8ea5"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/video/fbdev/udlfb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9981de9fb5ae0d3d6bc5ff5ca63350c2a3cdc564","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"fd50ab7dd4ee5bbb4aebffa76ae18484b03a8ea5","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"828ce54b27de93bd9c67991bca5a2c76c76742de","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"cce24f70090e0decb597b88bc52e8ef8efed6105","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"03797cdee38ef19c87785622d423aabaafb71c5f","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"6de048d78f3029744778b7a2891745f3ca7c209a","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"cccbf9b7fdab48ce4feb69c24f7f928aa8e4e8b8","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"afaaaa38579f1252bb42b145f6e88a955c4f73f3","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"},{"lessThan":"a31e4518bec70333a0a98f2946a12b53b45fe5b9","status":"affected","version":"59277b679f8b5ce594e367759256668eba652d0d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/video/fbdev/udlfb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.34"},{"lessThan":"2.6.34","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BC733B39-C7FC-46A8-9E89-D10969EC8C99","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO\n\nMuch like commit 19f953e74356 (\"fbdev: fb_pm2fb: Avoid potential divide\nby zero error\"), we also need to prevent that same crash from happening\nin the udlfb driver as it uses pixclock directly when dividing, which\nwill crash."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfbdev: udlfb: evitar división por cero en FBIOPUT_VSCREENINFO\n\nAl igual que el commit 19f953e74356 (’fbdev: fb_pm2fb: Evitar posible error de división por cero’), también necesitamos evitar que ocurra ese mismo fallo en el controlador udlfb, ya que usa pixclock directamente al dividir, lo que provocará un fallo."}],"id":"CVE-2026-31605","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:39.730","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03797cdee38ef19c87785622d423aabaafb71c5f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6de048d78f3029744778b7a2891745f3ca7c209a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/828ce54b27de93bd9c67991bca5a2c76c76742de"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9981de9fb5ae0d3d6bc5ff5ca63350c2a3cdc564"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a31e4518bec70333a0a98f2946a12b53b45fe5b9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/afaaaa38579f1252bb42b145f6e88a955c4f73f3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cccbf9b7fdab48ce4feb69c24f7f928aa8e4e8b8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cce24f70090e0decb597b88bc52e8ef8efed6105"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fd50ab7dd4ee5bbb4aebffa76ae18484b03a8ea5"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31606.json b/data/2026/CVE-2026-31606.json index 53e8c6fee0..0f3e21e1b6 100644 --- a/data/2026/CVE-2026-31606.json +++ b/data/2026/CVE-2026-31606.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_hid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"92f23ab86d9524bc51dae25ed916d0e69dce5992","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"3aa77f5da0ecb00895411f4246d8a3e4db0343c2","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"c6c0d13db5d0f8d465eabc14bd23d2b6a7247a43","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"eb6ef6185f2054a341ec70d7e2165f5381744215","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"5a229016ca3ac551294ec59770be9da94ec4bf63","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"75ecc46828ec377dd5692c677168ef6d64fd7123","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"81ebd43cc0d6d106ce7b6ccbf7b5e40ca7f5503d","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_hid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.19"},{"lessThan":"3.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3CD4A015-C9CA-48DA-A0F8-0A35B8A34560","versionEndExcluding":"6.12.83","versionStartIncluding":"3.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_hid: don't call cdev_init while cdev in use\n\nWhen calling unbind, then bind again, cdev_init reinitialized the cdev,\neven though there may still be references to it. That's the case when\nthe /dev/hidg* device is still opened. This obviously unsafe behavior\nlike oopes.\n\nThis fixes this by using cdev_alloc to put the cdev on the heap. That\nway, we can simply allocate a new one in hidg_bind."}],"id":"CVE-2026-31606","lastModified":"2026-10-30T13:18:41.550","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:39.830","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3aa77f5da0ecb00895411f4246d8a3e4db0343c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a229016ca3ac551294ec59770be9da94ec4bf63"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75ecc46828ec377dd5692c677168ef6d64fd7123"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/81ebd43cc0d6d106ce7b6ccbf7b5e40ca7f5503d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/92f23ab86d9524bc51dae25ed916d0e69dce5992"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c6c0d13db5d0f8d465eabc14bd23d2b6a7247a43"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb6ef6185f2054a341ec70d7e2165f5381744215"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_hid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"92f23ab86d9524bc51dae25ed916d0e69dce5992","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"3aa77f5da0ecb00895411f4246d8a3e4db0343c2","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"c6c0d13db5d0f8d465eabc14bd23d2b6a7247a43","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"eb6ef6185f2054a341ec70d7e2165f5381744215","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"5a229016ca3ac551294ec59770be9da94ec4bf63","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"75ecc46828ec377dd5692c677168ef6d64fd7123","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"},{"lessThan":"81ebd43cc0d6d106ce7b6ccbf7b5e40ca7f5503d","status":"affected","version":"cb382536052fcc7713988869b54a81137069e5a9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_hid.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.19"},{"lessThan":"3.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3CD4A015-C9CA-48DA-A0F8-0A35B8A34560","versionEndExcluding":"6.12.83","versionStartIncluding":"3.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_hid: don't call cdev_init while cdev in use\n\nWhen calling unbind, then bind again, cdev_init reinitialized the cdev,\neven though there may still be references to it. That's the case when\nthe /dev/hidg* device is still opened. This obviously unsafe behavior\nlike oopes.\n\nThis fixes this by using cdev_alloc to put the cdev on the heap. That\nway, we can simply allocate a new one in hidg_bind."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_hid: no llamar a cdev_init mientras cdev esté en uso\n\nAl llamar a unbind, luego a bind de nuevo, cdev_init reinicializaba el cdev, incluso si todavía puede haber referencias a él. Ese es el caso cuando el dispositivo /dev/hidg todavía está abierto. Este comportamiento obviamente inseguro como oopes.\n\nEsto lo soluciona usando cdev_alloc para poner el cdev en el heap. De esa manera, podemos simplemente asignar uno nuevo en hidg_bind."}],"id":"CVE-2026-31606","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:39.830","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3aa77f5da0ecb00895411f4246d8a3e4db0343c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a229016ca3ac551294ec59770be9da94ec4bf63"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75ecc46828ec377dd5692c677168ef6d64fd7123"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/81ebd43cc0d6d106ce7b6ccbf7b5e40ca7f5503d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/92f23ab86d9524bc51dae25ed916d0e69dce5992"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c6c0d13db5d0f8d465eabc14bd23d2b6a7247a43"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb6ef6185f2054a341ec70d7e2165f5381744215"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31607.json b/data/2026/CVE-2026-31607.json index 90333ce337..12df0a70e2 100644 --- a/data/2026/CVE-2026-31607.json +++ b/data/2026/CVE-2026-31607.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/usbip/usbip_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"324262c38438255bf6bdbf6342ca47c0badaab76","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"973f2c250289f5bf6cc146b98aa6fdde11fe50d6","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"ce744264b06b97069b3722511ab355738311fee0","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"885c8591784da6314f9aa82fa460ac69f9f79e5f","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"8d155e2d1c4102f74f82a2bf9c016164bb0f7384","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"906f16a836de13fe61f49cdce2f66f2dbd14caf4","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"ef8ebb1c637b4cfb61a9dd2e013376774ee2033b","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"5e1c4ece08ccdc197177631f111845a2c68eede3","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"2ab833a16a825373aad2ba7d54b572b277e95b71","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"status":"affected","version":"d9638d9236eed035a575feddec61d036dacc2676","versionType":"git"},{"status":"affected","version":"ca7d3501b7a287c18b5b470e871d3029b0f4842a","versionType":"git"},{"status":"affected","version":"1ce528277e1a66856ed3f7526c1e3458c0ed4a70","versionType":"git"},{"status":"affected","version":"db898d0c5c493ce4177d5e1d3a953e079a56a24b","versionType":"git"},{"status":"affected","version":"5aa02704b9ee67c5b2ee26d54c5f4eb99e93ba9a","versionType":"git"},{"lessThan":"2.6.33","status":"affected","version":"2.6.32.37","versionType":"semver"},{"lessThan":"2.6.34","status":"affected","version":"2.6.33.10","versionType":"semver"},{"lessThan":"2.6.35","status":"affected","version":"2.6.34.11","versionType":"semver"},{"lessThan":"2.6.36","status":"affected","version":"2.6.35.13","versionType":"semver"},{"lessThan":"2.6.39","status":"affected","version":"2.6.38.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/usbip/usbip_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.39"},{"lessThan":"2.6.39","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.16.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.77.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_extras_rt_els:7"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.10.0-1160.155.1.rt56.1307.el7","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.10.0-1160.151.1.el7","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.10.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.119.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"860F82EF-76BF-492E-B7CE-559EC99F9C95","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.39","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: validate number_of_packets in usbip_pack_ret_submit()\n\nWhen a USB/IP client receives a RET_SUBMIT response,\nusbip_pack_ret_submit() unconditionally overwrites\nurb->number_of_packets from the network PDU. This value is\nsubsequently used as the loop bound in usbip_recv_iso() and\nusbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible\narray whose size was fixed at URB allocation time based on the\n*original* number_of_packets from the CMD_SUBMIT.\n\nA malicious USB/IP server can set number_of_packets in the response\nto a value larger than what was originally submitted, causing a heap\nout-of-bounds write when usbip_recv_iso() writes to\nurb->iso_frame_desc[i] beyond the allocated region.\n\nKASAN confirmed this with kernel 7.0.0-rc5:\n\n BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640\n Write of size 4 at addr ffff888106351d40 by task vhci_rx/69\n\n The buggy address is located 0 bytes to the right of\n allocated 320-byte region [ffff888106351c00, ffff888106351d40)\n\nThe server side (stub_rx.c) and gadget side (vudc_rx.c) already\nvalidate number_of_packets in the CMD_SUBMIT path since commits\nc6688ef9f297 (\"usbip: fix stub_rx: harden CMD_SUBMIT path to handle\nmalicious input\") and b78d830f0049 (\"usbip: fix vudc_rx: harden\nCMD_SUBMIT path to handle malicious input\"). The server side validates\nagainst USBIP_MAX_ISO_PACKETS because no URB exists yet at that point.\nOn the client side we have the original URB, so we can use the tighter\nbound: the response must not exceed the original number_of_packets.\n\nThis mirrors the existing validation of actual_length against\ntransfer_buffer_length in usbip_recv_xbuff(), which checks the\nresponse value against the original allocation size.\n\nKelvin Mbogo's series (\"usb: usbip: fix integer overflow in\nusbip_recv_iso()\", v2) hardens the receive-side functions themselves;\nthis patch complements that work by catching the bad value at its\nsource -- in usbip_pack_ret_submit() before the overwrite -- and\nusing the tighter per-URB allocation bound rather than the global\nUSBIP_MAX_ISO_PACKETS limit.\n\nFix this by checking rpdu->number_of_packets against\nurb->number_of_packets in usbip_pack_ret_submit() before the\noverwrite. On violation, clamp to zero so that usbip_recv_iso() and\nusbip_pad_iso() safely return early."}],"id":"CVE-2026-31607","lastModified":"2026-10-19T19:18:01.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.5,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31607","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:11.271174Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:39.940","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ab833a16a825373aad2ba7d54b572b277e95b71"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/324262c38438255bf6bdbf6342ca47c0badaab76"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e1c4ece08ccdc197177631f111845a2c68eede3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/885c8591784da6314f9aa82fa460ac69f9f79e5f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d155e2d1c4102f74f82a2bf9c016164bb0f7384"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/906f16a836de13fe61f49cdce2f66f2dbd14caf4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/973f2c250289f5bf6cc146b98aa6fdde11fe50d6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ce744264b06b97069b3722511ab355738311fee0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef8ebb1c637b4cfb61a9dd2e013376774ee2033b"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:19568"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:19569"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23224"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24343"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25095"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:41236"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31607"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461521"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31607.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-805"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/usbip/usbip_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"324262c38438255bf6bdbf6342ca47c0badaab76","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"973f2c250289f5bf6cc146b98aa6fdde11fe50d6","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"ce744264b06b97069b3722511ab355738311fee0","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"885c8591784da6314f9aa82fa460ac69f9f79e5f","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"8d155e2d1c4102f74f82a2bf9c016164bb0f7384","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"906f16a836de13fe61f49cdce2f66f2dbd14caf4","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"ef8ebb1c637b4cfb61a9dd2e013376774ee2033b","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"5e1c4ece08ccdc197177631f111845a2c68eede3","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"lessThan":"2ab833a16a825373aad2ba7d54b572b277e95b71","status":"affected","version":"1325f85fa49f57df034869de430f7c302ae23109","versionType":"git"},{"status":"affected","version":"d9638d9236eed035a575feddec61d036dacc2676","versionType":"git"},{"status":"affected","version":"ca7d3501b7a287c18b5b470e871d3029b0f4842a","versionType":"git"},{"status":"affected","version":"1ce528277e1a66856ed3f7526c1e3458c0ed4a70","versionType":"git"},{"status":"affected","version":"db898d0c5c493ce4177d5e1d3a953e079a56a24b","versionType":"git"},{"status":"affected","version":"5aa02704b9ee67c5b2ee26d54c5f4eb99e93ba9a","versionType":"git"},{"lessThan":"2.6.33","status":"affected","version":"2.6.32.37","versionType":"semver"},{"lessThan":"2.6.34","status":"affected","version":"2.6.33.10","versionType":"semver"},{"lessThan":"2.6.35","status":"affected","version":"2.6.34.11","versionType":"semver"},{"lessThan":"2.6.36","status":"affected","version":"2.6.35.13","versionType":"semver"},{"lessThan":"2.6.39","status":"affected","version":"2.6.38.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/usbip/usbip_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.39"},{"lessThan":"2.6.39","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.16.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-55.77.1.el10_0","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_extras_rt_els:7"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.10.0-1160.155.1.rt56.1307.el7","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:3.10.0-1160.151.1.el7","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.10.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-570.119.1.el9_6","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"860F82EF-76BF-492E-B7CE-559EC99F9C95","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.39","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: validate number_of_packets in usbip_pack_ret_submit()\n\nWhen a USB/IP client receives a RET_SUBMIT response,\nusbip_pack_ret_submit() unconditionally overwrites\nurb->number_of_packets from the network PDU. This value is\nsubsequently used as the loop bound in usbip_recv_iso() and\nusbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible\narray whose size was fixed at URB allocation time based on the\n*original* number_of_packets from the CMD_SUBMIT.\n\nA malicious USB/IP server can set number_of_packets in the response\nto a value larger than what was originally submitted, causing a heap\nout-of-bounds write when usbip_recv_iso() writes to\nurb->iso_frame_desc[i] beyond the allocated region.\n\nKASAN confirmed this with kernel 7.0.0-rc5:\n\n BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640\n Write of size 4 at addr ffff888106351d40 by task vhci_rx/69\n\n The buggy address is located 0 bytes to the right of\n allocated 320-byte region [ffff888106351c00, ffff888106351d40)\n\nThe server side (stub_rx.c) and gadget side (vudc_rx.c) already\nvalidate number_of_packets in the CMD_SUBMIT path since commits\nc6688ef9f297 (\"usbip: fix stub_rx: harden CMD_SUBMIT path to handle\nmalicious input\") and b78d830f0049 (\"usbip: fix vudc_rx: harden\nCMD_SUBMIT path to handle malicious input\"). The server side validates\nagainst USBIP_MAX_ISO_PACKETS because no URB exists yet at that point.\nOn the client side we have the original URB, so we can use the tighter\nbound: the response must not exceed the original number_of_packets.\n\nThis mirrors the existing validation of actual_length against\ntransfer_buffer_length in usbip_recv_xbuff(), which checks the\nresponse value against the original allocation size.\n\nKelvin Mbogo's series (\"usb: usbip: fix integer overflow in\nusbip_recv_iso()\", v2) hardens the receive-side functions themselves;\nthis patch complements that work by catching the bad value at its\nsource -- in usbip_pack_ret_submit() before the overwrite -- and\nusing the tighter per-URB allocation bound rather than the global\nUSBIP_MAX_ISO_PACKETS limit.\n\nFix this by checking rpdu->number_of_packets against\nurb->number_of_packets in usbip_pack_ret_submit() before the\noverwrite. On violation, clamp to zero so that usbip_recv_iso() and\nusbip_pad_iso() safely return early."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusbip: validar number_of_packets en usbip_pack_ret_submit()\n\nCuando un cliente USB/IP recibe una respuesta RET_SUBMIT,\nusbip_pack_ret_submit() sobrescribe incondicionalmente\nurb -> number_of_packets del PDU de red. Este valor se utiliza\nposteriormente como límite de bucle en usbip_recv_iso() y\nusbip_pad_iso() para iterar sobre urb -> iso_frame_desc[], un array\nflexible cuyo tamaño se fijó en el momento de la asignación del URB\nbasándose en el number_of_packets original del CMD_SUBMIT.\n\nUn servidor USB/IP malicioso puede establecer number_of_packets en la\nrespuesta a un valor mayor que el que se envió originalmente, causando\nuna escritura fuera de límites en el heap cuando usbip_recv_iso()\nescribe en urb -> iso_frame_desc[i] más allá de la región asignada.\n\nKASAN confirmó esto con el kernel 7.0.0-rc5:\n\n BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640\n Write of size 4 at addr ffff888106351d40 by task vhci_rx/69\n\n The buggy address is located 0 bytes to the right of\n allocated 320-byte region [ffff888106351c00, ffff888106351d40)\n\nEl lado del servidor (stub_rx.c) y el lado del gadget (vudc_rx.c) ya\nvalidan number_of_packets en la ruta CMD_SUBMIT desde los commits\nc6688ef9f297 (’usbip: fix stub_rx: harden CMD_SUBMIT path to handle\nmalicious input’) y b78d830f0049 (’usbip: fix vudc_rx: harden\nCMD_SUBMIT path to handle malicious input’). El lado del servidor\nvalida contra USBIP_MAX_ISO_PACKETS porque aún no existe un URB en ese\npunto. En el lado del cliente tenemos el URB original, por lo que\npodemos usar el límite más estricto: la respuesta no debe exceder el\nnumber_of_packets original.\n\nEsto refleja la validación existente de actual_length contra\ntransfer_buffer_length en usbip_recv_xbuff(), que verifica el valor de\nrespuesta contra el tamaño de asignación original.\n\nLa serie de Kelvin Mbogo (’usb: usbip: fix desbordamiento de entero en\nusbip_recv_iso()’, v2) refuerza las propias funciones del lado de\nrecepción; este parche complementa ese trabajo al detectar el valor\nincorrecto en su origen - - en usbip_pack_ret_submit() antes de la\nsobrescritura - - y utilizando el límite de asignación por URB más\nestricto en lugar del límite global USBIP_MAX_ISO_PACKETS.\n\nSolucione esto verificando rpdu -> number_of_packets contra\nurb -> number_of_packets en usbip_pack_ret_submit() antes de la\nsobrescritura. En caso de violación, se ajusta a cero para que\nusbip_recv_iso() y usbip_pad_iso() regresen de forma segura y\nanticipada."}],"id":"CVE-2026-31607","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.5,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31607","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:11.271174Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:39.940","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ab833a16a825373aad2ba7d54b572b277e95b71"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/324262c38438255bf6bdbf6342ca47c0badaab76"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e1c4ece08ccdc197177631f111845a2c68eede3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/885c8591784da6314f9aa82fa460ac69f9f79e5f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d155e2d1c4102f74f82a2bf9c016164bb0f7384"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/906f16a836de13fe61f49cdce2f66f2dbd14caf4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/973f2c250289f5bf6cc146b98aa6fdde11fe50d6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ce744264b06b97069b3722511ab355738311fee0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef8ebb1c637b4cfb61a9dd2e013376774ee2033b"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:19568"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:19569"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:23224"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24343"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25095"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:41236"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31607"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461521"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31607.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-805"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31608.json b/data/2026/CVE-2026-31608.json index 6a11129ef3..4139fc6b44 100644 --- a/data/2026/CVE-2026-31608.json +++ b/data/2026/CVE-2026-31608.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6968c91fab05b8fc4d6700e0cf34472bb422df25","status":"affected","version":"5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7","versionType":"git"},{"lessThan":"2ba03f46132b0d1a7bafb86e1ef61951a2254023","status":"affected","version":"79242e7b6bc63efec28b7c235bc320806afce6c0","versionType":"git"},{"lessThan":"830de6eeb9db4cb7e758201fb99328ef4ca4b032","status":"affected","version":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","versionType":"git"},{"lessThan":"84ff995ae826aa6bbcc6c7b9ea569ff67c021d72","status":"affected","version":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","versionType":"git"},{"lessThan":"6.18.24","status":"affected","version":"6.18.11","versionType":"semver"},{"lessThan":"6.19.14","status":"affected","version":"6.19.1","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.0"},{"lessThan":"7.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E7BFA239-2F39-4B24-92AA-6F60AA187C18","versionEndExcluding":"6.18.24","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()\n\nsmb_direct_flush_send_list() already calls smb_direct_free_sendmsg(),\nso we should not call it again after post_sendmsg()\nmoved it to the batch list."}],"id":"CVE-2026-31608","lastModified":"2026-06-17T10:34:04.863","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:40.063","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ba03f46132b0d1a7bafb86e1ef61951a2254023"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6968c91fab05b8fc4d6700e0cf34472bb422df25"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/830de6eeb9db4cb7e758201fb99328ef4ca4b032"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/84ff995ae826aa6bbcc6c7b9ea569ff67c021d72"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6968c91fab05b8fc4d6700e0cf34472bb422df25","status":"affected","version":"5ef18a2e66f2f33fdac64437bddfb9fe6389fdc7","versionType":"git"},{"lessThan":"2ba03f46132b0d1a7bafb86e1ef61951a2254023","status":"affected","version":"79242e7b6bc63efec28b7c235bc320806afce6c0","versionType":"git"},{"lessThan":"830de6eeb9db4cb7e758201fb99328ef4ca4b032","status":"affected","version":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","versionType":"git"},{"lessThan":"84ff995ae826aa6bbcc6c7b9ea569ff67c021d72","status":"affected","version":"34abd408c8ba24d7c97bd02ba874d8c714f49db1","versionType":"git"},{"lessThan":"6.18.24","status":"affected","version":"6.18.11","versionType":"semver"},{"lessThan":"6.19.14","status":"affected","version":"6.19.1","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/transport_rdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.0"},{"lessThan":"7.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E7BFA239-2F39-4B24-92AA-6F60AA187C18","versionEndExcluding":"6.18.24","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()\n\nsmb_direct_flush_send_list() already calls smb_direct_free_sendmsg(),\nso we should not call it again after post_sendmsg()\nmoved it to the batch list."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: servidor: evitar doble liberación en smb_direct_free_sendmsg después de smb_direct_flush_send_list()\n\nsmb_direct_flush_send_list() ya llama a smb_direct_free_sendmsg(),\npor lo que no deberíamos llamarla de nuevo después de que post_sendmsg() la moviera a la lista de lotes."}],"id":"CVE-2026-31608","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:40.063","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ba03f46132b0d1a7bafb86e1ef61951a2254023"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6968c91fab05b8fc4d6700e0cf34472bb422df25"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/830de6eeb9db4cb7e758201fb99328ef4ca4b032"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/84ff995ae826aa6bbcc6c7b9ea569ff67c021d72"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31609.json b/data/2026/CVE-2026-31609.json index 89c747648c..6bf2f54a0e 100644 --- a/data/2026/CVE-2026-31609.json +++ b/data/2026/CVE-2026-31609.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smbdirect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a9940dcbe5cb92482c04efc7341039ddf7dbf607","status":"affected","version":"cca0526ef2344cab6944d7f441fc24e152da031b","versionType":"git"},{"lessThan":"22b7c1c619d808aec4cad3dc42103345e370d107","status":"affected","version":"37b5c06956183b65e6808b509cf637632016cdf7","versionType":"git"},{"lessThan":"f9a162c2bbcd0ac85bd07c5b37cf20286048b65c","status":"affected","version":"21538121efe6c8c5b51c742fa02cbe820bc48714","versionType":"git"},{"lessThan":"27b7c3e916218b5eb2ee350211140e961bfc49be","status":"affected","version":"21538121efe6c8c5b51c742fa02cbe820bc48714","versionType":"git"},{"lessThan":"6.18.24","status":"affected","version":"6.18.11","versionType":"semver"},{"lessThan":"6.19.14","status":"affected","version":"6.19.1","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smbdirect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.0"},{"lessThan":"7.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E7BFA239-2F39-4B24-92AA-6F60AA187C18","versionEndExcluding":"6.18.24","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()\n\nsmbd_send_batch_flush() already calls smbd_free_send_io(),\nso we should not call it again after smbd_post_send()\nmoved it to the batch list."}],"id":"CVE-2026-31609","lastModified":"2026-10-19T19:18:01.603","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31609","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:13.445840Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:40.160","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/22b7c1c619d808aec4cad3dc42103345e370d107"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/27b7c3e916218b5eb2ee350211140e961bfc49be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a9940dcbe5cb92482c04efc7341039ddf7dbf607"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f9a162c2bbcd0ac85bd07c5b37cf20286048b65c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smbdirect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a9940dcbe5cb92482c04efc7341039ddf7dbf607","status":"affected","version":"cca0526ef2344cab6944d7f441fc24e152da031b","versionType":"git"},{"lessThan":"22b7c1c619d808aec4cad3dc42103345e370d107","status":"affected","version":"37b5c06956183b65e6808b509cf637632016cdf7","versionType":"git"},{"lessThan":"f9a162c2bbcd0ac85bd07c5b37cf20286048b65c","status":"affected","version":"21538121efe6c8c5b51c742fa02cbe820bc48714","versionType":"git"},{"lessThan":"27b7c3e916218b5eb2ee350211140e961bfc49be","status":"affected","version":"21538121efe6c8c5b51c742fa02cbe820bc48714","versionType":"git"},{"lessThan":"6.18.24","status":"affected","version":"6.18.11","versionType":"semver"},{"lessThan":"6.19.14","status":"affected","version":"6.19.1","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smbdirect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"7.0"},{"lessThan":"7.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E7BFA239-2F39-4B24-92AA-6F60AA187C18","versionEndExcluding":"6.18.24","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()\n\nsmbd_send_batch_flush() already calls smbd_free_send_io(),\nso we should not call it again after smbd_post_send()\nmoved it to the batch list."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: cliente: evitar doble liberación en smbd_free_send_io() después de smbd_send_batch_flush()\n\nsmbd_send_batch_flush() ya llama a smbd_free_send_io(),\npor lo que no deberíamos llamarla de nuevo después de que smbd_post_send() la moviera a la lista de lotes."}],"id":"CVE-2026-31609","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31609","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:13.445840Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:40.160","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/22b7c1c619d808aec4cad3dc42103345e370d107"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/27b7c3e916218b5eb2ee350211140e961bfc49be"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a9940dcbe5cb92482c04efc7341039ddf7dbf607"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f9a162c2bbcd0ac85bd07c5b37cf20286048b65c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-415"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31610.json b/data/2026/CVE-2026-31610.json index 90b00fe494..ae63ab3d13 100644 --- a/data/2026/CVE-2026-31610.json +++ b/data/2026/CVE-2026-31610.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/connection.c","fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ae9cdb29efed20ffdee9ff3b0bb72fb369c353da","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"bd4a7fb04f06f419b0e93d8b52fe32067eb312d1","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"745a535461bbb90a56d9357573c9f97a5c12abe1","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"dd577cb55588ec3fbc66af3621280306601c4192","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"dd53414e301beb915fe672dc4c4a51bafb917604","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"269c800a7a7e363459291885b35f7bc72e231ed6","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"6c8c44e6553b9f072f62d9875e567766eb293162","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"ad0057fb91218914d6c98268718ceb9d59b388e1","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/connection.c","fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B1ABA9F0-A5C4-4CBE-92EC-33CA7D4F7634","versionEndExcluding":"6.6.136","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix mechToken leak when SPNEGO decode fails after token alloc\n\nThe kernel ASN.1 BER decoder calls action callbacks incrementally as it\nwalks the input. When ksmbd_decode_negTokenInit() reaches the mechToken\n[2] OCTET STRING element, ksmbd_neg_token_alloc() allocates\nconn->mechToken immediately via kmemdup_nul(). If a later element in\nthe same blob is malformed, then the decoder will return nonzero after\nthe allocation is already live. This could happen if mechListMIC [3]\noverrunse the enclosing SEQUENCE.\n\ndecode_negotiation_token() then sets conn->use_spnego = false because\nboth the negTokenInit and negTokenTarg grammars failed. The cleanup at\nthe bottom of smb2_sess_setup() is gated on use_spnego:\n\n\tif (conn->use_spnego && conn->mechToken) {\n\t\tkfree(conn->mechToken);\n\t\tconn->mechToken = NULL;\n\t}\n\nso the kfree is skipped, causing the mechToken to never be freed.\n\nThis codepath is reachable pre-authentication, so untrusted clients can\ncause slow memory leaks on a server without even being properly\nauthenticated.\n\nFix this up by not checking check for use_spnego, as it's not required,\nso the memory will always be properly freed. At the same time, always\nfree the memory in ksmbd_conn_free() incase some other failure path\nforgot to free it."}],"id":"CVE-2026-31610","lastModified":"2026-07-24T15:17:15.640","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:40.257","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/269c800a7a7e363459291885b35f7bc72e231ed6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6c8c44e6553b9f072f62d9875e567766eb293162"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/745a535461bbb90a56d9357573c9f97a5c12abe1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ad0057fb91218914d6c98268718ceb9d59b388e1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ae9cdb29efed20ffdee9ff3b0bb72fb369c353da"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bd4a7fb04f06f419b0e93d8b52fe32067eb312d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dd53414e301beb915fe672dc4c4a51bafb917604"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dd577cb55588ec3fbc66af3621280306601c4192"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/connection.c","fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ae9cdb29efed20ffdee9ff3b0bb72fb369c353da","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"bd4a7fb04f06f419b0e93d8b52fe32067eb312d1","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"745a535461bbb90a56d9357573c9f97a5c12abe1","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"dd577cb55588ec3fbc66af3621280306601c4192","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"dd53414e301beb915fe672dc4c4a51bafb917604","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"269c800a7a7e363459291885b35f7bc72e231ed6","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"6c8c44e6553b9f072f62d9875e567766eb293162","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"},{"lessThan":"ad0057fb91218914d6c98268718ceb9d59b388e1","status":"affected","version":"fad4161b5cd01a24202234976ebbb133f7adc0b5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/connection.c","fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B1ABA9F0-A5C4-4CBE-92EC-33CA7D4F7634","versionEndExcluding":"6.6.136","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix mechToken leak when SPNEGO decode fails after token alloc\n\nThe kernel ASN.1 BER decoder calls action callbacks incrementally as it\nwalks the input. When ksmbd_decode_negTokenInit() reaches the mechToken\n[2] OCTET STRING element, ksmbd_neg_token_alloc() allocates\nconn->mechToken immediately via kmemdup_nul(). If a later element in\nthe same blob is malformed, then the decoder will return nonzero after\nthe allocation is already live. This could happen if mechListMIC [3]\noverrunse the enclosing SEQUENCE.\n\ndecode_negotiation_token() then sets conn->use_spnego = false because\nboth the negTokenInit and negTokenTarg grammars failed. The cleanup at\nthe bottom of smb2_sess_setup() is gated on use_spnego:\n\n\tif (conn->use_spnego && conn->mechToken) {\n\t\tkfree(conn->mechToken);\n\t\tconn->mechToken = NULL;\n\t}\n\nso the kfree is skipped, causing the mechToken to never be freed.\n\nThis codepath is reachable pre-authentication, so untrusted clients can\ncause slow memory leaks on a server without even being properly\nauthenticated.\n\nFix this up by not checking check for use_spnego, as it's not required,\nso the memory will always be properly freed. At the same time, always\nfree the memory in ksmbd_conn_free() incase some other failure path\nforgot to free it."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: corrige la fuga de mechToken cuando la decodificación SPNEGO falla después de la asignación del token\n\nEl decodificador BER ASN.1 del kernel llama a las devoluciones de llamada de acción incrementalmente a medida que recorre la entrada. Cuando ksmbd_decode_negTokenInit() alcanza el elemento OCTET STRING mechToken [2], ksmbd_neg_token_alloc() asigna conn -> mechToken inmediatamente a través de kmemdup_nul(). Si un elemento posterior en el mismo blob está malformado, entonces el decodificador devolverá un valor distinto de cero después de que la asignación ya esté activa. Esto podría ocurrir si mechListMIC [3] excede la SEQUENCE que lo contiene.\n\ndecode_negotiation_token() luego establece conn -> use_spnego = false porque ambas gramáticas negTokenInit y negTokenTarg fallaron. La limpieza al final de smb2_sess_setup() está condicionada por use_spnego:\n\n\tsi (conn -> use_spnego && conn -> mechToken) {\n\t\tkfree(conn -> mechToken);\n\t\tconn -> mechToken = NULL;\n\t}\n\npor lo que el kfree se omite, haciendo que el mechToken nunca sea liberado.\n\nEsta ruta de código es alcanzable pre-autenticación, por lo que los clientes no confiables pueden causar fugas de memoria lentas en un servidor sin siquiera estar correctamente autenticados.\n\nSoluciona esto al no verificar use_spnego, ya que no es necesario, por lo que la memoria siempre será liberada correctamente. Al mismo tiempo, libera siempre la memoria en ksmbd_conn_free() en caso de que alguna otra ruta de fallo olvidara liberarla."}],"id":"CVE-2026-31610","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:40.257","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/269c800a7a7e363459291885b35f7bc72e231ed6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6c8c44e6553b9f072f62d9875e567766eb293162"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/745a535461bbb90a56d9357573c9f97a5c12abe1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ad0057fb91218914d6c98268718ceb9d59b388e1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/ae9cdb29efed20ffdee9ff3b0bb72fb369c353da"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/bd4a7fb04f06f419b0e93d8b52fe32067eb312d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dd53414e301beb915fe672dc4c4a51bafb917604"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dd577cb55588ec3fbc66af3621280306601c4192"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31611.json b/data/2026/CVE-2026-31611.json index 20eefa32b7..599e1ac05f 100644 --- a/data/2026/CVE-2026-31611.json +++ b/data/2026/CVE-2026-31611.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cf2148b880fb7c0fcd727202dbc4fd5d6998b9c2","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"b5b5d5936a50497fb151c0b122899a6894721c2b","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"08f9e6d899b5c834bbcc239eae1bed58d9b15d2c","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"d2454f4a002d08560a60f214f392e6491cf11560","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"46bbcd3ebfb3549c8da1838fc4493e79bd3241e7","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"9401f86a224f37b50e6a3ccf1d46a70d5ef8af0a","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"53370cf9090777774e07fd9a8ebce67c6cc333ab","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B1ABA9F0-A5C4-4CBE-92EC-33CA7D4F7634","versionEndExcluding":"6.6.136","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require 3 sub-authorities before reading sub_auth[2]\n\nparse_dacl() compares each ACE SID against sid_unix_NFS_mode and on\nmatch reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode is\nthe prefix S-1-5-88-3 with num_subauth = 2 then compare_sids() compares\nonly min(num_subauth, 2) sub-authorities so a client SID with\nnum_subauth = 2 and sub_auth = {88, 3} will match.\n\nIf num_subauth = 2 and the ACE is placed at the very end of the security\ndescriptor, sub_auth[2] will be 4 bytes past end_of_acl. The\nout-of-band bytes will then be masked to the low 9 bits and applied as\nthe file's POSIX mode, probably not something that is good to have\nhappen.\n\nFix this up by forcing the SID to actually carry a third sub-authority\nbefore reading it at all."}],"id":"CVE-2026-31611","lastModified":"2026-10-15T02:19:12.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:40.360","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08f9e6d899b5c834bbcc239eae1bed58d9b15d2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/46bbcd3ebfb3549c8da1838fc4493e79bd3241e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/53370cf9090777774e07fd9a8ebce67c6cc333ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9401f86a224f37b50e6a3ccf1d46a70d5ef8af0a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5b5d5936a50497fb151c0b122899a6894721c2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/cf2148b880fb7c0fcd727202dbc4fd5d6998b9c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d2454f4a002d08560a60f214f392e6491cf11560"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"cf2148b880fb7c0fcd727202dbc4fd5d6998b9c2","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"b5b5d5936a50497fb151c0b122899a6894721c2b","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"08f9e6d899b5c834bbcc239eae1bed58d9b15d2c","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"d2454f4a002d08560a60f214f392e6491cf11560","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"46bbcd3ebfb3549c8da1838fc4493e79bd3241e7","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"9401f86a224f37b50e6a3ccf1d46a70d5ef8af0a","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"53370cf9090777774e07fd9a8ebce67c6cc333ab","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smbacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B1ABA9F0-A5C4-4CBE-92EC-33CA7D4F7634","versionEndExcluding":"6.6.136","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require 3 sub-authorities before reading sub_auth[2]\n\nparse_dacl() compares each ACE SID against sid_unix_NFS_mode and on\nmatch reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode is\nthe prefix S-1-5-88-3 with num_subauth = 2 then compare_sids() compares\nonly min(num_subauth, 2) sub-authorities so a client SID with\nnum_subauth = 2 and sub_auth = {88, 3} will match.\n\nIf num_subauth = 2 and the ACE is placed at the very end of the security\ndescriptor, sub_auth[2] will be 4 bytes past end_of_acl. The\nout-of-band bytes will then be masked to the low 9 bits and applied as\nthe file's POSIX mode, probably not something that is good to have\nhappen.\n\nFix this up by forcing the SID to actually carry a third sub-authority\nbefore reading it at all."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: requiere 3 subautoridades antes de leer sub_auth[2]\n\nparse_dacl() compara cada SID de ACE contra sid_unix_NFS_mode y, en caso de coincidencia, lee sid.sub_auth[2] como el modo de archivo. Si sid_unix_NFS_mode es el prefijo S-1-5-88-3 con num_subauth = 2, entonces compare_sids() compara solo min(num_subauth, 2) subautoridades, por lo que un SID de cliente con num_subauth = 2 y sub_auth = {88, 3} coincidirá.\n\nSi num_subauth = 2 y el ACE se coloca al final del descriptor de seguridad, sub_auth[2] estará 4 bytes más allá de end_of_acl. Los bytes fuera de banda se enmascararán entonces a los 9 bits bajos y se aplicarán como el modo POSIX del archivo, probablemente no sea algo bueno que suceda.\n\nSolucione esto forzando al SID a llevar realmente una tercera subautoridad antes de leerlo en absoluto."}],"id":"CVE-2026-31611","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.7,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:40.360","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/08f9e6d899b5c834bbcc239eae1bed58d9b15d2c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/46bbcd3ebfb3549c8da1838fc4493e79bd3241e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/53370cf9090777774e07fd9a8ebce67c6cc333ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9401f86a224f37b50e6a3ccf1d46a70d5ef8af0a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5b5d5936a50497fb151c0b122899a6894721c2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/cf2148b880fb7c0fcd727202dbc4fd5d6998b9c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d2454f4a002d08560a60f214f392e6491cf11560"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31612.json b/data/2026/CVE-2026-31612.json index 1c49d4593c..80764644e9 100644 --- a/data/2026/CVE-2026-31612.json +++ b/data/2026/CVE-2026-31612.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"859f11e1bc81a4d32bb3ceeae54bcd296ac675d3","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"4b73376feecb3b61172fe5b4ff42bbbb8531669d","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"551dfb15b182abad4600eaf7b37e6eb7000d5b1b","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"3363a770b193f555f29d76ddf4ced3305c0ccf6d","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"243b206bcb5a7137e8bddd57b2eec81e1ebd3859","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"dfc6878d14acafffbe670bf2576620757a10a3d8","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"66751841212c2cc196577453c37f7774ff363f02","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B1ABA9F0-A5C4-4CBE-92EC-33CA7D4F7634","versionEndExcluding":"6.6.136","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate EaNameLength in smb2_get_ea()\n\nsmb2_get_ea() reads ea_req->EaNameLength from the client request and\npasses it directly to strncmp() as the comparison length without\nverifying that the length of the name really is the size of the input\nbuffer received.\n\nFix this up by properly checking the size of the name based on the value\nreceived and the overall size of the request, to prevent a later\nstrncmp() call to use the length as a \"trusted\" size of the buffer.\nWithout this check, uninitialized heap values might be slowly leaked to\nthe client."}],"id":"CVE-2026-31612","lastModified":"2026-10-15T02:19:12.443","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:40.460","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/243b206bcb5a7137e8bddd57b2eec81e1ebd3859"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3363a770b193f555f29d76ddf4ced3305c0ccf6d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b73376feecb3b61172fe5b4ff42bbbb8531669d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/551dfb15b182abad4600eaf7b37e6eb7000d5b1b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66751841212c2cc196577453c37f7774ff363f02"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/859f11e1bc81a4d32bb3ceeae54bcd296ac675d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dfc6878d14acafffbe670bf2576620757a10a3d8"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"859f11e1bc81a4d32bb3ceeae54bcd296ac675d3","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"4b73376feecb3b61172fe5b4ff42bbbb8531669d","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"551dfb15b182abad4600eaf7b37e6eb7000d5b1b","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"3363a770b193f555f29d76ddf4ced3305c0ccf6d","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"243b206bcb5a7137e8bddd57b2eec81e1ebd3859","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"dfc6878d14acafffbe670bf2576620757a10a3d8","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"},{"lessThan":"66751841212c2cc196577453c37f7774ff363f02","status":"affected","version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/server/smb2pdu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.15"},{"lessThan":"5.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B1ABA9F0-A5C4-4CBE-92EC-33CA7D4F7634","versionEndExcluding":"6.6.136","versionStartIncluding":"5.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate EaNameLength in smb2_get_ea()\n\nsmb2_get_ea() reads ea_req->EaNameLength from the client request and\npasses it directly to strncmp() as the comparison length without\nverifying that the length of the name really is the size of the input\nbuffer received.\n\nFix this up by properly checking the size of the name based on the value\nreceived and the overall size of the request, to prevent a later\nstrncmp() call to use the length as a \"trusted\" size of the buffer.\nWithout this check, uninitialized heap values might be slowly leaked to\nthe client."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: validar EaNameLength en smb2_get_ea()\n\nsmb2_get_ea() lee ea_req -> EaNameLength de la solicitud del cliente y lo pasa directamente a strncmp() como la longitud de comparación sin verificar que la longitud del nombre realmente sea el tamaño del búfer de entrada recibido.\n\nEsto se soluciona comprobando correctamente el tamaño del nombre basándose en el valor recibido y el tamaño total de la solicitud, para evitar que una llamada posterior a strncmp() use la longitud como un tamaño ’confiable’ del búfer. Sin esta comprobación, los valores de pila no inicializados podrían filtrarse lentamente al cliente."}],"id":"CVE-2026-31612","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:40.460","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/243b206bcb5a7137e8bddd57b2eec81e1ebd3859"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3363a770b193f555f29d76ddf4ced3305c0ccf6d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b73376feecb3b61172fe5b4ff42bbbb8531669d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/551dfb15b182abad4600eaf7b37e6eb7000d5b1b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66751841212c2cc196577453c37f7774ff363f02"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/859f11e1bc81a4d32bb3ceeae54bcd296ac675d3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dfc6878d14acafffbe670bf2576620757a10a3d8"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31613.json b/data/2026/CVE-2026-31613.json index 25e8eec8e7..9b5be0b882 100644 --- a/data/2026/CVE-2026-31613.json +++ b/data/2026/CVE-2026-31613.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smb2file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"043834e72337ee7b4e9685859888623ba1504ac7","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"lessThan":"d65a64755a3df68a2fd19d2a81395e9f723aca23","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"lessThan":"20ac98f0eb6047edb73c9a27af782bdde08b3757","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"lessThan":"e0dd90d14cbbf318157ea8e3fb62ee68a28655ed","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"lessThan":"781902e069f4ecb6c3b83502f181972c1446110a","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"lessThan":"a66ef2e7ed837325c5600f8617d5ee0a0a149fdd","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"lessThan":"3df690bba28edec865cf7190be10708ad0ddd67e","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"status":"affected","version":"2d046892a493d9760c35fdaefc3017f27f91b621","versionType":"git"},{"lessThan":"6.1","status":"affected","version":"6.0.16","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smb2file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.1"},{"lessThan":"6.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.141","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.91","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F141EC61-6476-4983-A772-21DE7575B28E","versionEndExcluding":"6.18.24","versionStartIncluding":"6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB reads parsing symlink error response\n\nWhen a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message()\nreturns success without any length validation, leaving the symlink\nparsers as the only defense against an untrusted server.\n\nsymlink_data() walks SMB 3.1.1 error contexts with the loop test \"p <\nend\", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset\n0. When the server-controlled ErrorDataLength advances p to within 1-7\nbytes of end, the next iteration will read past it. When the matching\ncontext is found, sym->SymLinkErrorTag is read at offset 4 from\np->ErrorContextData with no check that the symlink header itself fits.\n\nsmb2_parse_symlink_response() then bounds-checks the substitute name\nusing SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from\niov_base. That value is computed as sizeof(smb2_err_rsp) +\nsizeof(smb2_symlink_err_rsp), which is correct only when\nErrorContextCount == 0.\n\nWith at least one error context the symlink data sits 8 bytes deeper,\nand each skipped non-matching context shifts it further by 8 +\nALIGN(ErrorDataLength, 8). The check is too short, allowing the\nsubstitute name read to run past iov_len. The out-of-bound heap bytes\nare UTF-16-decoded into the symlink target and returned to userspace via\nreadlink(2).\n\nFix this all up by making the loops test require the full context header\nto fit, rejecting sym if its header runs past end, and bound the\nsubstitute name against the actual position of sym->PathBuffer rather\nthan a fixed offset.\n\nBecause sub_offs and sub_len are 16bits, the pointer math will not\noverflow here with the new greater-than."}],"id":"CVE-2026-31613","lastModified":"2026-10-19T19:18:01.757","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31613","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:15.811123Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:40.560","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/043834e72337ee7b4e9685859888623ba1504ac7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/20ac98f0eb6047edb73c9a27af782bdde08b3757"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3df690bba28edec865cf7190be10708ad0ddd67e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/781902e069f4ecb6c3b83502f181972c1446110a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a66ef2e7ed837325c5600f8617d5ee0a0a149fdd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d65a64755a3df68a2fd19d2a81395e9f723aca23"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0dd90d14cbbf318157ea8e3fb62ee68a28655ed"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smb2file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"043834e72337ee7b4e9685859888623ba1504ac7","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"lessThan":"d65a64755a3df68a2fd19d2a81395e9f723aca23","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"lessThan":"20ac98f0eb6047edb73c9a27af782bdde08b3757","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"lessThan":"e0dd90d14cbbf318157ea8e3fb62ee68a28655ed","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"lessThan":"781902e069f4ecb6c3b83502f181972c1446110a","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"lessThan":"a66ef2e7ed837325c5600f8617d5ee0a0a149fdd","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"lessThan":"3df690bba28edec865cf7190be10708ad0ddd67e","status":"affected","version":"76894f3e2f71177747b8b4763fb180e800279585","versionType":"git"},{"status":"affected","version":"2d046892a493d9760c35fdaefc3017f27f91b621","versionType":"git"},{"lessThan":"6.1","status":"affected","version":"6.0.16","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smb2file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.1"},{"lessThan":"6.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.141","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.91","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F141EC61-6476-4983-A772-21DE7575B28E","versionEndExcluding":"6.18.24","versionStartIncluding":"6.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix OOB reads parsing symlink error response\n\nWhen a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message()\nreturns success without any length validation, leaving the symlink\nparsers as the only defense against an untrusted server.\n\nsymlink_data() walks SMB 3.1.1 error contexts with the loop test \"p <\nend\", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset\n0. When the server-controlled ErrorDataLength advances p to within 1-7\nbytes of end, the next iteration will read past it. When the matching\ncontext is found, sym->SymLinkErrorTag is read at offset 4 from\np->ErrorContextData with no check that the symlink header itself fits.\n\nsmb2_parse_symlink_response() then bounds-checks the substitute name\nusing SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from\niov_base. That value is computed as sizeof(smb2_err_rsp) +\nsizeof(smb2_symlink_err_rsp), which is correct only when\nErrorContextCount == 0.\n\nWith at least one error context the symlink data sits 8 bytes deeper,\nand each skipped non-matching context shifts it further by 8 +\nALIGN(ErrorDataLength, 8). The check is too short, allowing the\nsubstitute name read to run past iov_len. The out-of-bound heap bytes\nare UTF-16-decoded into the symlink target and returned to userspace via\nreadlink(2).\n\nFix this all up by making the loops test require the full context header\nto fit, rejecting sym if its header runs past end, and bound the\nsubstitute name against the actual position of sym->PathBuffer rather\nthan a fixed offset.\n\nBecause sub_offs and sub_len are 16bits, the pointer math will not\noverflow here with the new greater-than."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: cliente: corrige lecturas fuera de límites (OOB) al analizar la respuesta de error de enlace simbólico\n\nCuando un CREATE devuelve STATUS_STOPPED_ON_SYMLINK, smb2_check_message() devuelve éxito sin ninguna validación de longitud, dejando los analizadores de enlaces simbólicos como la única defensa contra un servidor no confiable.\n\nsymlink_data() recorre los contextos de error de SMB 3.1.1 con la prueba de bucle “p < end”, pero lee p -> ErrorId en el desplazamiento 4 y p -> ErrorDataLength en el desplazamiento 0. Cuando ErrorDataLength, controlado por el servidor, avanza p a una distancia de 1-7 bytes de ’end’, la siguiente iteración leerá más allá de este. Cuando se encuentra el contexto coincidente, sym -> SymLinkErrorTag se lee en el desplazamiento 4 de p -> ErrorContextData sin ninguna comprobación de que el encabezado del enlace simbólico encaje.\n\nsmb2_parse_symlink_response() luego comprueba los límites del nombre sustituto usando SMB2_SYMLINK_STRUCT_SIZE como el desplazamiento de PathBuffer desde iov_base. Ese valor se calcula como sizeof(smb2_err_rsp) + sizeof(smb2_symlink_err_rsp), lo cual es correcto solo cuando ErrorContextCount == 0.\n\nCon al menos un contexto de error, los datos del enlace simbólico se encuentran 8 bytes más profundos, y cada contexto no coincidente omitido lo desplaza aún más en 8 + ALIGN(ErrorDataLength, 8). La comprobación es demasiado corta, permitiendo que la lectura del nombre sustituto se extienda más allá de iov_len. Los bytes de pila fuera de límites se decodifican en UTF-16 en el destino del enlace simbólico y se devuelven al espacio de usuario a través de readlink(2).\n\nSolucione todo esto haciendo que la prueba de los bucles requiera que el encabezado de contexto completo encaje, rechazando ’sym’ si su encabezado se extiende más allá de ’end’, y limite el nombre sustituto contra la posición real de sym -> PathBuffer en lugar de un desplazamiento fijo.\n\nDebido a que sub_offs y sub_len son de 16 bits, la aritmética de punteros no desbordará aquí con el nuevo “mayor que”."}],"id":"CVE-2026-31613","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31613","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:15.811123Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:40.560","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/043834e72337ee7b4e9685859888623ba1504ac7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/20ac98f0eb6047edb73c9a27af782bdde08b3757"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3df690bba28edec865cf7190be10708ad0ddd67e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/781902e069f4ecb6c3b83502f181972c1446110a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a66ef2e7ed837325c5600f8617d5ee0a0a149fdd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d65a64755a3df68a2fd19d2a81395e9f723aca23"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0dd90d14cbbf318157ea8e3fb62ee68a28655ed"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31614.json b/data/2026/CVE-2026-31614.json index 1efa1a38e5..c7607d7aee 100644 --- a/data/2026/CVE-2026-31614.json +++ b/data/2026/CVE-2026-31614.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smb2inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"bfbc74df8bbe095b3ed68f6d4487b368af087890","status":"affected","version":"7449d736bbbd160c76b01b8fcdf72f58a8757d4b","versionType":"git"},{"lessThan":"5cc0574c84aa73946ade587c41e81757b8b01cb5","status":"affected","version":"ea41367b2a602f602ea6594fc4a310520dcc64f4","versionType":"git"},{"lessThan":"b2b76d09a64c538c57006180103fc1841e8cfa66","status":"affected","version":"ea41367b2a602f602ea6594fc4a310520dcc64f4","versionType":"git"},{"lessThan":"ba3ad159aa61810bbe0acaf39578b1ebfb6f1a18","status":"affected","version":"ea41367b2a602f602ea6594fc4a310520dcc64f4","versionType":"git"},{"lessThan":"a893f1757d9a4009e4a8d7ceb2312142fe29cea4","status":"affected","version":"ea41367b2a602f602ea6594fc4a310520dcc64f4","versionType":"git"},{"lessThan":"3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b","status":"affected","version":"ea41367b2a602f602ea6594fc4a310520dcc64f4","versionType":"git"},{"lessThan":"6.6.136","status":"affected","version":"6.6.32","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smb2inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1487B72A-0930-4903-A6AE-173E355D9209","versionEndExcluding":"6.6.136","versionStartIncluding":"6.6.32","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ABBF18DE-4F74-47AB-B0B1-8493B33EDC1E","versionEndExcluding":"6.12.83","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix off-by-8 bounds check in check_wsl_eas()\n\nThe bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA\nname and value, but ea_data sits at offset sizeof(struct\nsmb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncmp()\nlater reads ea->ea_data[0..nlen-1] and the value bytes follow at\nea_data[nlen+1..nlen+vlen], so the actual end is ea->ea_data + nlen + 1\n+ vlen. Isn't pointer math fun?\n\nThe earlier check (u8 *)ea > end - sizeof(*ea) only guarantees the\n8-byte header is in bounds, but since the last EA is placed within 8\nbytes of the end of the response, the name and value bytes are read past\nthe end of iov.\n\nFix this mess all up by using ea->ea_data as the base for the bounds\ncheck.\n\nAn \"untrusted\" server can use this to leak up to 8 bytes of kernel heap\ninto the EA name comparison and influence which WSL xattr the data is\ninterpreted as."}],"id":"CVE-2026-31614","lastModified":"2026-11-06T16:18:03.247","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31614","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:40.298481Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:40.663","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5cc0574c84aa73946ade587c41e81757b8b01cb5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a893f1757d9a4009e4a8d7ceb2312142fe29cea4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b2b76d09a64c538c57006180103fc1841e8cfa66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba3ad159aa61810bbe0acaf39578b1ebfb6f1a18"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bfbc74df8bbe095b3ed68f6d4487b368af087890"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/smb/client/smb2inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"bfbc74df8bbe095b3ed68f6d4487b368af087890","status":"affected","version":"7449d736bbbd160c76b01b8fcdf72f58a8757d4b","versionType":"git"},{"lessThan":"5cc0574c84aa73946ade587c41e81757b8b01cb5","status":"affected","version":"ea41367b2a602f602ea6594fc4a310520dcc64f4","versionType":"git"},{"lessThan":"b2b76d09a64c538c57006180103fc1841e8cfa66","status":"affected","version":"ea41367b2a602f602ea6594fc4a310520dcc64f4","versionType":"git"},{"lessThan":"ba3ad159aa61810bbe0acaf39578b1ebfb6f1a18","status":"affected","version":"ea41367b2a602f602ea6594fc4a310520dcc64f4","versionType":"git"},{"lessThan":"a893f1757d9a4009e4a8d7ceb2312142fe29cea4","status":"affected","version":"ea41367b2a602f602ea6594fc4a310520dcc64f4","versionType":"git"},{"lessThan":"3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b","status":"affected","version":"ea41367b2a602f602ea6594fc4a310520dcc64f4","versionType":"git"},{"lessThan":"6.6.136","status":"affected","version":"6.6.32","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/smb/client/smb2inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1487B72A-0930-4903-A6AE-173E355D9209","versionEndExcluding":"6.6.136","versionStartIncluding":"6.6.32","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ABBF18DE-4F74-47AB-B0B1-8493B33EDC1E","versionEndExcluding":"6.12.83","versionStartIncluding":"6.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix off-by-8 bounds check in check_wsl_eas()\n\nThe bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA\nname and value, but ea_data sits at offset sizeof(struct\nsmb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncmp()\nlater reads ea->ea_data[0..nlen-1] and the value bytes follow at\nea_data[nlen+1..nlen+vlen], so the actual end is ea->ea_data + nlen + 1\n+ vlen. Isn't pointer math fun?\n\nThe earlier check (u8 *)ea > end - sizeof(*ea) only guarantees the\n8-byte header is in bounds, but since the last EA is placed within 8\nbytes of the end of the response, the name and value bytes are read past\nthe end of iov.\n\nFix this mess all up by using ea->ea_data as the base for the bounds\ncheck.\n\nAn \"untrusted\" server can use this to leak up to 8 bytes of kernel heap\ninto the EA name comparison and influence which WSL xattr the data is\ninterpreted as."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nsmb: cliente: corregir la comprobación de límites con un error de 8 bytes en check_wsl_eas()\n\nLa comprobación de límites usa (u8 *)ea + nlen + 1 + vlen como el final del nombre y valor de la EA, pero ea_data se encuentra en el desplazamiento sizeof(struct smb2_file_full_ea_info) = 8 desde ea, no en el desplazamiento 0. La función strncmp() lee más tarde ea -> ea_data[0..nlen-1] y los bytes del valor siguen en ea_data[nlen+1..nlen+vlen], por lo que el final real es ea -> ea_data + nlen + 1 + vlen. ¿No es divertida la aritmética de punteros?\n\nLa comprobación anterior (u8 *)ea > end - sizeof(ea) solo garantiza que la cabecera de 8 bytes está dentro de los límites, pero dado que la última EA se coloca dentro de los 8 bytes del final de la respuesta, los bytes del nombre y del valor se leen más allá del final de iov.\n\nSolucionar todo este lío usando ea -> ea_data como base para la comprobación de límites.\n\nUn servidor ’no confiable’ puede usar esto para filtrar hasta 8 bytes de la pila del kernel en la comparación del nombre de la EA e influir en cómo se interpreta el dato para qué xattr de WSL."}],"id":"CVE-2026-31614","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31614","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:40.298481Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:40.663","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5cc0574c84aa73946ade587c41e81757b8b01cb5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a893f1757d9a4009e4a8d7ceb2312142fe29cea4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b2b76d09a64c538c57006180103fc1841e8cfa66"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba3ad159aa61810bbe0acaf39578b1ebfb6f1a18"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bfbc74df8bbe095b3ed68f6d4487b368af087890"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31615.json b/data/2026/CVE-2026-31615.json index e29c60b5ad..9ad76d7183 100644 --- a/data/2026/CVE-2026-31615.json +++ b/data/2026/CVE-2026-31615.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/udc/renesas_usb3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7caaf76207f50c77abfd788380e19b2c23a94415","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"c4e5ae6db2328d2d9ed55d3005a36c13faab0752","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"360aa6e71870a175a6d86af905be2ca171639eb3","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"1b2bfedccc4fb8c9572e1ea464f905424c91de2a","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"adb8014599fdf0818d3d93f1f74e06cd0bdec08d","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"44216e3dd4455b798899b50eedb0ec3831dff8e0","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"37f430b2240655e6b0199a92aa1057e4d621be51","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"e3d42598f2995cdc07b7779874e7c5f8a1b773db","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"f880aac8a57ebd92abfa685d45424b2998ac1059","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/udc/renesas_usb3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.5"},{"lessThan":"4.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FCEFD340-4D12-4082-8086-2A113C4D3AAD","versionEndExcluding":"6.6.136","versionStartIncluding":"4.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: renesas_usb3: validate endpoint index in standard request handlers\n\nThe GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint\nnumber from the host-supplied wIndex without any sort of validation.\nFix this up by validating the number of endpoints actually match up with\nthe number the device has before attempting to dereference a pointer\nbased on this math.\n\nThis is just like what was done in commit ee0d382feb44 (\"usb: gadget:\naspeed_udc: validate endpoint index for ast udc\") for the aspeed driver."}],"id":"CVE-2026-31615","lastModified":"2026-06-17T10:34:05.703","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:40.767","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1b2bfedccc4fb8c9572e1ea464f905424c91de2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/360aa6e71870a175a6d86af905be2ca171639eb3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/37f430b2240655e6b0199a92aa1057e4d621be51"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/44216e3dd4455b798899b50eedb0ec3831dff8e0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7caaf76207f50c77abfd788380e19b2c23a94415"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/adb8014599fdf0818d3d93f1f74e06cd0bdec08d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c4e5ae6db2328d2d9ed55d3005a36c13faab0752"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e3d42598f2995cdc07b7779874e7c5f8a1b773db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f880aac8a57ebd92abfa685d45424b2998ac1059"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/udc/renesas_usb3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7caaf76207f50c77abfd788380e19b2c23a94415","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"c4e5ae6db2328d2d9ed55d3005a36c13faab0752","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"360aa6e71870a175a6d86af905be2ca171639eb3","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"1b2bfedccc4fb8c9572e1ea464f905424c91de2a","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"adb8014599fdf0818d3d93f1f74e06cd0bdec08d","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"44216e3dd4455b798899b50eedb0ec3831dff8e0","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"37f430b2240655e6b0199a92aa1057e4d621be51","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"e3d42598f2995cdc07b7779874e7c5f8a1b773db","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"},{"lessThan":"f880aac8a57ebd92abfa685d45424b2998ac1059","status":"affected","version":"746bfe63bba37ad55956b7377c9af494e7e28929","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/udc/renesas_usb3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.5"},{"lessThan":"4.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FCEFD340-4D12-4082-8086-2A113C4D3AAD","versionEndExcluding":"6.6.136","versionStartIncluding":"4.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: renesas_usb3: validate endpoint index in standard request handlers\n\nThe GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint\nnumber from the host-supplied wIndex without any sort of validation.\nFix this up by validating the number of endpoints actually match up with\nthe number the device has before attempting to dereference a pointer\nbased on this math.\n\nThis is just like what was done in commit ee0d382feb44 (\"usb: gadget:\naspeed_udc: validate endpoint index for ast udc\") for the aspeed driver."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: renesas_usb3: validar el índice del punto final en los manejadores de solicitudes estándar\n\nLos manejadores GET_STATUS y SET/CLEAR_FEATURE extraen el número de punto final del wIndex proporcionado por el host sin ningún tipo de validación. Solucionar esto validando que el número de puntos finales realmente coincida con el número que tiene el dispositivo antes de intentar desreferenciar un puntero basado en este cálculo.\n\nEsto es justo como lo que se hizo en el commit ee0d382feb44 (’usb: gadget: aspeed_udc: validar el índice del punto final para ast udc’) para el controlador aspeed."}],"id":"CVE-2026-31615","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:40.767","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1b2bfedccc4fb8c9572e1ea464f905424c91de2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/360aa6e71870a175a6d86af905be2ca171639eb3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/37f430b2240655e6b0199a92aa1057e4d621be51"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/44216e3dd4455b798899b50eedb0ec3831dff8e0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7caaf76207f50c77abfd788380e19b2c23a94415"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/adb8014599fdf0818d3d93f1f74e06cd0bdec08d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c4e5ae6db2328d2d9ed55d3005a36c13faab0752"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e3d42598f2995cdc07b7779874e7c5f8a1b773db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f880aac8a57ebd92abfa685d45424b2998ac1059"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31616.json b/data/2026/CVE-2026-31616.json index e557a15bb8..becae084ee 100644 --- a/data/2026/CVE-2026-31616.json +++ b/data/2026/CVE-2026-31616.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_phonet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3d7f7e0c842242878c24b2facff8d6eda23ee1e9","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"b5ec49fa198bd08967a3102bd41f53ccadce72c9","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"7424f0287da73d3d8c5fa5e9d25d26fce762708e","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"9ceff1251904901b0b4e5fe6350fcaffa368ce83","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"c9315ce9da3632c591666a29de82d3e92d46bec1","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"4e476c25bfcab0535ba7c76a903ae77ca8747711","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"bd44ce09b9b569f49ed13e2d87d23d853fc7d6a7","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"66f7471c4042e4eb300e30b5b9d87d1406862673","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"c088d5dd2fffb4de1fb8e7f57751c8b82942180a","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_phonet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.32"},{"lessThan":"2.6.32","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B5320F96-8216-44DE-B8AC-7694F1E2D98E","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.32","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()\n\nA broken/bored/mean USB host can overflow the skb_shared_info->frags[]\narray on a Linux gadget exposing a Phonet function by sending an\nunbounded sequence of full-page OUT transfers.\n\npn_rx_complete() finalizes the skb only when req->actual < req->length,\nwhere req->length is set to PAGE_SIZE by the gadget. If the host always\nsends exactly PAGE_SIZE bytes per transfer, fp->rx.skb will never be\nreset and each completion will add another fragment via\nskb_add_rx_frag(). Once nr_frags exceeds MAX_SKB_FRAGS (default 17),\nsubsequent frag stores overwrite memory adjacent to the shinfo on the\nheap.\n\nDrop the skb and account a length error when the frag limit is reached,\nmatching the fix applied in t7xx by commit f0813bcd2d9d (\"net: wwan:\nt7xx: fix potential skb->frags overflow in RX path\")."}],"id":"CVE-2026-31616","lastModified":"2026-06-17T10:34:05.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:40.870","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3d7f7e0c842242878c24b2facff8d6eda23ee1e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e476c25bfcab0535ba7c76a903ae77ca8747711"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66f7471c4042e4eb300e30b5b9d87d1406862673"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7424f0287da73d3d8c5fa5e9d25d26fce762708e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ceff1251904901b0b4e5fe6350fcaffa368ce83"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b5ec49fa198bd08967a3102bd41f53ccadce72c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd44ce09b9b569f49ed13e2d87d23d853fc7d6a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c088d5dd2fffb4de1fb8e7f57751c8b82942180a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c9315ce9da3632c591666a29de82d3e92d46bec1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_phonet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3d7f7e0c842242878c24b2facff8d6eda23ee1e9","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"b5ec49fa198bd08967a3102bd41f53ccadce72c9","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"7424f0287da73d3d8c5fa5e9d25d26fce762708e","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"9ceff1251904901b0b4e5fe6350fcaffa368ce83","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"c9315ce9da3632c591666a29de82d3e92d46bec1","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"4e476c25bfcab0535ba7c76a903ae77ca8747711","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"bd44ce09b9b569f49ed13e2d87d23d853fc7d6a7","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"66f7471c4042e4eb300e30b5b9d87d1406862673","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"},{"lessThan":"c088d5dd2fffb4de1fb8e7f57751c8b82942180a","status":"affected","version":"b91cd1440870f7a0649e570498b7b93caf9f781c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_phonet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.32"},{"lessThan":"2.6.32","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B5320F96-8216-44DE-B8AC-7694F1E2D98E","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.32","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()\n\nA broken/bored/mean USB host can overflow the skb_shared_info->frags[]\narray on a Linux gadget exposing a Phonet function by sending an\nunbounded sequence of full-page OUT transfers.\n\npn_rx_complete() finalizes the skb only when req->actual < req->length,\nwhere req->length is set to PAGE_SIZE by the gadget. If the host always\nsends exactly PAGE_SIZE bytes per transfer, fp->rx.skb will never be\nreset and each completion will add another fragment via\nskb_add_rx_frag(). Once nr_frags exceeds MAX_SKB_FRAGS (default 17),\nsubsequent frag stores overwrite memory adjacent to the shinfo on the\nheap.\n\nDrop the skb and account a length error when the frag limit is reached,\nmatching the fix applied in t7xx by commit f0813bcd2d9d (\"net: wwan:\nt7xx: fix potential skb->frags overflow in RX path\")."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_phonet: corrección de desbordamiento de skb frags[] en pn_rx_complete()\n\nUn host USB defectuoso/ocioso/malintencionado puede desbordar el array skb_shared_info -> frags[] en un gadget de Linux que expone una función Phonet enviando una secuencia ilimitada de transferencias OUT de página completa.\n\npn_rx_complete() finaliza el skb solo cuando req -> actual < req -> length, donde req -> length es establecido a PAGE_SIZE por el gadget. Si el host siempre envía exactamente PAGE_SIZE bytes por transferencia, fp -> rx.skb nunca será reiniciado y cada finalización añadirá otro fragmento a través de skb_add_rx_frag(). Una vez que nr_frags excede MAX_SKB_FRAGS (por defecto 17), los almacenamientos de fragmentos subsiguientes sobrescriben memoria adyacente al shinfo en el heap.\n\nDescartar el skb y registrar un error de longitud cuando se alcanza el límite de fragmentos, coincidiendo con la corrección aplicada en t7xx por el commit f0813bcd2d9d (’net: wwan: t7xx: corregir posible desbordamiento de skb -> frags en la ruta RX’)."}],"id":"CVE-2026-31616","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:40.870","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3d7f7e0c842242878c24b2facff8d6eda23ee1e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4e476c25bfcab0535ba7c76a903ae77ca8747711"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/66f7471c4042e4eb300e30b5b9d87d1406862673"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7424f0287da73d3d8c5fa5e9d25d26fce762708e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ceff1251904901b0b4e5fe6350fcaffa368ce83"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b5ec49fa198bd08967a3102bd41f53ccadce72c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd44ce09b9b569f49ed13e2d87d23d853fc7d6a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c088d5dd2fffb4de1fb8e7f57751c8b82942180a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c9315ce9da3632c591666a29de82d3e92d46bec1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31617.json b/data/2026/CVE-2026-31617.json index d491e7b765..8146444168 100644 --- a/data/2026/CVE-2026-31617.json +++ b/data/2026/CVE-2026-31617.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_ncm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"068a7f2749fff6462a0a908ec415b885fe430f50","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"1425655c2870054c3ab4712e2b6dbdd331597ada","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"8b3b7bd3c02f98634baaf36c7fc7ac915f6517ca","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"0f156bb5334e588034ca68ac2ee92b23f66e56e7","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"8757a2593631443648218244b9788e193ae0fdc1","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"6762f8a95772265dd0c2ffe7f400493f3115b135","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"d58ba8f6546232f8414f396c189297dbee03f1a7","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"74908b0318d1df1188457040b8714ff4d4b68126","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"8f993d30b95dc9557a8a96ceca11abed674c8acb","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"status":"affected","version":"f7e0611e207d8908c4f2858e244370529a76dbf7","versionType":"git"},{"status":"affected","version":"b88ad6e714284b33a47834f5f2a294c2b37c66aa","versionType":"git"},{"status":"affected","version":"471b23586387a32857778c511be60ab31c98dcfd","versionType":"git"},{"status":"affected","version":"4f529c4d1e436230d3af7c09a3239677a14d2b46","versionType":"git"},{"status":"affected","version":"ae6a5394d9fbe118bc95cfe376d6a9d91d7547e8","versionType":"git"},{"lessThan":"4.10","status":"affected","version":"4.9.235","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.196","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.143","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.62","versionType":"semver"},{"lessThan":"5.9","status":"affected","version":"5.8.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_ncm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5F07F4AC-C44A-486A-9422-D8975351BA25","versionEndExcluding":"6.6.136","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()\n\nThe block_len read from the host-supplied NTB header is checked against\nntb_max but has no lower bound. When block_len is smaller than\nopts->ndp_size, the bounds check of:\n\tndp_index > (block_len - opts->ndp_size)\nwill underflow producing a huge unsigned value that ndp_index can never\nexceed, defeating the check entirely.\n\nThe same underflow occurs in the datagram index checks against block_len\n- opts->dpe_size. With those checks neutered, a malicious USB host can\nchoose ndp_index and datagram offsets that point past the actual\ntransfer, and the skb_put_data() copies adjacent kernel memory into the\nnetwork skb.\n\nFix this by rejecting block lengths that cannot hold at least the NTB\nheader plus one NDP. This will make block_len - opts->ndp_size and\nblock_len - opts->dpe_size both well-defined.\n\nCommit 8d2b1a1ec9f5 (\"CDC-NCM: avoid overflow in sanity checking\") fixed\na related class of issues on the host side of NCM."}],"id":"CVE-2026-31617","lastModified":"2026-10-15T02:19:12.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]},"published":"2026-04-24T15:16:40.973","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/068a7f2749fff6462a0a908ec415b885fe430f50"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f156bb5334e588034ca68ac2ee92b23f66e56e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1425655c2870054c3ab4712e2b6dbdd331597ada"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6762f8a95772265dd0c2ffe7f400493f3115b135"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/74908b0318d1df1188457040b8714ff4d4b68126"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8757a2593631443648218244b9788e193ae0fdc1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8b3b7bd3c02f98634baaf36c7fc7ac915f6517ca"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f993d30b95dc9557a8a96ceca11abed674c8acb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d58ba8f6546232f8414f396c189297dbee03f1a7"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31617"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461448"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31617.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-191"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_ncm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"068a7f2749fff6462a0a908ec415b885fe430f50","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"1425655c2870054c3ab4712e2b6dbdd331597ada","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"8b3b7bd3c02f98634baaf36c7fc7ac915f6517ca","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"0f156bb5334e588034ca68ac2ee92b23f66e56e7","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"8757a2593631443648218244b9788e193ae0fdc1","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"6762f8a95772265dd0c2ffe7f400493f3115b135","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"d58ba8f6546232f8414f396c189297dbee03f1a7","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"74908b0318d1df1188457040b8714ff4d4b68126","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"lessThan":"8f993d30b95dc9557a8a96ceca11abed674c8acb","status":"affected","version":"2b74b0a04d3e9f9f08ff026e5663dce88ff94e52","versionType":"git"},{"status":"affected","version":"f7e0611e207d8908c4f2858e244370529a76dbf7","versionType":"git"},{"status":"affected","version":"b88ad6e714284b33a47834f5f2a294c2b37c66aa","versionType":"git"},{"status":"affected","version":"471b23586387a32857778c511be60ab31c98dcfd","versionType":"git"},{"status":"affected","version":"4f529c4d1e436230d3af7c09a3239677a14d2b46","versionType":"git"},{"status":"affected","version":"ae6a5394d9fbe118bc95cfe376d6a9d91d7547e8","versionType":"git"},{"lessThan":"4.10","status":"affected","version":"4.9.235","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.196","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.143","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.62","versionType":"semver"},{"lessThan":"5.9","status":"affected","version":"5.8.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/usb/gadget/function/f_ncm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.9"},{"lessThan":"5.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5F07F4AC-C44A-486A-9422-D8975351BA25","versionEndExcluding":"6.6.136","versionStartIncluding":"5.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8BAD957-8E20-401C-A129-DFF3655CA0B7","versionEndExcluding":"6.12.83","versionStartIncluding":"6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()\n\nThe block_len read from the host-supplied NTB header is checked against\nntb_max but has no lower bound. When block_len is smaller than\nopts->ndp_size, the bounds check of:\n\tndp_index > (block_len - opts->ndp_size)\nwill underflow producing a huge unsigned value that ndp_index can never\nexceed, defeating the check entirely.\n\nThe same underflow occurs in the datagram index checks against block_len\n- opts->dpe_size. With those checks neutered, a malicious USB host can\nchoose ndp_index and datagram offsets that point past the actual\ntransfer, and the skb_put_data() copies adjacent kernel memory into the\nnetwork skb.\n\nFix this by rejecting block lengths that cannot hold at least the NTB\nheader plus one NDP. This will make block_len - opts->ndp_size and\nblock_len - opts->dpe_size both well-defined.\n\nCommit 8d2b1a1ec9f5 (\"CDC-NCM: avoid overflow in sanity checking\") fixed\na related class of issues on the host side of NCM."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: gadget: f_ncm: validar la longitud mínima de bloque (block_len) en ncm_unwrap_ntb()\n\nLa block_len leída del encabezado NTB proporcionado por el host se verifica contra ntb_max pero no tiene un límite inferior. Cuando block_len es menor que opts -> ndp_size, la verificación de límites de:\nndp_index > (block_len - opts -> ndp_size)\nse desbordará por debajo, produciendo un valor sin signo enorme que ndp_index nunca puede exceder, anulando la verificación por completo.\n\nEl mismo desbordamiento por debajo ocurre en las verificaciones del índice del datagrama contra block_len - opts -> dpe_size. Con esas verificaciones neutralizadas, un host USB malicioso puede elegir ndp_index y desplazamientos de datagrama que apuntan más allá de la transferencia real, y skb_put_data() copia memoria adyacente del kernel en el skb de red.\n\nSolucione esto rechazando las longitudes de bloque que no pueden contener al menos el encabezado NTB más un NDP. Esto hará que block_len - opts -> ndp_size y block_len - opts -> dpe_size estén ambos bien definidos.\n\nEl commit 8d2b1a1ec9f5 (’CDC-NCM: avoid overflow in sanity checking’) solucionó una clase de problemas relacionados en el lado del host de NCM."}],"id":"CVE-2026-31617","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]},"published":"2026-04-24T15:16:40.973","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/068a7f2749fff6462a0a908ec415b885fe430f50"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f156bb5334e588034ca68ac2ee92b23f66e56e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/1425655c2870054c3ab4712e2b6dbdd331597ada"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6762f8a95772265dd0c2ffe7f400493f3115b135"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/74908b0318d1df1188457040b8714ff4d4b68126"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8757a2593631443648218244b9788e193ae0fdc1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8b3b7bd3c02f98634baaf36c7fc7ac915f6517ca"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f993d30b95dc9557a8a96ceca11abed674c8acb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d58ba8f6546232f8414f396c189297dbee03f1a7"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31617"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461448"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31617.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-191"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31618.json b/data/2026/CVE-2026-31618.json index 203a5b15f1..7bac3b0d73 100644 --- a/data/2026/CVE-2026-31618.json +++ b/data/2026/CVE-2026-31618.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/video/fbdev/tdfxfb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2f207e46c62688bb7eb4e3feaf9a0d94020fb0c9","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6c05191598eca87a87329b3f6e4a0825775f09cf","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"59bde9e0930efef1286768cb65fc78d5e5267f93","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"859a239d58a812b61267d9944b701affe6a6244e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"53cb4e79a07124d2ebe502983c29800104080b47","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"fc386daa6846551a88d338ba9864fc2812cd9030","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6567d3e1aaadfebf44ce7dc9ea2630323cd4c736","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"63dfb0b4741f46d65b667c4275132b3d1966acc8","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"8f98b81fe011e1879e6a7b1247e69e06a5e17af2","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/video/fbdev/tdfxfb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2D9D9DF-0F25-43D5-9C6A-4C891E3A29FC","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO\n\nMuch like commit 19f953e74356 (\"fbdev: fb_pm2fb: Avoid potential divide\nby zero error\"), we also need to prevent that same crash from happening\nin the udlfb driver as it uses pixclock directly when dividing, which\nwill crash."}],"id":"CVE-2026-31618","lastModified":"2026-06-17T10:34:06.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:41.080","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2f207e46c62688bb7eb4e3feaf9a0d94020fb0c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/53cb4e79a07124d2ebe502983c29800104080b47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/59bde9e0930efef1286768cb65fc78d5e5267f93"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63dfb0b4741f46d65b667c4275132b3d1966acc8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6567d3e1aaadfebf44ce7dc9ea2630323cd4c736"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6c05191598eca87a87329b3f6e4a0825775f09cf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/859a239d58a812b61267d9944b701affe6a6244e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f98b81fe011e1879e6a7b1247e69e06a5e17af2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fc386daa6846551a88d338ba9864fc2812cd9030"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/video/fbdev/tdfxfb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2f207e46c62688bb7eb4e3feaf9a0d94020fb0c9","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6c05191598eca87a87329b3f6e4a0825775f09cf","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"59bde9e0930efef1286768cb65fc78d5e5267f93","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"859a239d58a812b61267d9944b701affe6a6244e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"53cb4e79a07124d2ebe502983c29800104080b47","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"fc386daa6846551a88d338ba9864fc2812cd9030","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"6567d3e1aaadfebf44ce7dc9ea2630323cd4c736","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"63dfb0b4741f46d65b667c4275132b3d1966acc8","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"8f98b81fe011e1879e6a7b1247e69e06a5e17af2","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/video/fbdev/tdfxfb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2D9D9DF-0F25-43D5-9C6A-4C891E3A29FC","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO\n\nMuch like commit 19f953e74356 (\"fbdev: fb_pm2fb: Avoid potential divide\nby zero error\"), we also need to prevent that same crash from happening\nin the udlfb driver as it uses pixclock directly when dividing, which\nwill crash."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfbdev: tdfxfb: evitar división por cero en FBIOPUT_VSCREENINFO\n\nAl igual que el commit 19f953e74356 (’fbdev: fb_pm2fb: Evitar posible error de división por cero’), también necesitamos evitar que ocurra el mismo fallo en el controlador udlfb, ya que utiliza pixclock directamente al dividir, lo que provocará un fallo."}],"id":"CVE-2026-31618","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:41.080","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2f207e46c62688bb7eb4e3feaf9a0d94020fb0c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/53cb4e79a07124d2ebe502983c29800104080b47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/59bde9e0930efef1286768cb65fc78d5e5267f93"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/63dfb0b4741f46d65b667c4275132b3d1966acc8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6567d3e1aaadfebf44ce7dc9ea2630323cd4c736"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6c05191598eca87a87329b3f6e4a0825775f09cf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/859a239d58a812b61267d9944b701affe6a6244e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f98b81fe011e1879e6a7b1247e69e06a5e17af2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fc386daa6846551a88d338ba9864fc2812cd9030"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-369"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31619.json b/data/2026/CVE-2026-31619.json index 51e66cee2b..223231e9fe 100644 --- a/data/2026/CVE-2026-31619.json +++ b/data/2026/CVE-2026-31619.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/firewire/fireworks/fireworks_command.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"183aa0de0f680496b9feb85c9d182681ad4600dd","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"62fcb273fbee5b2a0e7ed41cc914c8d7d1a5d285","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"327f8e730e3c65ec97df9d3b07de66aeb3dc932d","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"f856f4b6efd51be7950e4b84c06cd961961ca41c","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"e103f98f6615ed2934e9cf340654f0cad9eb8a8a","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"67cfd14074cdafab5de3f7cfc0952c1a9b653e5d","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"cc624b3d2be13297100539b64ad950695188e046","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"682d8accf0d83a871e8c327b95c81f53902c922b","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"07704bbf36f57e4379e4cadf96410dab14621e3b","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/firewire/fireworks/fireworks_command.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.16"},{"lessThan":"3.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7482AD77-8977-4A6A-96C0-1B7E86AC25E9","versionEndExcluding":"6.6.136","versionStartIncluding":"3.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: fireworks: bound device-supplied status before string array lookup\n\nThe status field in an EFW response is a 32-bit value supplied by the\nfirewire device. efr_status_names[] has 17 entries so a status value\noutside that range goes off into the weeds when looking at the %s value.\n\nEven worse, the status could return EFR_STATUS_INCOMPLETE which is\n0x80000000, and is obviously not in that array of potential strings.\n\nFix this up by properly bounding the index against the array size and\nprinting \"unknown\" if it's not recognized."}],"id":"CVE-2026-31619","lastModified":"2026-11-06T16:18:03.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31619","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:46.214544Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:41.180","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07704bbf36f57e4379e4cadf96410dab14621e3b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/183aa0de0f680496b9feb85c9d182681ad4600dd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/327f8e730e3c65ec97df9d3b07de66aeb3dc932d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/62fcb273fbee5b2a0e7ed41cc914c8d7d1a5d285"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67cfd14074cdafab5de3f7cfc0952c1a9b653e5d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/682d8accf0d83a871e8c327b95c81f53902c922b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc624b3d2be13297100539b64ad950695188e046"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e103f98f6615ed2934e9cf340654f0cad9eb8a8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f856f4b6efd51be7950e4b84c06cd961961ca41c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/firewire/fireworks/fireworks_command.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"183aa0de0f680496b9feb85c9d182681ad4600dd","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"62fcb273fbee5b2a0e7ed41cc914c8d7d1a5d285","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"327f8e730e3c65ec97df9d3b07de66aeb3dc932d","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"f856f4b6efd51be7950e4b84c06cd961961ca41c","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"e103f98f6615ed2934e9cf340654f0cad9eb8a8a","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"67cfd14074cdafab5de3f7cfc0952c1a9b653e5d","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"cc624b3d2be13297100539b64ad950695188e046","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"682d8accf0d83a871e8c327b95c81f53902c922b","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"},{"lessThan":"07704bbf36f57e4379e4cadf96410dab14621e3b","status":"affected","version":"bde8a8f23bbe6db51fa4e81644273af18fef3d7a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/firewire/fireworks/fireworks_command.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.16"},{"lessThan":"3.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7482AD77-8977-4A6A-96C0-1B7E86AC25E9","versionEndExcluding":"6.6.136","versionStartIncluding":"3.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: fireworks: bound device-supplied status before string array lookup\n\nThe status field in an EFW response is a 32-bit value supplied by the\nfirewire device. efr_status_names[] has 17 entries so a status value\noutside that range goes off into the weeds when looking at the %s value.\n\nEven worse, the status could return EFR_STATUS_INCOMPLETE which is\n0x80000000, and is obviously not in that array of potential strings.\n\nFix this up by properly bounding the index against the array size and\nprinting \"unknown\" if it's not recognized."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: fireworks: acotar el estado proporcionado por el dispositivo antes de la búsqueda en el array de cadenas\n\nEl campo de estado en una respuesta EFW es un valor de 32 bits proporcionado por el dispositivo firewire. efr_status_names[] tiene 17 entradas, por lo que un valor de estado fuera de ese rango se desvía al observar el valor %s.\n\nPeor aún, el estado podría devolver EFR_STATUS_INCOMPLETE, que es 0x 80000000, y obviamente no está en ese array de cadenas potenciales.\n\nEsto se soluciona acotando correctamente el índice con respecto al tamaño del array e imprimiendo ’desconocido’ si no es reconocido."}],"id":"CVE-2026-31619","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31619","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:46.214544Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:41.180","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07704bbf36f57e4379e4cadf96410dab14621e3b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/183aa0de0f680496b9feb85c9d182681ad4600dd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/327f8e730e3c65ec97df9d3b07de66aeb3dc932d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/62fcb273fbee5b2a0e7ed41cc914c8d7d1a5d285"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67cfd14074cdafab5de3f7cfc0952c1a9b653e5d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/682d8accf0d83a871e8c327b95c81f53902c922b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc624b3d2be13297100539b64ad950695188e046"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e103f98f6615ed2934e9cf340654f0cad9eb8a8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f856f4b6efd51be7950e4b84c06cd961961ca41c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31620.json b/data/2026/CVE-2026-31620.json index 063fcfff51..d0c473e488 100644 --- a/data/2026/CVE-2026-31620.json +++ b/data/2026/CVE-2026-31620.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/usx2y/us144mkii.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"09b145c1f1331c40dc955c0024d636f25417cddb","status":"affected","version":"dee1bcf28a3dd13ddb2e9200407864f73e9c4d63","versionType":"git"},{"lessThan":"fbaf29ce00e7bce683f3faf4f2b326bd0a9e6602","status":"affected","version":"dee1bcf28a3dd13ddb2e9200407864f73e9c4d63","versionType":"git"},{"lessThan":"d04dd67ab10dc978c6c843c6bd6a2a66a9444f51","status":"affected","version":"dee1bcf28a3dd13ddb2e9200407864f73e9c4d63","versionType":"git"},{"lessThan":"48bd344e1040b9f2eb512be73c13f5db83efc191","status":"affected","version":"dee1bcf28a3dd13ddb2e9200407864f73e9c4d63","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/usb/usx2y/us144mkii.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4C4EAA6A-7949-4B29-BD69-5BB05C4D1A6B","versionEndExcluding":"6.18.24","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usx2y: us144mkii: fix NULL deref on missing interface 0\n\nA malicious USB device with the TASCAM US-144MKII device id can have a\nconfiguration containing bInterfaceNumber=1 but no interface 0. USB\nconfiguration descriptors are not required to assign interface numbers\nsequentially, so usb_ifnum_to_if(dev, 0) returns will NULL, which will\nthen be dereferenced directly.\n\nFix this up by checking the return value properly."}],"id":"CVE-2026-31620","lastModified":"2026-11-06T16:18:03.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:50.866253Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:41.280","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09b145c1f1331c40dc955c0024d636f25417cddb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48bd344e1040b9f2eb512be73c13f5db83efc191"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d04dd67ab10dc978c6c843c6bd6a2a66a9444f51"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbaf29ce00e7bce683f3faf4f2b326bd0a9e6602"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["sound/usb/usx2y/us144mkii.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"09b145c1f1331c40dc955c0024d636f25417cddb","status":"affected","version":"dee1bcf28a3dd13ddb2e9200407864f73e9c4d63","versionType":"git"},{"lessThan":"fbaf29ce00e7bce683f3faf4f2b326bd0a9e6602","status":"affected","version":"dee1bcf28a3dd13ddb2e9200407864f73e9c4d63","versionType":"git"},{"lessThan":"d04dd67ab10dc978c6c843c6bd6a2a66a9444f51","status":"affected","version":"dee1bcf28a3dd13ddb2e9200407864f73e9c4d63","versionType":"git"},{"lessThan":"48bd344e1040b9f2eb512be73c13f5db83efc191","status":"affected","version":"dee1bcf28a3dd13ddb2e9200407864f73e9c4d63","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["sound/usb/usx2y/us144mkii.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4C4EAA6A-7949-4B29-BD69-5BB05C4D1A6B","versionEndExcluding":"6.18.24","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usx2y: us144mkii: fix NULL deref on missing interface 0\n\nA malicious USB device with the TASCAM US-144MKII device id can have a\nconfiguration containing bInterfaceNumber=1 but no interface 0. USB\nconfiguration descriptors are not required to assign interface numbers\nsequentially, so usb_ifnum_to_if(dev, 0) returns will NULL, which will\nthen be dereferenced directly.\n\nFix this up by checking the return value properly."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nALSA: usx2y: us144mkii: corrección de desreferencia de NULL al faltar la interfaz 0\n\nUn dispositivo USB malicioso con el ID de dispositivo TASCAM US-144MKII puede tener una configuración que contenga bInterfaceNumber=1 pero sin interfaz 0. Los descriptores de configuración USB no están obligados a asignar números de interfaz secuencialmente, por lo que usb_ifnum_to_if(dev, 0) devolverá NULL, lo que luego será desreferenciado directamente.\n\nEsto se soluciona verificando el valor de retorno correctamente."}],"id":"CVE-2026-31620","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":0.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:50.866253Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:41.280","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/09b145c1f1331c40dc955c0024d636f25417cddb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48bd344e1040b9f2eb512be73c13f5db83efc191"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d04dd67ab10dc978c6c843c6bd6a2a66a9444f51"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbaf29ce00e7bce683f3faf4f2b326bd0a9e6602"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31621.json b/data/2026/CVE-2026-31621.json index aaaa97ef03..a490e9c576 100644 --- a/data/2026/CVE-2026-31621.json +++ b/data/2026/CVE-2026-31621.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/broadcom/bnge/bnge_auxr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"38c383ec6d37f4b5597f8e6a1f5c2ab31ea01d3a","status":"affected","version":"8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554","versionType":"git"},{"lessThan":"87bc3557c708110d83086bf091328271298a44e3","status":"affected","version":"8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554","versionType":"git"},{"lessThan":"8b0c25528cb64f71a73b5c0d49cbbcb68540a4ce","status":"affected","version":"8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/broadcom/bnge/bnge_auxr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnge: return after auxiliary_device_uninit() in error path\n\nWhen auxiliary_device_add() fails, the error block calls\nauxiliary_device_uninit() but does not return. The uninit drops the\nlast reference and synchronously runs bnge_aux_dev_release(), which sets\nbd->auxr_dev = NULL and frees the underlying object. The subsequent\nbd->auxr_dev->net = bd->netdev then dereferences NULL, which is not a\ngood thing to have happen when trying to clean up from an error.\n\nAdd the missing return, as the auxiliary bus documentation states is a\nrequirement (seems that LLM tools read documentation better than humans\ndo...)"}],"id":"CVE-2026-31621","lastModified":"2026-06-17T10:34:06.453","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:41.380","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/38c383ec6d37f4b5597f8e6a1f5c2ab31ea01d3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/87bc3557c708110d83086bf091328271298a44e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8b0c25528cb64f71a73b5c0d49cbbcb68540a4ce"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/broadcom/bnge/bnge_auxr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"38c383ec6d37f4b5597f8e6a1f5c2ab31ea01d3a","status":"affected","version":"8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554","versionType":"git"},{"lessThan":"87bc3557c708110d83086bf091328271298a44e3","status":"affected","version":"8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554","versionType":"git"},{"lessThan":"8b0c25528cb64f71a73b5c0d49cbbcb68540a4ce","status":"affected","version":"8ac050ec3b1c0dcb5e89cf86fe2ebe0afcc73554","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/broadcom/bnge/bnge_auxr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbnge: return after auxiliary_device_uninit() in error path\n\nWhen auxiliary_device_add() fails, the error block calls\nauxiliary_device_uninit() but does not return. The uninit drops the\nlast reference and synchronously runs bnge_aux_dev_release(), which sets\nbd->auxr_dev = NULL and frees the underlying object. The subsequent\nbd->auxr_dev->net = bd->netdev then dereferences NULL, which is not a\ngood thing to have happen when trying to clean up from an error.\n\nAdd the missing return, as the auxiliary bus documentation states is a\nrequirement (seems that LLM tools read documentation better than humans\ndo...)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbnge: retornar después de auxiliary_device_uninit() en la ruta de error\n\nCuando auxiliary_device_add() falla, el bloque de error llama a auxiliary_device_uninit() pero no retorna. La desinicialización libera la última referencia y ejecuta sincrónicamente bnge_aux_dev_release(), lo que establece bd -> auxr_dev = NULL y libera el objeto subyacente. La subsiguiente operación bd -> auxr_dev -> net = bd -> netdev entonces desreferencia NULL, lo cual no es algo bueno que ocurra al intentar limpiar un error.\n\nAñadir el retorno faltante, ya que la documentación del bus auxiliar establece que es un requisito (parece que las herramientas LLM leen la documentación mejor que los humanos...)."}],"id":"CVE-2026-31621","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:41.380","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/38c383ec6d37f4b5597f8e6a1f5c2ab31ea01d3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/87bc3557c708110d83086bf091328271298a44e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8b0c25528cb64f71a73b5c0d49cbbcb68540a4ce"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31622.json b/data/2026/CVE-2026-31622.json index 96a0f4f7ab..38bcf29eed 100644 --- a/data/2026/CVE-2026-31622.json +++ b/data/2026/CVE-2026-31622.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/nfc/digital_technology.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9ba6bb09e00b922d902f684f575779e5433fe6e3","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"f83b399aa05a0712e3b1569a30d3d90b3533d2ef","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"20663102c14566e900e1d2f679e30b7f1694f387","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"2819f34e08bdffb6f06a51c67948ec5737fb166a","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"1bec5698b55aa2be5c3b983dba657c01d0fd3dbc","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"8d9d9bf3565271ca7ab9c716a94e87296177e7ba","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"cc024a3de265ef6c58957f4990eccb9f806208cb","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/nfc/digital_technology.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.13"},{"lessThan":"3.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6E4B7C62-D2BF-4255-BC77-4D30A01DC46D","versionEndExcluding":"6.6.136","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: digital: Bounds check NFC-A cascade depth in SDD response handler\n\nThe NFC-A anti-collision cascade in digital_in_recv_sdd_res() appends 3\nor 4 bytes to target->nfcid1 on each round, but the number of cascade\nrounds is controlled entirely by the peer device. The peer sets the\ncascade tag in the SDD_RES (deciding 3 vs 4 bytes) and the\ncascade-incomplete bit in the SEL_RES (deciding whether another round\nfollows).\n\nISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 is\nsized accordingly (NFC_NFCID1_MAXSIZE = 10), but nothing in the driver\nactually enforces this. This means a malicious peer can keep the\ncascade running, writing past the heap-allocated nfc_target with each\nround.\n\nFix this by rejecting the response when the accumulated UID would exceed\nthe buffer.\n\nCommit e329e71013c9 (\"NFC: nci: Bounds check struct nfc_target arrays\")\nfixed similar missing checks against the same field on the NCI path."}],"id":"CVE-2026-31622","lastModified":"2026-10-15T02:19:13.100","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:41.487","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1bec5698b55aa2be5c3b983dba657c01d0fd3dbc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/20663102c14566e900e1d2f679e30b7f1694f387"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2819f34e08bdffb6f06a51c67948ec5737fb166a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d9d9bf3565271ca7ab9c716a94e87296177e7ba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9ba6bb09e00b922d902f684f575779e5433fe6e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc024a3de265ef6c58957f4990eccb9f806208cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f83b399aa05a0712e3b1569a30d3d90b3533d2ef"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/nfc/digital_technology.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9ba6bb09e00b922d902f684f575779e5433fe6e3","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"f83b399aa05a0712e3b1569a30d3d90b3533d2ef","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"20663102c14566e900e1d2f679e30b7f1694f387","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"2819f34e08bdffb6f06a51c67948ec5737fb166a","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"1bec5698b55aa2be5c3b983dba657c01d0fd3dbc","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"8d9d9bf3565271ca7ab9c716a94e87296177e7ba","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"cc024a3de265ef6c58957f4990eccb9f806208cb","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"},{"lessThan":"46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1","status":"affected","version":"2c66daecc4092e6049673c281b2e6f0d5e59a94c","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/nfc/digital_technology.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.13"},{"lessThan":"3.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6E4B7C62-D2BF-4255-BC77-4D30A01DC46D","versionEndExcluding":"6.6.136","versionStartIncluding":"3.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: digital: Bounds check NFC-A cascade depth in SDD response handler\n\nThe NFC-A anti-collision cascade in digital_in_recv_sdd_res() appends 3\nor 4 bytes to target->nfcid1 on each round, but the number of cascade\nrounds is controlled entirely by the peer device. The peer sets the\ncascade tag in the SDD_RES (deciding 3 vs 4 bytes) and the\ncascade-incomplete bit in the SEL_RES (deciding whether another round\nfollows).\n\nISO 14443-3 limits NFC-A to three cascade levels and target->nfcid1 is\nsized accordingly (NFC_NFCID1_MAXSIZE = 10), but nothing in the driver\nactually enforces this. This means a malicious peer can keep the\ncascade running, writing past the heap-allocated nfc_target with each\nround.\n\nFix this by rejecting the response when the accumulated UID would exceed\nthe buffer.\n\nCommit e329e71013c9 (\"NFC: nci: Bounds check struct nfc_target arrays\")\nfixed similar missing checks against the same field on the NCI path."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nNFC: digital: Comprobación de límites de la profundidad de cascada NFC-A en el gestor de respuesta SDD\n\nLa cascada anticolisión NFC-A en digital_in_recv_sdd_res() añade 3 o 4 bytes a target -> nfcid1 en cada ronda, pero el número de rondas de cascada es controlado completamente por el dispositivo par. El par establece la etiqueta de cascada en el SDD_RES (decidiendo 3 frente a 4 bytes) y el bit de cascada incompleta en el SEL_RES (decidiendo si sigue otra ronda).\n\nISO 14443-3 limita NFC-A a tres niveles de cascada y target -> nfcid1 tiene un tamaño acorde (NFC_NFCID1_MAXSIZE = 10), pero nada en el controlador realmente lo aplica. Esto significa que un par malicioso puede mantener la cascada en ejecución, escribiendo más allá del nfc_target asignado en el heap con cada ronda.\n\nSolucione esto rechazando la respuesta cuando el UID acumulado excedería el búfer.\n\nEl commit e329e71013c9 (’NFC: nci: Comprobación de límites de arrays de struct nfc_target’) corrigió comprobaciones faltantes similares contra el mismo campo en la ruta NCI."}],"id":"CVE-2026-31622","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:41.487","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1bec5698b55aa2be5c3b983dba657c01d0fd3dbc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/20663102c14566e900e1d2f679e30b7f1694f387"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2819f34e08bdffb6f06a51c67948ec5737fb166a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/46ce8be2ced389bccd84bcc04a12cf2f4d0c22d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a59bf70c38ee1eb4be03bab830bbc3a6f0bd1f1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d9d9bf3565271ca7ab9c716a94e87296177e7ba"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9ba6bb09e00b922d902f684f575779e5433fe6e3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cc024a3de265ef6c58957f4990eccb9f806208cb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f83b399aa05a0712e3b1569a30d3d90b3533d2ef"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31623.json b/data/2026/CVE-2026-31623.json index acbb21a9c3..2a0aac6adc 100644 --- a/data/2026/CVE-2026-31623.json +++ b/data/2026/CVE-2026-31623.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/usb/cdc-phonet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6807ff49bf796b3823b1e29f97b69316a40a9a94","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"0c5c65a17db729fc63ab656bdaaf0e675a9dbeac","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"6053620fdbcd89fa7e755644efdaab78e0daaae7","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"d4e1946bea8d6441835eb3fd09b19237ba366a6f","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"a23b1b1aaf41e174181d5853a70e65d4d01e648c","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"c183d5775129a0a7495bd61a6e57ec230dcf01e5","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"ebf75c6301c4972a87542ebf2d994c6391eb5d46","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"9989938d13cc5ba8447eeed5a61acfcf61bc6801","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"600dc40554dc5ad1e6f3af51f700228033f43ea7","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/usb/cdc-phonet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F537DD4C-1540-41DE-85CB-6B14F7030A5F","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()\n\nA malicious USB device claiming to be a CDC Phonet modem can overflow\nthe skb_shared_info->frags[] array by sending an unbounded sequence of\nfull-page bulk transfers.\n\nDrop the skb and increment the length error when the frag limit is\nreached. This matches the same fix that commit f0813bcd2d9d (\"net:\nwwan: t7xx: fix potential skb->frags overflow in RX path\") did for the\nt7xx driver."}],"id":"CVE-2026-31623","lastModified":"2026-06-17T10:34:06.693","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:41.587","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0c5c65a17db729fc63ab656bdaaf0e675a9dbeac"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/600dc40554dc5ad1e6f3af51f700228033f43ea7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6053620fdbcd89fa7e755644efdaab78e0daaae7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6807ff49bf796b3823b1e29f97b69316a40a9a94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9989938d13cc5ba8447eeed5a61acfcf61bc6801"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a23b1b1aaf41e174181d5853a70e65d4d01e648c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c183d5775129a0a7495bd61a6e57ec230dcf01e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d4e1946bea8d6441835eb3fd09b19237ba366a6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ebf75c6301c4972a87542ebf2d994c6391eb5d46"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/usb/cdc-phonet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6807ff49bf796b3823b1e29f97b69316a40a9a94","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"0c5c65a17db729fc63ab656bdaaf0e675a9dbeac","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"6053620fdbcd89fa7e755644efdaab78e0daaae7","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"d4e1946bea8d6441835eb3fd09b19237ba366a6f","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"a23b1b1aaf41e174181d5853a70e65d4d01e648c","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"c183d5775129a0a7495bd61a6e57ec230dcf01e5","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"ebf75c6301c4972a87542ebf2d994c6391eb5d46","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"9989938d13cc5ba8447eeed5a61acfcf61bc6801","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"},{"lessThan":"600dc40554dc5ad1e6f3af51f700228033f43ea7","status":"affected","version":"87cf65601e1709e57f7e28f0f7b3eb0a992c1782","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/usb/cdc-phonet.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F537DD4C-1540-41DE-85CB-6B14F7030A5F","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.31","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()\n\nA malicious USB device claiming to be a CDC Phonet modem can overflow\nthe skb_shared_info->frags[] array by sending an unbounded sequence of\nfull-page bulk transfers.\n\nDrop the skb and increment the length error when the frag limit is\nreached. This matches the same fix that commit f0813bcd2d9d (\"net:\nwwan: t7xx: fix potential skb->frags overflow in RX path\") did for the\nt7xx driver."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: usb: cdc-phonet: corregir desbordamiento de skb frags[] en rx_complete()\n\nUn dispositivo USB malicioso que afirma ser un módem CDC Phonet puede desbordar el array skb_shared_info -> frags[] al enviar una secuencia ilimitada de transferencias masivas de página completa.\n\nDescartar el skb e incrementar el error de longitud cuando se alcanza el límite de fragmentos. Esto coincide con la misma corrección que el commit f0813bcd2d9d (’net: wwan: t7xx: corregir posible desbordamiento de skb -> frags en la ruta RX’) hizo para el controlador t7xx."}],"id":"CVE-2026-31623","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:41.587","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0c5c65a17db729fc63ab656bdaaf0e675a9dbeac"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/600dc40554dc5ad1e6f3af51f700228033f43ea7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6053620fdbcd89fa7e755644efdaab78e0daaae7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6807ff49bf796b3823b1e29f97b69316a40a9a94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9989938d13cc5ba8447eeed5a61acfcf61bc6801"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a23b1b1aaf41e174181d5853a70e65d4d01e648c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c183d5775129a0a7495bd61a6e57ec230dcf01e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d4e1946bea8d6441835eb3fd09b19237ba366a6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ebf75c6301c4972a87542ebf2d994c6391eb5d46"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-120"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31624.json b/data/2026/CVE-2026-31624.json index 27f55445ce..40992ff087 100644 --- a/data/2026/CVE-2026-31624.json +++ b/data/2026/CVE-2026-31624.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"76ad02854a30c394e0c076e6e6bed0a388573a94","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"eb415ddaf25e09ddb8fe5736a70c9de2e6462534","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"0ab048dbdb1daacf17d52e9252297eb6e1298e49","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"932ae5309e53561197aa7d1606c7cf63af10e24f","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"58386f00af710922cafb0fb69211497beddfaa95","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"8a8333237f1f5caab8d4c3d2c2e7578c4263a97f","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"ea363a34086ddb4231adc581a7f36c39ec154bfc","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"97014719bb8fccb1ffcbbc299e84b1f11b114195","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"69c02ffde6ed4d535fa4e693a9e572729cad3d0d","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.20"},{"lessThan":"2.6.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"098695E6-95CE-401B-AC16-CEBD793B4DF1","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.20.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.20:-:*:*:*:*:*:*","matchCriteriaId":"5AE1560A-DECA-4BC6-87F6-F3F9ED544840","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: clamp report_size in s32ton() to avoid undefined shift\n\ns32ton() shifts by n-1 where n is the field's report_size, a value that\ncomes directly from a HID device. The HID parser bounds report_size\nonly to <= 256, so a broken HID device can supply a report descriptor\nwith a wide field that triggers shift exponents up to 256 on a 32-bit\ntype when an output report is built via hid_output_field() or\nhid_set_field().\n\nCommit ec61b41918587 (\"HID: core: fix shift-out-of-bounds in\nhid_report_raw_event\") added the same n > 32 clamp to the function\nsnto32(), but s32ton() was never given the same fix as I guess syzbot\nhadn't figured out how to fuzz a device the same way.\n\nFix this up by just clamping the max value of n, just like snto32()\ndoes."}],"id":"CVE-2026-31624","lastModified":"2026-11-06T16:18:03.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31624","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:55.150218Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:41.697","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0ab048dbdb1daacf17d52e9252297eb6e1298e49"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/58386f00af710922cafb0fb69211497beddfaa95"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/69c02ffde6ed4d535fa4e693a9e572729cad3d0d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/76ad02854a30c394e0c076e6e6bed0a388573a94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a8333237f1f5caab8d4c3d2c2e7578c4263a97f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/932ae5309e53561197aa7d1606c7cf63af10e24f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/97014719bb8fccb1ffcbbc299e84b1f11b114195"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea363a34086ddb4231adc581a7f36c39ec154bfc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/eb415ddaf25e09ddb8fe5736a70c9de2e6462534"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"76ad02854a30c394e0c076e6e6bed0a388573a94","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"eb415ddaf25e09ddb8fe5736a70c9de2e6462534","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"0ab048dbdb1daacf17d52e9252297eb6e1298e49","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"932ae5309e53561197aa7d1606c7cf63af10e24f","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"58386f00af710922cafb0fb69211497beddfaa95","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"8a8333237f1f5caab8d4c3d2c2e7578c4263a97f","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"ea363a34086ddb4231adc581a7f36c39ec154bfc","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"97014719bb8fccb1ffcbbc299e84b1f11b114195","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"},{"lessThan":"69c02ffde6ed4d535fa4e693a9e572729cad3d0d","status":"affected","version":"dde5845a529ff753364a6d1aea61180946270bfa","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.20"},{"lessThan":"2.6.20","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"098695E6-95CE-401B-AC16-CEBD793B4DF1","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.20.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.20:-:*:*:*:*:*:*","matchCriteriaId":"5AE1560A-DECA-4BC6-87F6-F3F9ED544840","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: clamp report_size in s32ton() to avoid undefined shift\n\ns32ton() shifts by n-1 where n is the field's report_size, a value that\ncomes directly from a HID device. The HID parser bounds report_size\nonly to <= 256, so a broken HID device can supply a report descriptor\nwith a wide field that triggers shift exponents up to 256 on a 32-bit\ntype when an output report is built via hid_output_field() or\nhid_set_field().\n\nCommit ec61b41918587 (\"HID: core: fix shift-out-of-bounds in\nhid_report_raw_event\") added the same n > 32 clamp to the function\nsnto32(), but s32ton() was never given the same fix as I guess syzbot\nhadn't figured out how to fuzz a device the same way.\n\nFix this up by just clamping the max value of n, just like snto32()\ndoes."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: HID: core: limitar report_size en s32ton() para evitar un desplazamiento indefinido s32ton() desplaza por n-1 donde n es el report_size del campo, un valor que proviene directamente de un dispositivo HID. El analizador HID limita report_size solo a menor o igual que 256, por lo que un dispositivo HID defectuoso puede proporcionar un descriptor de informe con un campo amplio que activa exponentes de desplazamiento de hasta 256 en un tipo de 32 bits cuando se construye un informe de salida a través de hid_output_field() o hid_set_field(). El commit ec61b41918587 (’HID: core: corregir desplazamiento fuera de límites en hid_report_raw_event’) añadió la misma limitación n mayor que 32 a la función snto32(), pero s32ton() nunca recibió la misma corrección ya que supongo que syzbot no había descubierto cómo fuzzear un dispositivo de la misma manera. Corregir esto simplemente limitando el valor máximo de n, tal como lo hace snto32()."}],"id":"CVE-2026-31624","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31624","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:55.150218Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:41.697","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0ab048dbdb1daacf17d52e9252297eb6e1298e49"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/58386f00af710922cafb0fb69211497beddfaa95"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/69c02ffde6ed4d535fa4e693a9e572729cad3d0d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/76ad02854a30c394e0c076e6e6bed0a388573a94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8a8333237f1f5caab8d4c3d2c2e7578c4263a97f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/932ae5309e53561197aa7d1606c7cf63af10e24f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/97014719bb8fccb1ffcbbc299e84b1f11b114195"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea363a34086ddb4231adc581a7f36c39ec154bfc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/eb415ddaf25e09ddb8fe5736a70c9de2e6462534"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31625.json b/data/2026/CVE-2026-31625.json index e3921f0853..63872f6386 100644 --- a/data/2026/CVE-2026-31625.json +++ b/data/2026/CVE-2026-31625.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-alps.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"56850666bb5dcf7a13d76c5d02864813e17ee537","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"72516a8d7fe247fd895424bab87952f105a0c255","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"cc411e4823d8bfa23327d9989a0fa4e0ce76aebe","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"c8cc765253ad89ccc106a7bdeb5aeac6cf963078","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"8eed7bce7a4c41ab28ee4891103623a12fd41611","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"0091dfa542a362c178a7e9393097138a57d327d1","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"4b618248d2307a219d9431a730cfe1156c8e3386","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"ee2cb3ddfdca949dbc0c3f796ed5a439f0efc9f6","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"1badfc4319224820d5d890f8eab6aa52e4e83339","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-alps.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"73306563-4D86-4EFC-8B84-FAF53D5FB6A5","versionEndExcluding":"6.6.136","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: fix NULL pointer dereference in alps_raw_event()\n\nCommit ecfa6f34492c (\"HID: Add HID_CLAIMED_INPUT guards in raw_event\ncallbacks missing them\") attempted to fix up the HID drivers that had\nmissed the previous fix that was done in 2ff5baa9b527 (\"HID: appleir:\nFix potential NULL dereference at raw event handle\"), but the alps\ndriver was missed.\n\nFix this up by properly checking in the hid-alps driver that it had been\nclaimed correctly before attempting to process the raw event."}],"id":"CVE-2026-31625","lastModified":"2026-11-06T16:18:04.067","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:59.351133Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:41.807","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0091dfa542a362c178a7e9393097138a57d327d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1badfc4319224820d5d890f8eab6aa52e4e83339"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b618248d2307a219d9431a730cfe1156c8e3386"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/56850666bb5dcf7a13d76c5d02864813e17ee537"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/72516a8d7fe247fd895424bab87952f105a0c255"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8eed7bce7a4c41ab28ee4891103623a12fd41611"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8cc765253ad89ccc106a7bdeb5aeac6cf963078"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/cc411e4823d8bfa23327d9989a0fa4e0ce76aebe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee2cb3ddfdca949dbc0c3f796ed5a439f0efc9f6"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/hid/hid-alps.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"56850666bb5dcf7a13d76c5d02864813e17ee537","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"72516a8d7fe247fd895424bab87952f105a0c255","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"cc411e4823d8bfa23327d9989a0fa4e0ce76aebe","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"c8cc765253ad89ccc106a7bdeb5aeac6cf963078","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"8eed7bce7a4c41ab28ee4891103623a12fd41611","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"0091dfa542a362c178a7e9393097138a57d327d1","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"4b618248d2307a219d9431a730cfe1156c8e3386","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"ee2cb3ddfdca949dbc0c3f796ed5a439f0efc9f6","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"},{"lessThan":"1badfc4319224820d5d890f8eab6aa52e4e83339","status":"affected","version":"73196ebe134d11a68a2e27814c489d685cfc8b03","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/hid/hid-alps.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"73306563-4D86-4EFC-8B84-FAF53D5FB6A5","versionEndExcluding":"6.6.136","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: fix NULL pointer dereference in alps_raw_event()\n\nCommit ecfa6f34492c (\"HID: Add HID_CLAIMED_INPUT guards in raw_event\ncallbacks missing them\") attempted to fix up the HID drivers that had\nmissed the previous fix that was done in 2ff5baa9b527 (\"HID: appleir:\nFix potential NULL dereference at raw event handle\"), but the alps\ndriver was missed.\n\nFix this up by properly checking in the hid-alps driver that it had been\nclaimed correctly before attempting to process the raw event."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nHID: alps: corregir desreferencia de puntero NULL en alps_raw_event()\n\nEl commit ecfa6f34492c (’HID: Añadir protecciones HID_CLAIMED_INPUT en las devoluciones de llamada raw_event que carecen de ellas’) intentó corregir los controladores HID que habían omitido la corrección anterior que se realizó en 2ff5baa9b527 (’HID: appleir: Corregir posible desreferencia NULL en el manejador de eventos raw’), pero el controlador alps fue omitido.\n\nCorregir esto comprobando correctamente en el controlador hid-alps que había sido reclamado correctamente antes de intentar procesar el evento raw."}],"id":"CVE-2026-31625","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:22:59.351133Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:41.807","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0091dfa542a362c178a7e9393097138a57d327d1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1badfc4319224820d5d890f8eab6aa52e4e83339"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b618248d2307a219d9431a730cfe1156c8e3386"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/56850666bb5dcf7a13d76c5d02864813e17ee537"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/72516a8d7fe247fd895424bab87952f105a0c255"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8eed7bce7a4c41ab28ee4891103623a12fd41611"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c8cc765253ad89ccc106a7bdeb5aeac6cf963078"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/cc411e4823d8bfa23327d9989a0fa4e0ce76aebe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee2cb3ddfdca949dbc0c3f796ed5a439f0efc9f6"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31626.json b/data/2026/CVE-2026-31626.json index 28576d2c19..1b237d73a3 100644 --- a/data/2026/CVE-2026-31626.json +++ b/data/2026/CVE-2026-31626.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/staging/rtl8723bs/core/rtw_security.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6792624d933146e2757b07092e93ad915cb58930","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"51532c7c1d357145f4ac561648499f7a6847f739","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"9e911eead187240193516edf55a0e1ab3425aa5b","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"c65ee4d3be5df395e48afbcd0946dd5fce4338a9","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"d5b8f5f8d6fc09a8af5ed139c688660f578ed732","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"b487a7754d874230299d5a9c2710ec4df8b2ed8a","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"c2026c6b603ebec52f55015496703fe79077accf","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"ef74ce5f0bc0e53ce702d8a794f3957884a26efc","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"8c964b82a4e97ec7f25e17b803ee196009b38a57","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/staging/rtl8723bs/core/rtw_security.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"022BB187-782F-49F9-A3AE-9DCC0B6012CE","versionEndExcluding":"6.6.136","versionStartIncluding":"4.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()\n\nInitialize le_tmp64 to zero in rtw_BIP_verify() to prevent using\nuninitialized data.\n\nSmatch warns that only 6 bytes are copied to this 8-byte (u64)\nvariable, leaving the last two bytes uninitialized:\n\ndrivers/staging/rtl8723bs/core/rtw_security.c:1308 rtw_BIP_verify()\nwarn: not copying enough bytes for '&le_tmp64' (8 vs 6 bytes)\n\nInitializing the variable at the start of the function fixes this\nwarning and ensures predictable behavior."}],"id":"CVE-2026-31626","lastModified":"2026-06-17T10:34:07.060","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:41.907","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/51532c7c1d357145f4ac561648499f7a6847f739"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6792624d933146e2757b07092e93ad915cb58930"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8c964b82a4e97ec7f25e17b803ee196009b38a57"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9e911eead187240193516edf55a0e1ab3425aa5b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b487a7754d874230299d5a9c2710ec4df8b2ed8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c2026c6b603ebec52f55015496703fe79077accf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c65ee4d3be5df395e48afbcd0946dd5fce4338a9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5b8f5f8d6fc09a8af5ed139c688660f578ed732"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef74ce5f0bc0e53ce702d8a794f3957884a26efc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/staging/rtl8723bs/core/rtw_security.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6792624d933146e2757b07092e93ad915cb58930","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"51532c7c1d357145f4ac561648499f7a6847f739","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"9e911eead187240193516edf55a0e1ab3425aa5b","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"c65ee4d3be5df395e48afbcd0946dd5fce4338a9","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"d5b8f5f8d6fc09a8af5ed139c688660f578ed732","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"b487a7754d874230299d5a9c2710ec4df8b2ed8a","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"c2026c6b603ebec52f55015496703fe79077accf","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"ef74ce5f0bc0e53ce702d8a794f3957884a26efc","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"},{"lessThan":"8c964b82a4e97ec7f25e17b803ee196009b38a57","status":"affected","version":"554c0a3abf216c991c5ebddcdb2c08689ecd290b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/staging/rtl8723bs/core/rtw_security.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"022BB187-782F-49F9-A3AE-9DCC0B6012CE","versionEndExcluding":"6.6.136","versionStartIncluding":"4.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()\n\nInitialize le_tmp64 to zero in rtw_BIP_verify() to prevent using\nuninitialized data.\n\nSmatch warns that only 6 bytes are copied to this 8-byte (u64)\nvariable, leaving the last two bytes uninitialized:\n\ndrivers/staging/rtl8723bs/core/rtw_security.c:1308 rtw_BIP_verify()\nwarn: not copying enough bytes for '&le_tmp64' (8 vs 6 bytes)\n\nInitializing the variable at the start of the function fixes this\nwarning and ensures predictable behavior."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nstaging: rtl8723bs: inicializar le_tmp64 en rtw_BIP_verify()\n\nInicializar le_tmp64 a cero en rtw_BIP_verify() para evitar el uso de datos no inicializados.\n\nSmatch advierte que solo se copian 6 bytes a esta variable de 8 bytes (u64), dejando los últimos dos bytes sin inicializar:\n\ndrivers/staging/rtl8723bs/core/rtw_security.c:1308 rtw_BIP_verify() advertencia: no se copian suficientes bytes para ref:le_tmp64 (8 vs 6 bytes)\n\nInicializar la variable al inicio de la función soluciona esta advertencia y asegura un comportamiento predecible."}],"id":"CVE-2026-31626","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:41.907","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/51532c7c1d357145f4ac561648499f7a6847f739"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6792624d933146e2757b07092e93ad915cb58930"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8c964b82a4e97ec7f25e17b803ee196009b38a57"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9e911eead187240193516edf55a0e1ab3425aa5b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b487a7754d874230299d5a9c2710ec4df8b2ed8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c2026c6b603ebec52f55015496703fe79077accf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c65ee4d3be5df395e48afbcd0946dd5fce4338a9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5b8f5f8d6fc09a8af5ed139c688660f578ed732"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef74ce5f0bc0e53ce702d8a794f3957884a26efc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-908"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31627.json b/data/2026/CVE-2026-31627.json index b0afe3bd4d..58dc2e118c 100644 --- a/data/2026/CVE-2026-31627.json +++ b/data/2026/CVE-2026-31627.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/i2c/busses/i2c-s3c2410.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fd1650da24ed54c716aa9b69e9bbd8a662e492da","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"8f756a5964396da0fc9e0db33253a5b85dbbcbb6","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"2d262da4bca6fab96e2e709feb95b31b0a9a03a7","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"fa00738ab30b07db1a43b9c85fc56b8cc3b7d197","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"d87d5620125a03b1eadbd5df39748215d3db7ddb","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"377fae22a137b6b89f3f32399a58c52cf2325416","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"71b3c316b22c555d2769126a92b1244b15a9750d","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"c0128c7157d639a931353ea344fb44aad6d6e17a","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/i2c/busses/i2c-s3c2410.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.10"},{"lessThan":"3.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FB898C76-28CD-416F-9777-F00444862F17","versionEndExcluding":"6.6.136","versionStartIncluding":"3.10.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.10:-:*:*:*:*:*:*","matchCriteriaId":"82D28405-E1F2-43CF-AA38-B228805AFFF9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: s3c24xx: check the size of the SMBUS message before using it\n\nThe first byte of an i2c SMBUS message is the size, and it should be\nverified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX\nbefore processing it.\n\nThis is the same logic that was added in commit a6e04f05ce0b (\"i2c:\ntegra: check msg length in SMBUS block read\") to the i2c tegra driver."}],"id":"CVE-2026-31627","lastModified":"2026-06-17T10:34:07.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:42.003","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2d262da4bca6fab96e2e709feb95b31b0a9a03a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/377fae22a137b6b89f3f32399a58c52cf2325416"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/71b3c316b22c555d2769126a92b1244b15a9750d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8f756a5964396da0fc9e0db33253a5b85dbbcbb6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c0128c7157d639a931353ea344fb44aad6d6e17a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d87d5620125a03b1eadbd5df39748215d3db7ddb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fa00738ab30b07db1a43b9c85fc56b8cc3b7d197"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fd1650da24ed54c716aa9b69e9bbd8a662e492da"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/i2c/busses/i2c-s3c2410.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fd1650da24ed54c716aa9b69e9bbd8a662e492da","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"8f756a5964396da0fc9e0db33253a5b85dbbcbb6","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"2d262da4bca6fab96e2e709feb95b31b0a9a03a7","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"fa00738ab30b07db1a43b9c85fc56b8cc3b7d197","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"d87d5620125a03b1eadbd5df39748215d3db7ddb","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"377fae22a137b6b89f3f32399a58c52cf2325416","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"71b3c316b22c555d2769126a92b1244b15a9750d","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"},{"lessThan":"c0128c7157d639a931353ea344fb44aad6d6e17a","status":"affected","version":"85747311ecb6167c989093c64a13807366fdd3a9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/i2c/busses/i2c-s3c2410.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.10"},{"lessThan":"3.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FB898C76-28CD-416F-9777-F00444862F17","versionEndExcluding":"6.6.136","versionStartIncluding":"3.10.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.10:-:*:*:*:*:*:*","matchCriteriaId":"82D28405-E1F2-43CF-AA38-B228805AFFF9","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: s3c24xx: check the size of the SMBUS message before using it\n\nThe first byte of an i2c SMBUS message is the size, and it should be\nverified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX\nbefore processing it.\n\nThis is the same logic that was added in commit a6e04f05ce0b (\"i2c:\ntegra: check msg length in SMBUS block read\") to the i2c tegra driver."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ni2c: s3c24xx: verificar el tamaño del mensaje SMBUS antes de usarlo\n\nEl primer byte de un mensaje SMBUS i2c es el tamaño, y debe ser verificado para asegurar que está en el rango de 0..I2C_SMBUS_BLOCK_MAX antes de procesarlo.\n\nEsta es la misma lógica que fue añadida en el commit a6e04f05ce0b (’i2c: tegra: check msg length in SMBUS block read’) al controlador i2c tegra."}],"id":"CVE-2026-31627","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:42.003","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2d262da4bca6fab96e2e709feb95b31b0a9a03a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/377fae22a137b6b89f3f32399a58c52cf2325416"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/71b3c316b22c555d2769126a92b1244b15a9750d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8f756a5964396da0fc9e0db33253a5b85dbbcbb6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c0128c7157d639a931353ea344fb44aad6d6e17a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d87d5620125a03b1eadbd5df39748215d3db7ddb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fa00738ab30b07db1a43b9c85fc56b8cc3b7d197"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/fd1650da24ed54c716aa9b69e9bbd8a662e492da"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31628.json b/data/2026/CVE-2026-31628.json index 958c9c5b8f..da0556181b 100644 --- a/data/2026/CVE-2026-31628.json +++ b/data/2026/CVE-2026-31628.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/include/asm/msr-index.h","arch/x86/kernel/cpu/amd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ed7a3a246309ccc807238f1b4f159ee6d37ff9c4","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"0548529af20e68c6552817834b766646dd3bd7a7","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"1272cfedf4cd1019ddf583917a99b62f2d3645bb","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"91f02726b2203b71545713ecb7fb006e60a2d66f","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"b731aca06387b195058a9f6449a03b62efa1bd10","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"ad17f07e95e6e8505e2153e5b391f0d27eacce25","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"e6af5286efe5a56128b34032572c9ce9ebeccda3","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"546785c719418c6166834a47e372a88f5f7ae893","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"e55d98e7756135f32150b9b8f75d580d0d4b2dd3","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"status":"affected","version":"5abd1583e06b3963e5c9d915760367de86808b78","versionType":"git"},{"status":"affected","version":"4ba461d426490b6ed7e8298c4d3b7a13aa5d2686","versionType":"git"},{"status":"affected","version":"5a63725cd18fcee2af6ec46ccb856b64ad3077b4","versionType":"git"},{"lessThan":"3.17","status":"affected","version":"3.16.58","versionType":"semver"},{"lessThan":"4.5","status":"affected","version":"4.4.144","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.102","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/include/asm/msr-index.h","arch/x86/kernel/cpu/amd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C1981AEB-4867-4AB9-8168-BAB8D6567131","versionEndExcluding":"3.17","versionStartIncluding":"3.16.58","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7E307C3F-E33B-4061-B210-F031D88F5C6E","versionEndExcluding":"4.5","versionStartIncluding":"4.4.144","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96373A7C-EBC6-4D06-941C-481E7B24579D","versionEndExcluding":"4.10","versionStartIncluding":"4.9.102","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A6FC7EE9-71F9-4ACC-9566-0299D47F2B4A","versionEndExcluding":"5.10.253","versionStartIncluding":"4.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.14:-:*:*:*:*:*:*","matchCriteriaId":"7875AA30-1F6F-470C-A52D-ECBD6663CEC5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU: Fix FPDSS on Zen1\n\nZen1's hardware divider can leave, under certain circumstances, partial\nresults from previous operations. Those results can be leaked by\nanother, attacker thread.\n\nFix that with a chicken bit."}],"id":"CVE-2026-31628","lastModified":"2026-11-10T13:19:01.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31628","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:04.681219Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.103","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0548529af20e68c6552817834b766646dd3bd7a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1272cfedf4cd1019ddf583917a99b62f2d3645bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/546785c719418c6166834a47e372a88f5f7ae893"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/91f02726b2203b71545713ecb7fb006e60a2d66f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ad17f07e95e6e8505e2153e5b391f0d27eacce25"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b731aca06387b195058a9f6449a03b62efa1bd10"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e55d98e7756135f32150b9b8f75d580d0d4b2dd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6af5286efe5a56128b34032572c9ce9ebeccda3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ed7a3a246309ccc807238f1b4f159ee6d37ff9c4"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/include/asm/msr-index.h","arch/x86/kernel/cpu/amd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ed7a3a246309ccc807238f1b4f159ee6d37ff9c4","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"0548529af20e68c6552817834b766646dd3bd7a7","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"1272cfedf4cd1019ddf583917a99b62f2d3645bb","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"91f02726b2203b71545713ecb7fb006e60a2d66f","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"b731aca06387b195058a9f6449a03b62efa1bd10","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"ad17f07e95e6e8505e2153e5b391f0d27eacce25","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"e6af5286efe5a56128b34032572c9ce9ebeccda3","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"546785c719418c6166834a47e372a88f5f7ae893","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"lessThan":"e55d98e7756135f32150b9b8f75d580d0d4b2dd3","status":"affected","version":"f7f3dc00f61261cdc9ccd8b886f21bc4dffd6fd9","versionType":"git"},{"status":"affected","version":"5abd1583e06b3963e5c9d915760367de86808b78","versionType":"git"},{"status":"affected","version":"4ba461d426490b6ed7e8298c4d3b7a13aa5d2686","versionType":"git"},{"status":"affected","version":"5a63725cd18fcee2af6ec46ccb856b64ad3077b4","versionType":"git"},{"lessThan":"3.17","status":"affected","version":"3.16.58","versionType":"semver"},{"lessThan":"4.5","status":"affected","version":"4.4.144","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.102","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/include/asm/msr-index.h","arch/x86/kernel/cpu/amd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C1981AEB-4867-4AB9-8168-BAB8D6567131","versionEndExcluding":"3.17","versionStartIncluding":"3.16.58","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7E307C3F-E33B-4061-B210-F031D88F5C6E","versionEndExcluding":"4.5","versionStartIncluding":"4.4.144","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96373A7C-EBC6-4D06-941C-481E7B24579D","versionEndExcluding":"4.10","versionStartIncluding":"4.9.102","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A6FC7EE9-71F9-4ACC-9566-0299D47F2B4A","versionEndExcluding":"5.10.253","versionStartIncluding":"4.14.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.14:-:*:*:*:*:*:*","matchCriteriaId":"7875AA30-1F6F-470C-A52D-ECBD6663CEC5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU: Fix FPDSS on Zen1\n\nZen1's hardware divider can leave, under certain circumstances, partial\nresults from previous operations. Those results can be leaked by\nanother, attacker thread.\n\nFix that with a chicken bit."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nx86/CPU: Corrección de FPDSS en Zen1\n\nEl divisor de hardware de Zen1 puede dejar, bajo ciertas circunstancias, resultados parciales de operaciones anteriores. Esos resultados pueden ser filtrados por otro hilo atacante.\n\nEsto se corrige con un chicken bit."}],"id":"CVE-2026-31628","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31628","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:04.681219Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.103","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0548529af20e68c6552817834b766646dd3bd7a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1272cfedf4cd1019ddf583917a99b62f2d3645bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/546785c719418c6166834a47e372a88f5f7ae893"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/91f02726b2203b71545713ecb7fb006e60a2d66f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ad17f07e95e6e8505e2153e5b391f0d27eacce25"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b731aca06387b195058a9f6449a03b62efa1bd10"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e55d98e7756135f32150b9b8f75d580d0d4b2dd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6af5286efe5a56128b34032572c9ce9ebeccda3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ed7a3a246309ccc807238f1b4f159ee6d37ff9c4"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31629.json b/data/2026/CVE-2026-31629.json index bcd8729aae..11d062eefb 100644 --- a/data/2026/CVE-2026-31629.json +++ b/data/2026/CVE-2026-31629.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/nfc/llcp_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b2a23529593d011fb433a3d711fc597ed6a6bd2f","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"665315df9c3486cb213fc44d83cc8bcd47fe0d26","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"9b49e2a4b8219a2fc5cebf94f4ec34e509aff8a6","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"0eb1263a3b8c36418c9ba295c9ab3abed664edbf","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"796e0cac058252d0ad34ebe288e6f7979b5fc9b2","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"8977fad2b3c6eefd414131168d597c5d1d5e1abf","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"ff3d9e8f7244293e303f7b6ef70774291c7c27e9","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"aba4712e8f0381cd5d196534ce2ad082626a5ab6","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"2b5dd4632966c39da6ba74dbc8689b309065e82c","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/nfc/llcp_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.3"},{"lessThan":"3.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FAB12062-558C-4570-A908-D71195858ADA","versionEndExcluding":"6.6.136","versionStartIncluding":"3.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: add missing return after LLCP_CLOSED checks\n\nIn nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket\nstate is LLCP_CLOSED, the code correctly calls release_sock() and\nnfc_llcp_sock_put() but fails to return. Execution falls through to\nthe remainder of the function, which calls release_sock() and\nnfc_llcp_sock_put() again. This results in a double release_sock()\nand a refcount underflow via double nfc_llcp_sock_put(), leading to\na use-after-free.\n\nAdd the missing return statements after the LLCP_CLOSED branches\nin both functions to prevent the fall-through."}],"id":"CVE-2026-31629","lastModified":"2026-10-15T02:19:13.923","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:42.217","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0eb1263a3b8c36418c9ba295c9ab3abed664edbf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b5dd4632966c39da6ba74dbc8689b309065e82c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/665315df9c3486cb213fc44d83cc8bcd47fe0d26"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/796e0cac058252d0ad34ebe288e6f7979b5fc9b2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8977fad2b3c6eefd414131168d597c5d1d5e1abf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9b49e2a4b8219a2fc5cebf94f4ec34e509aff8a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aba4712e8f0381cd5d196534ce2ad082626a5ab6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b2a23529593d011fb433a3d711fc597ed6a6bd2f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ff3d9e8f7244293e303f7b6ef70774291c7c27e9"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/nfc/llcp_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b2a23529593d011fb433a3d711fc597ed6a6bd2f","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"665315df9c3486cb213fc44d83cc8bcd47fe0d26","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"9b49e2a4b8219a2fc5cebf94f4ec34e509aff8a6","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"0eb1263a3b8c36418c9ba295c9ab3abed664edbf","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"796e0cac058252d0ad34ebe288e6f7979b5fc9b2","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"8977fad2b3c6eefd414131168d597c5d1d5e1abf","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"ff3d9e8f7244293e303f7b6ef70774291c7c27e9","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"aba4712e8f0381cd5d196534ce2ad082626a5ab6","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"},{"lessThan":"2b5dd4632966c39da6ba74dbc8689b309065e82c","status":"affected","version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/nfc/llcp_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.3"},{"lessThan":"3.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FAB12062-558C-4570-A908-D71195858ADA","versionEndExcluding":"6.6.136","versionStartIncluding":"3.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: add missing return after LLCP_CLOSED checks\n\nIn nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket\nstate is LLCP_CLOSED, the code correctly calls release_sock() and\nnfc_llcp_sock_put() but fails to return. Execution falls through to\nthe remainder of the function, which calls release_sock() and\nnfc_llcp_sock_put() again. This results in a double release_sock()\nand a refcount underflow via double nfc_llcp_sock_put(), leading to\na use-after-free.\n\nAdd the missing return statements after the LLCP_CLOSED branches\nin both functions to prevent the fall-through."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnfc: llcp: añadir retorno faltante después de las comprobaciones de LLCP_CLOSED\n\nEn nfc_llcp_recv_hdlc() y nfc_llcp_recv_disc(), cuando el estado del socket es LLCP_CLOSED, el código llama correctamente a release_sock() y nfc_llcp_sock_put() pero no retorna. La ejecución continúa hacia el resto de la función, que llama a release_sock() y nfc_llcp_sock_put() de nuevo. Esto resulta en una doble llamada a release_sock() y un subdesbordamiento del contador de referencias a través de una doble llamada a nfc_llcp_sock_put(), lo que lleva a un uso después de liberación.\n\nAñadir las sentencias ’return’ faltantes después de las ramas LLCP_CLOSED en ambas funciones para evitar el paso directo."}],"id":"CVE-2026-31629","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:42.217","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0eb1263a3b8c36418c9ba295c9ab3abed664edbf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2b5dd4632966c39da6ba74dbc8689b309065e82c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/665315df9c3486cb213fc44d83cc8bcd47fe0d26"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/796e0cac058252d0ad34ebe288e6f7979b5fc9b2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8977fad2b3c6eefd414131168d597c5d1d5e1abf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/9b49e2a4b8219a2fc5cebf94f4ec34e509aff8a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aba4712e8f0381cd5d196534ce2ad082626a5ab6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b2a23529593d011fb433a3d711fc597ed6a6bd2f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ff3d9e8f7244293e303f7b6ef70774291c7c27e9"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31630.json b/data/2026/CVE-2026-31630.json index ef5eed024f..1eb621f743 100644 --- a/data/2026/CVE-2026-31630.json +++ b/data/2026/CVE-2026-31630.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"386c86412608d3449006a318a662cbcd6ca1f668","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"235b2115de892eab2e107a42efa7a4347baaa80b","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"625af53a1564e31bb2df9adc3739df46137f46c1","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"808a34cdbe8ce336c202d8ea6d5e48496764dc37","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"a6042b8066b24dbcc7945616a157d4d43e463668","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"db297c78ce537c9ac96f0eda9b25ad72c8caefa9","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"10ebed83f9f6414af4e85bc85ffaeda7effdd874","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"a44ce6aa2efb61fe44f2cfab72bb01544bbca272","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.9"},{"lessThan":"4.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"59855615-6720-4D3F-83EB-B5CCFD90FBD3","versionEndExcluding":"6.18.23","versionStartIncluding":"4.9.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.9:-:*:*:*:*:*:*","matchCriteriaId":"592761F7-6672-484E-8490-1187F4CDD13E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: proc: size address buffers for %pISpc output\n\nThe AF_RXRPC procfs helpers format local and remote socket addresses into\nfixed 50-byte stack buffers with \"%pISpc\".\n\nThat is too small for the longest current-tree IPv6-with-port form the\nformatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a\ndotted-quad tail not only for v4mapped addresses, but also for ISATAP\naddresses via ipv6_addr_is_isatap().\n\nAs a result, a case such as\n\n [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nis possible with the current formatter. That is 50 visible characters, so\n51 bytes including the trailing NUL, which does not fit in the existing\nchar[50] buffers used by net/rxrpc/proc.c.\n\nSize the buffers from the formatter's maximum textual form and switch the\ncall sites to scnprintf().\n\nChanges since v1:\n- correct the changelog to cite the actual maximum current-tree case\n explicitly\n- frame the proof around the ISATAP formatting path instead of the earlier\n mapped-v4 example"}],"id":"CVE-2026-31630","lastModified":"2026-10-21T13:18:40.563","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31630","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:18.108954Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.323","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10ebed83f9f6414af4e85bc85ffaeda7effdd874"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/235b2115de892eab2e107a42efa7a4347baaa80b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/386c86412608d3449006a318a662cbcd6ca1f668"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/625af53a1564e31bb2df9adc3739df46137f46c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/808a34cdbe8ce336c202d8ea6d5e48496764dc37"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a6042b8066b24dbcc7945616a157d4d43e463668"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-121"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"386c86412608d3449006a318a662cbcd6ca1f668","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"235b2115de892eab2e107a42efa7a4347baaa80b","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"625af53a1564e31bb2df9adc3739df46137f46c1","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"808a34cdbe8ce336c202d8ea6d5e48496764dc37","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"a6042b8066b24dbcc7945616a157d4d43e463668","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"db297c78ce537c9ac96f0eda9b25ad72c8caefa9","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"10ebed83f9f6414af4e85bc85ffaeda7effdd874","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"},{"lessThan":"a44ce6aa2efb61fe44f2cfab72bb01544bbca272","status":"affected","version":"75b54cb57ca34cbe7a87c6ac757c55360a624590","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.9"},{"lessThan":"4.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.114","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"59855615-6720-4D3F-83EB-B5CCFD90FBD3","versionEndExcluding":"6.18.23","versionStartIncluding":"4.9.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.9:-:*:*:*:*:*:*","matchCriteriaId":"592761F7-6672-484E-8490-1187F4CDD13E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: proc: size address buffers for %pISpc output\n\nThe AF_RXRPC procfs helpers format local and remote socket addresses into\nfixed 50-byte stack buffers with \"%pISpc\".\n\nThat is too small for the longest current-tree IPv6-with-port form the\nformatter can produce. In lib/vsprintf.c, the compressed IPv6 path uses a\ndotted-quad tail not only for v4mapped addresses, but also for ISATAP\naddresses via ipv6_addr_is_isatap().\n\nAs a result, a case such as\n\n [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nis possible with the current formatter. That is 50 visible characters, so\n51 bytes including the trailing NUL, which does not fit in the existing\nchar[50] buffers used by net/rxrpc/proc.c.\n\nSize the buffers from the formatter's maximum textual form and switch the\ncall sites to scnprintf().\n\nChanges since v1:\n- correct the changelog to cite the actual maximum current-tree case\n explicitly\n- frame the proof around the ISATAP formatting path instead of the earlier\n mapped-v4 example"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: proc: dimensionar los búferes de dirección para la salida %pISpc\n\nLos ayudantes de procfs de AF_RXRPC formatean las direcciones de socket locales y remotas en búferes de pila fijos de 50 bytes con ’%pISpc’.\n\nEso es demasiado pequeño para la forma más larga de IPv6 con puerto del árbol actual que el formateador puede producir. En lib/vsprintf.c, la ruta IPv6 comprimida utiliza una cola de cuádruple punteado no solo para direcciones mapeadas a v4, sino también para direcciones ISATAP a través de ipv6_addr_is_isatap().\n\nComo resultado, un caso como\n\n [ffff:ffff:ffff:ffff:0:5efe:255.255.255.255]:65535\n\nes posible con el formateador actual. Eso son 50 caracteres visibles, por lo tanto, 51 bytes incluyendo el NUL final, lo cual no cabe en los búferes char[50] existentes utilizados por net/rxrpc/proc.c.\n\nDimensionar los búferes a partir de la forma textual máxima del formateador y cambiar los sitios de llamada a scnprintf().\n\nCambios desde la v1:\n- corregir el registro de cambios para citar explícitamente el caso máximo real del árbol actual\n- enmarcar la prueba en torno a la ruta de formateo ISATAP en lugar del ejemplo anterior de v4 mapeado"}],"id":"CVE-2026-31630","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31630","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:18.108954Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.323","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10ebed83f9f6414af4e85bc85ffaeda7effdd874"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/235b2115de892eab2e107a42efa7a4347baaa80b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/386c86412608d3449006a318a662cbcd6ca1f668"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/625af53a1564e31bb2df9adc3739df46137f46c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/808a34cdbe8ce336c202d8ea6d5e48496764dc37"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a44ce6aa2efb61fe44f2cfab72bb01544bbca272"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a6042b8066b24dbcc7945616a157d4d43e463668"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/db297c78ce537c9ac96f0eda9b25ad72c8caefa9"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-121"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31631.json b/data/2026/CVE-2026-31631.json index 6e7ed290af..cff9e03ba7 100644 --- a/data/2026/CVE-2026-31631.json +++ b/data/2026/CVE-2026-31631.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"794586789800b16dcbe235452494f4223ac80413","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"1c4422d8be81718ecb15d79aedff607323085201","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"f564af387c8c28238f8ebc13314c589d7ba8475d","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix buffer overread in rxgk_do_verify_authenticator()\n\nFix rxgk_do_verify_authenticator() to check the buffer size before checking\nthe nonce."}],"id":"CVE-2026-31631","lastModified":"2026-10-19T19:18:02.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31631","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:20.356548Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.423","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c4422d8be81718ecb15d79aedff607323085201"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/794586789800b16dcbe235452494f4223ac80413"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f564af387c8c28238f8ebc13314c589d7ba8475d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"794586789800b16dcbe235452494f4223ac80413","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"1c4422d8be81718ecb15d79aedff607323085201","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"f564af387c8c28238f8ebc13314c589d7ba8475d","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix buffer overread in rxgk_do_verify_authenticator()\n\nFix rxgk_do_verify_authenticator() to check the buffer size before checking\nthe nonce."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nrxrpc: Corrección de lectura excesiva de búfer en rxgk_do_verify_authenticator()\n\nCorregir rxgk_do_verify_authenticator() para que compruebe el tamaño del búfer antes de comprobar el nonce."}],"id":"CVE-2026-31631","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31631","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:20.356548Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.423","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c4422d8be81718ecb15d79aedff607323085201"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/794586789800b16dcbe235452494f4223ac80413"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f564af387c8c28238f8ebc13314c589d7ba8475d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31632.json b/data/2026/CVE-2026-31632.json index 9a8e6ba438..f6cb39292f 100644 --- a/data/2026/CVE-2026-31632.json +++ b/data/2026/CVE-2026-31632.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4b5e8365515f4409de7d3b92a439154ee4f90f6d","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"1bd3d01378c1f9ecd313d394b51c808c1f418615","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"7e1876caa8363056f58a21d3b31b82c2daf7e608","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix leak of rxgk context in rxgk_verify_response()\n\nFix rxgk_verify_response() to clean up the rxgk context it creates."}],"id":"CVE-2026-31632","lastModified":"2026-11-06T16:18:04.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31632","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:09.132782Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.517","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1bd3d01378c1f9ecd313d394b51c808c1f418615"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b5e8365515f4409de7d3b92a439154ee4f90f6d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e1876caa8363056f58a21d3b31b82c2daf7e608"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4b5e8365515f4409de7d3b92a439154ee4f90f6d","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"1bd3d01378c1f9ecd313d394b51c808c1f418615","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"7e1876caa8363056f58a21d3b31b82c2daf7e608","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix leak of rxgk context in rxgk_verify_response()\n\nFix rxgk_verify_response() to clean up the rxgk context it creates."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: Soluciona la fuga de contexto rxgk en rxgk_verify_response()\n\nSoluciona rxgk_verify_response() para limpiar el contexto rxgk que crea."}],"id":"CVE-2026-31632","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31632","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:09.132782Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.517","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1bd3d01378c1f9ecd313d394b51c808c1f418615"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b5e8365515f4409de7d3b92a439154ee4f90f6d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e1876caa8363056f58a21d3b31b82c2daf7e608"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31633.json b/data/2026/CVE-2026-31633.json index d93efc2eef..3aeabcf71d 100644 --- a/data/2026/CVE-2026-31633.json +++ b/data/2026/CVE-2026-31633.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1f864d9daaf622aeaa774404fd51e7d6a435b046","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"c1e242beb6b1efc3c286f617e8d940c8fbf2ed41","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"699e52180f4231c257821c037ed5c99d5eb0edb8","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix integer overflow in rxgk_verify_response()\n\nIn rxgk_verify_response(), there's a potential integer overflow due to\nrounding up token_len before checking it, thereby allowing the length check to\nbe bypassed.\n\nFix this by checking the unrounded value against len too (len is limited as\nthe response must fit in a single UDP packet)."}],"id":"CVE-2026-31633","lastModified":"2026-10-19T19:18:02.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31633","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:22.560304Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.613","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1f864d9daaf622aeaa774404fd51e7d6a435b046"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/699e52180f4231c257821c037ed5c99d5eb0edb8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c1e242beb6b1efc3c286f617e8d940c8fbf2ed41"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1f864d9daaf622aeaa774404fd51e7d6a435b046","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"c1e242beb6b1efc3c286f617e8d940c8fbf2ed41","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"699e52180f4231c257821c037ed5c99d5eb0edb8","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix integer overflow in rxgk_verify_response()\n\nIn rxgk_verify_response(), there's a potential integer overflow due to\nrounding up token_len before checking it, thereby allowing the length check to\nbe bypassed.\n\nFix this by checking the unrounded value against len too (len is limited as\nthe response must fit in a single UDP packet)."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: Corrección de desbordamiento de entero en rxgk_verify_response()\n\nEn rxgk_verify_response(), existe un potencial desbordamiento de entero debido al redondeo al alza de token_len antes de comprobarlo, lo que permite que se eluda la comprobación de longitud.\n\nEsto se soluciona comprobando también el valor sin redondear contra len (len está limitado ya que la respuesta debe caber en un único paquete UDP)."}],"id":"CVE-2026-31633","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31633","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:22.560304Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.613","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1f864d9daaf622aeaa774404fd51e7d6a435b046"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/699e52180f4231c257821c037ed5c99d5eb0edb8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c1e242beb6b1efc3c286f617e8d940c8fbf2ed41"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31634.json b/data/2026/CVE-2026-31634.json index 4c2fc4f253..49bec60921 100644 --- a/data/2026/CVE-2026-31634.json +++ b/data/2026/CVE-2026-31634.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/server_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"45d9584e51bdd61faf1900f82666d4ea6a85da72","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"fc76d0bd00850b7372f0a4a319c0c60f80487632","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"c6d9ea26cf8756ad6f162578e94a5f82f6fae3c2","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"9ce36d28f67c2a477a7e2f03480de3f6783fb363","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"12de9e0e0b0b7058be7dfb8a5927eb565bc25780","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"8ee931c3cd97f1c42b4fbf057f04b9dae45dfb7a","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"139c750bf06649097d98b0bc41e2a678b4627e27","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"f125846ee79fcae537a964ce66494e96fa54a6de","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/server_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3CA3003D-15D3-4188-ADEA-9A0A4C5759FD","versionEndExcluding":"5.15.203","versionStartIncluding":"2.6.22.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:-:*:*:*:*:*:*","matchCriteriaId":"7F7D6C66-3384-4ACC-9D08-C5A26B4FD004","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix reference count leak in rxrpc_server_keyring()\n\nThis patch fixes a reference count leak in rxrpc_server_keyring()\nby checking if rx->securities is already set."}],"id":"CVE-2026-31634","lastModified":"2026-11-10T13:19:01.233","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31634","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:13.728340Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.707","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/12de9e0e0b0b7058be7dfb8a5927eb565bc25780"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/139c750bf06649097d98b0bc41e2a678b4627e27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/45d9584e51bdd61faf1900f82666d4ea6a85da72"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ee931c3cd97f1c42b4fbf057f04b9dae45dfb7a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ce36d28f67c2a477a7e2f03480de3f6783fb363"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c6d9ea26cf8756ad6f162578e94a5f82f6fae3c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f125846ee79fcae537a964ce66494e96fa54a6de"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fc76d0bd00850b7372f0a4a319c0c60f80487632"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/server_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"45d9584e51bdd61faf1900f82666d4ea6a85da72","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"fc76d0bd00850b7372f0a4a319c0c60f80487632","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"c6d9ea26cf8756ad6f162578e94a5f82f6fae3c2","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"9ce36d28f67c2a477a7e2f03480de3f6783fb363","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"12de9e0e0b0b7058be7dfb8a5927eb565bc25780","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"8ee931c3cd97f1c42b4fbf057f04b9dae45dfb7a","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"139c750bf06649097d98b0bc41e2a678b4627e27","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"f125846ee79fcae537a964ce66494e96fa54a6de","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/server_key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3CA3003D-15D3-4188-ADEA-9A0A4C5759FD","versionEndExcluding":"5.15.203","versionStartIncluding":"2.6.22.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:-:*:*:*:*:*:*","matchCriteriaId":"7F7D6C66-3384-4ACC-9D08-C5A26B4FD004","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix reference count leak in rxrpc_server_keyring()\n\nThis patch fixes a reference count leak in rxrpc_server_keyring()\nby checking if rx->securities is already set."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: soluciona una fuga de contador de referencias en rxrpc_server_keyring()\n\nEste parche soluciona una fuga de contador de referencias en rxrpc_server_keyring() al verificar si rx -> securities ya está establecido."}],"id":"CVE-2026-31634","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31634","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:13.728340Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.707","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/12de9e0e0b0b7058be7dfb8a5927eb565bc25780"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/139c750bf06649097d98b0bc41e2a678b4627e27"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/45d9584e51bdd61faf1900f82666d4ea6a85da72"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ee931c3cd97f1c42b4fbf057f04b9dae45dfb7a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ce36d28f67c2a477a7e2f03480de3f6783fb363"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c6d9ea26cf8756ad6f162578e94a5f82f6fae3c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f125846ee79fcae537a964ce66494e96fa54a6de"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fc76d0bd00850b7372f0a4a319c0c60f80487632"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31635.json b/data/2026/CVE-2026-31635.json index d02ab2fa7d..19b79e776e 100644 --- a/data/2026/CVE-2026-31635.json +++ b/data/2026/CVE-2026-31635.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"beee051f259acd286fed64c32c2b31e6f5097eb5","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"a2567217ade970ecc458144b6be469bc015b23e5","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix oversized RESPONSE authenticator length check\n\nrxgk_verify_response() decodes auth_len from the packet and is supposed\nto verify that it fits in the remaining bytes. The existing check is\ninverted, so oversized RESPONSE authenticators are accepted and passed\nto rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an\nimpossible length and hit BUG_ON(len).\n\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\n\nRIP: __skb_to_sgvec()\n [net/core/skbuff.c:5285 (discriminator 1)]\nCall Trace:\n skb_to_sgvec() [net/core/skbuff.c:5305]\n rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]\n rxgk_verify_response() [net/rxrpc/rxgk.c:1268]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nReject authenticator lengths that exceed the remaining packet payload."}],"id":"CVE-2026-31635","lastModified":"2026-06-17T10:34:08.150","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31635","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-18T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.820","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a2567217ade970ecc458144b6be469bc015b23e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/beee051f259acd286fed64c32c2b31e6f5097eb5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/v12-security/pocs/tree/main/dirtydecrypt"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-130"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"beee051f259acd286fed64c32c2b31e6f5097eb5","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"a2567217ade970ecc458144b6be469bc015b23e5","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix oversized RESPONSE authenticator length check\n\nrxgk_verify_response() decodes auth_len from the packet and is supposed\nto verify that it fits in the remaining bytes. The existing check is\ninverted, so oversized RESPONSE authenticators are accepted and passed\nto rxgk_decrypt_skb(), which can later reach skb_to_sgvec() with an\nimpossible length and hit BUG_ON(len).\n\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\n\nRIP: __skb_to_sgvec()\n [net/core/skbuff.c:5285 (discriminator 1)]\nCall Trace:\n skb_to_sgvec() [net/core/skbuff.c:5305]\n rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]\n rxgk_verify_response() [net/rxrpc/rxgk.c:1268]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nReject authenticator lengths that exceed the remaining packet payload."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: corrección de la comprobación de longitud de autenticador RESPONSE sobredimensionado\n\nrxgk_verify_response() decodifica auth_len del paquete y se supone que verifica que cabe en los bytes restantes. La comprobación existente está invertida, por lo que los autenticadores RESPONSE sobredimensionados son aceptados y pasados a rxgk_decrypt_skb(), lo que puede llegar más tarde a skb_to_sgvec() con una longitud imposible y activar BUG_ON(len).\n\nDecodificado de los registros de reproducción latest-net originales con scripts/decode_stacktrace.sh:\n\nRIP: __skb_to_sgvec()\n [net/core/skbuff.c:5285 (discriminador 1)]\nTraza de Llamadas:\n skb_to_sgvec() [net/core/skbuff.c:5305]\n rxgk_decrypt_skb() [net/rxrpc/rxgk_common.h:81]\n rxgk_verify_response() [net/rxrpc/rxgk.c:1268]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nRechazar longitudes de autenticador que excedan la carga útil restante del paquete."}],"id":"CVE-2026-31635","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31635","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-18T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-04-24T15:16:42.820","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a2567217ade970ecc458144b6be469bc015b23e5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/beee051f259acd286fed64c32c2b31e6f5097eb5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e2f1a80d8b1ed6a5ae585a399c2b46500bdcc305"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/v12-security/pocs/tree/main/dirtydecrypt"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-130"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31636.json b/data/2026/CVE-2026-31636.json index 9d2ba14e17..7c6d99e2e8 100644 --- a/data/2026/CVE-2026-31636.json +++ b/data/2026/CVE-2026-31636.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7875f3d9777bd4e9892c4db830571ab8ac2044c0","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"20a188775a9a9982d1987e12660d9b44b40a6c99","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"3e3138007887504ee9206d0bfb5acb062c600025","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix RESPONSE authenticator parser OOB read\n\nrxgk_verify_authenticator() copies auth_len bytes into a temporary\nbuffer and then passes p + auth_len as the parser limit to\nrxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the\nparser end pointer by a factor of four and lets malformed RESPONSE\nauthenticators read past the kmalloc() buffer.\n\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\n\nBUG: KASAN: slab-out-of-bounds in rxgk_verify_response()\nCall Trace:\n dump_stack_lvl() [lib/dump_stack.c:123]\n print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482]\n kasan_report() [mm/kasan/report.c:597]\n rxgk_verify_response()\n [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nAllocated by task 54:\n rxgk_verify_response()\n [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n\nConvert the byte count to __be32 units before constructing the parser\nlimit."}],"id":"CVE-2026-31636","lastModified":"2026-06-17T10:34:08.277","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:42.920","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/20a188775a9a9982d1987e12660d9b44b40a6c99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3e3138007887504ee9206d0bfb5acb062c600025"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7875f3d9777bd4e9892c4db830571ab8ac2044c0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7875f3d9777bd4e9892c4db830571ab8ac2044c0","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"20a188775a9a9982d1987e12660d9b44b40a6c99","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"},{"lessThan":"3e3138007887504ee9206d0bfb5acb062c600025","status":"affected","version":"9d1d2b59341f58126a69b51f9f5f8ccb9f12e54a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/rxgk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: fix RESPONSE authenticator parser OOB read\n\nrxgk_verify_authenticator() copies auth_len bytes into a temporary\nbuffer and then passes p + auth_len as the parser limit to\nrxgk_do_verify_authenticator(). Since p is a __be32 *, that inflates the\nparser end pointer by a factor of four and lets malformed RESPONSE\nauthenticators read past the kmalloc() buffer.\n\nDecoded from the original latest-net reproduction logs with\nscripts/decode_stacktrace.sh:\n\nBUG: KASAN: slab-out-of-bounds in rxgk_verify_response()\nCall Trace:\n dump_stack_lvl() [lib/dump_stack.c:123]\n print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482]\n kasan_report() [mm/kasan/report.c:597]\n rxgk_verify_response()\n [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nAllocated by task 54:\n rxgk_verify_response()\n [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n\nConvert the byte count to __be32 units before constructing the parser\nlimit."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: corrección de lectura fuera de límites del analizador de autenticador RESPONSE\n\nrxgk_verify_authenticator() copia auth_len bytes en un búfer temporal y luego pasa p + auth_len como el límite del analizador a rxgk_do_verify_authenticator(). Dado que p es un __be32 *, eso infla el puntero de fin del analizador por un factor de cuatro y permite que los autenticadores RESPONSE malformados lean más allá del búfer de kmalloc().\n\nDecodificado de los registros de reproducción originales de latest-net con scripts/decode_stacktrace.sh:\n\nERROR: KASAN: slab-fuera-de-límites en rxgk_verify_response()\nTraza de Llamada:\n dump_stack_lvl() [lib/dump_stack.c:123]\n print_report() [mm/kasan/report.c:379 mm/kasan/report.c:482]\n kasan_report() [mm/kasan/report.c:597]\n rxgk_verify_response()\n [net/rxrpc/rxgk.c:1103 net/rxrpc/rxgk.c:1167\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n process_one_work() [kernel/workqueue.c:3281]\n worker_thread()\n [kernel/workqueue.c:3353 kernel/workqueue.c:3440]\n kthread() [kernel/kthread.c:436]\n ret_from_fork() [arch/x86/kernel/process.c:164]\n\nAsignado por tarea 54:\n rxgk_verify_response()\n [include/linux/slab.h:954 net/rxrpc/rxgk.c:1155\n net/rxrpc/rxgk.c:1274]\n rxrpc_process_connection()\n [net/rxrpc/conn_event.c:266 net/rxrpc/conn_event.c:364\n net/rxrpc/conn_event.c:386]\n\nConvertir el recuento de bytes a unidades __be32 antes de construir el límite del analizador."}],"id":"CVE-2026-31636","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:42.920","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/20a188775a9a9982d1987e12660d9b44b40a6c99"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3e3138007887504ee9206d0bfb5acb062c600025"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7875f3d9777bd4e9892c4db830571ab8ac2044c0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31637.json b/data/2026/CVE-2026-31637.json index b0fa1fe5d2..64e64970db 100644 --- a/data/2026/CVE-2026-31637.json +++ b/data/2026/CVE-2026-31637.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/rxkad.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"252157d939d179b5d767cb860ff8fa7f8723b67a","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"a75b3b361dd481d942c5f259a82d59718a41092c","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"b3a808cd0790b5075aaa2bc3588edf02cd71d352","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8a","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"a149dcae23309df9de1c3b6b5d468610ef5ab7de","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"22f6258e7b31dba9bf88dce4e3ee7f0f20072e60","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"58fcd1b156152613ba00a064a129fb69507ddd7d","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"fe4447cd95623b1cfacc15f280aab73a6d7340b2","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/rxkad.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CF3437DE-9B4D-4F70-8EDD-552E0695376B","versionEndExcluding":"6.6.135","versionStartIncluding":"2.6.22.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:-:*:*:*:*:*:*","matchCriteriaId":"7F7D6C66-3384-4ACC-9D08-C5A26B4FD004","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: reject undecryptable rxkad response tickets\n\nrxkad_decrypt_ticket() decrypts the RXKAD response ticket and then\nparses the buffer as plaintext without checking whether\ncrypto_skcipher_decrypt() succeeded.\n\nA malformed RESPONSE can therefore use a non-block-aligned ticket\nlength, make the decrypt operation fail, and still drive the ticket\nparser with attacker-controlled bytes.\n\nCheck the decrypt result and abort the connection with RXKADBADTICKET\nwhen ticket decryption fails."}],"id":"CVE-2026-31637","lastModified":"2026-10-19T19:18:02.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31637","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:24.761157Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:43.020","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/22f6258e7b31dba9bf88dce4e3ee7f0f20072e60"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/252157d939d179b5d767cb860ff8fa7f8723b67a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/58fcd1b156152613ba00a064a129fb69507ddd7d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a149dcae23309df9de1c3b6b5d468610ef5ab7de"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a75b3b361dd481d942c5f259a82d59718a41092c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b3a808cd0790b5075aaa2bc3588edf02cd71d352"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fe4447cd95623b1cfacc15f280aab73a6d7340b2"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-754"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/rxkad.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"252157d939d179b5d767cb860ff8fa7f8723b67a","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"a75b3b361dd481d942c5f259a82d59718a41092c","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"b3a808cd0790b5075aaa2bc3588edf02cd71d352","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8a","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"a149dcae23309df9de1c3b6b5d468610ef5ab7de","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"22f6258e7b31dba9bf88dce4e3ee7f0f20072e60","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"58fcd1b156152613ba00a064a129fb69507ddd7d","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"fe4447cd95623b1cfacc15f280aab73a6d7340b2","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/rxkad.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CF3437DE-9B4D-4F70-8EDD-552E0695376B","versionEndExcluding":"6.6.135","versionStartIncluding":"2.6.22.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.22:-:*:*:*:*:*:*","matchCriteriaId":"7F7D6C66-3384-4ACC-9D08-C5A26B4FD004","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: reject undecryptable rxkad response tickets\n\nrxkad_decrypt_ticket() decrypts the RXKAD response ticket and then\nparses the buffer as plaintext without checking whether\ncrypto_skcipher_decrypt() succeeded.\n\nA malformed RESPONSE can therefore use a non-block-aligned ticket\nlength, make the decrypt operation fail, and still drive the ticket\nparser with attacker-controlled bytes.\n\nCheck the decrypt result and abort the connection with RXKADBADTICKET\nwhen ticket decryption fails."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nrxrpc: rechazar tickets de respuesta rxkad indescifrables\n\nrxkad_decrypt_ticket() descifra el ticket de respuesta RXKAD y luego analiza el búfer como texto plano sin comprobar si crypto_skcipher_decrypt() tuvo éxito.\n\nUna RESPUESTA malformada puede, por lo tanto, usar una longitud de ticket no alineada con el bloque, hacer que la operación de descifrado falle y aún así dirigir el analizador de tickets con bytes controlados por el atacante.\n\nComprobar el resultado del descifrado y abortar la conexión con RXKADBADTICKET cuando el descifrado del ticket falla."}],"id":"CVE-2026-31637","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31637","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:24.761157Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:43.020","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/22f6258e7b31dba9bf88dce4e3ee7f0f20072e60"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/252157d939d179b5d767cb860ff8fa7f8723b67a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/47073aab8a3a5a7b41c9bd37d2a3dcbeeccd6c8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/58fcd1b156152613ba00a064a129fb69507ddd7d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a149dcae23309df9de1c3b6b5d468610ef5ab7de"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a75b3b361dd481d942c5f259a82d59718a41092c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b3a808cd0790b5075aaa2bc3588edf02cd71d352"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fe4447cd95623b1cfacc15f280aab73a6d7340b2"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-754"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31638.json b/data/2026/CVE-2026-31638.json index 197e68a168..2b347fa30d 100644 --- a/data/2026/CVE-2026-31638.json +++ b/data/2026/CVE-2026-31638.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/io_thread.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b8f66447448d6c305a51413a67ec8ed26aa7d1dd","status":"affected","version":"5e6ef4f1017c7f844e305283bbd8875af475e2fc","versionType":"git"},{"lessThan":"0c156aff8a2d4fa0d61db7837641975cf0e5452d","status":"affected","version":"5e6ef4f1017c7f844e305283bbd8875af475e2fc","versionType":"git"},{"lessThan":"8299ca146489664e3c0c90a3b8900d8335b1ede4","status":"affected","version":"5e6ef4f1017c7f844e305283bbd8875af475e2fc","versionType":"git"},{"lessThan":"9fb09861e2b8d1abfe2efaf260c9f1d30080ea38","status":"affected","version":"5e6ef4f1017c7f844e305283bbd8875af475e2fc","versionType":"git"},{"lessThan":"6331f1b24a3e85465f6454e003a3e6c22005a5c5","status":"affected","version":"5e6ef4f1017c7f844e305283bbd8875af475e2fc","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/io_thread.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8AD2A-FCEB-42B6-8B79-66822D8E7C37","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*","matchCriteriaId":"3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Only put the call ref if one was acquired\n\nrxrpc_input_packet_on_conn() can process a to-client packet after the\ncurrent client call on the channel has already been torn down. In that\ncase chan->call is NULL, rxrpc_try_get_call() returns NULL and there is\nno reference to drop.\n\nThe client-side implicit-end error path does not account for that and\nunconditionally calls rxrpc_put_call(). This turns a protocol error\npath into a kernel crash instead of rejecting the packet.\n\nOnly drop the call reference if one was actually acquired. Keep the\nexisting protocol error handling unchanged."}],"id":"CVE-2026-31638","lastModified":"2026-10-19T19:18:02.613","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31638","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:27.061889Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:43.127","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c156aff8a2d4fa0d61db7837641975cf0e5452d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6331f1b24a3e85465f6454e003a3e6c22005a5c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8299ca146489664e3c0c90a3b8900d8335b1ede4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9fb09861e2b8d1abfe2efaf260c9f1d30080ea38"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b8f66447448d6c305a51413a67ec8ed26aa7d1dd"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-476"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/io_thread.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b8f66447448d6c305a51413a67ec8ed26aa7d1dd","status":"affected","version":"5e6ef4f1017c7f844e305283bbd8875af475e2fc","versionType":"git"},{"lessThan":"0c156aff8a2d4fa0d61db7837641975cf0e5452d","status":"affected","version":"5e6ef4f1017c7f844e305283bbd8875af475e2fc","versionType":"git"},{"lessThan":"8299ca146489664e3c0c90a3b8900d8335b1ede4","status":"affected","version":"5e6ef4f1017c7f844e305283bbd8875af475e2fc","versionType":"git"},{"lessThan":"9fb09861e2b8d1abfe2efaf260c9f1d30080ea38","status":"affected","version":"5e6ef4f1017c7f844e305283bbd8875af475e2fc","versionType":"git"},{"lessThan":"6331f1b24a3e85465f6454e003a3e6c22005a5c5","status":"affected","version":"5e6ef4f1017c7f844e305283bbd8875af475e2fc","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/io_thread.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8AD2A-FCEB-42B6-8B79-66822D8E7C37","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*","matchCriteriaId":"3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Only put the call ref if one was acquired\n\nrxrpc_input_packet_on_conn() can process a to-client packet after the\ncurrent client call on the channel has already been torn down. In that\ncase chan->call is NULL, rxrpc_try_get_call() returns NULL and there is\nno reference to drop.\n\nThe client-side implicit-end error path does not account for that and\nunconditionally calls rxrpc_put_call(). This turns a protocol error\npath into a kernel crash instead of rejecting the packet.\n\nOnly drop the call reference if one was actually acquired. Keep the\nexisting protocol error handling unchanged."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: Solo liberar la referencia de llamada si se adquirió una\n\nrxrpc_input_packet_on_conn() puede procesar un paquete dirigido al cliente después de que la llamada actual del cliente en el canal ya ha sido terminada. En ese caso, chan -> call es NULL, rxrpc_try_get_call() devuelve NULL y no hay ninguna referencia que liberar.\n\nLa ruta de error de fin implícito del lado del cliente no tiene en cuenta eso y llama incondicionalmente a rxrpc_put_call(). Esto convierte una ruta de error del protocolo en un fallo del kernel en lugar de rechazar el paquete.\n\nSolo liberar la referencia de llamada si se adquirió una realmente. Mantener el manejo de errores del protocolo existente sin cambios."}],"id":"CVE-2026-31638","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31638","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:27.061889Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:43.127","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c156aff8a2d4fa0d61db7837641975cf0e5452d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6331f1b24a3e85465f6454e003a3e6c22005a5c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8299ca146489664e3c0c90a3b8900d8335b1ede4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9fb09861e2b8d1abfe2efaf260c9f1d30080ea38"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b8f66447448d6c305a51413a67ec8ed26aa7d1dd"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-476"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31639.json b/data/2026/CVE-2026-31639.json index 35b838618f..a4649387b5 100644 --- a/data/2026/CVE-2026-31639.json +++ b/data/2026/CVE-2026-31639.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/call_object.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f1a7a3ab0f35f83cf11bba906b9e948cf3788c28","status":"affected","version":"f3441d4125fc98995858550a5521b8d7daf0504a","versionType":"git"},{"lessThan":"e6b7943c5dc875647499da09bf4d50a8557ab0c3","status":"affected","version":"f3441d4125fc98995858550a5521b8d7daf0504a","versionType":"git"},{"lessThan":"2e6ef713b1598f6acd7f302fa6b12b6731c89914","status":"affected","version":"f3441d4125fc98995858550a5521b8d7daf0504a","versionType":"git"},{"lessThan":"978108902ee4ef2b348ff7ec36ad014dc5bc6dc6","status":"affected","version":"f3441d4125fc98995858550a5521b8d7daf0504a","versionType":"git"},{"lessThan":"d666540d217e8d420544ebdfbadeedd623562733","status":"affected","version":"f3441d4125fc98995858550a5521b8d7daf0504a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/call_object.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8AD2A-FCEB-42B6-8B79-66822D8E7C37","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*","matchCriteriaId":"3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix key reference count leak from call->key\n\nWhen creating a client call in rxrpc_alloc_client_call(), the code obtains\na reference to the key. This is never cleaned up and gets leaked when the\ncall is destroyed.\n\nFix this by freeing call->key in rxrpc_destroy_call().\n\nBefore the patch, it shows the key reference counter elevated:\n\n$ cat /proc/keys | grep afs@54321\n1bffe9cd I--Q--i 8053480 4169w 3b010000 1000 1000 rxrpc afs@54321: ka\n$\n\nAfter the patch, the invalidated key is removed when the code exits:\n\n$ cat /proc/keys | grep afs@54321\n$"}],"id":"CVE-2026-31639","lastModified":"2026-11-06T16:18:05.040","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31639","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:18.427651Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:43.240","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e6ef713b1598f6acd7f302fa6b12b6731c89914"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/978108902ee4ef2b348ff7ec36ad014dc5bc6dc6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d666540d217e8d420544ebdfbadeedd623562733"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6b7943c5dc875647499da09bf4d50a8557ab0c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1a7a3ab0f35f83cf11bba906b9e948cf3788c28"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/call_object.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f1a7a3ab0f35f83cf11bba906b9e948cf3788c28","status":"affected","version":"f3441d4125fc98995858550a5521b8d7daf0504a","versionType":"git"},{"lessThan":"e6b7943c5dc875647499da09bf4d50a8557ab0c3","status":"affected","version":"f3441d4125fc98995858550a5521b8d7daf0504a","versionType":"git"},{"lessThan":"2e6ef713b1598f6acd7f302fa6b12b6731c89914","status":"affected","version":"f3441d4125fc98995858550a5521b8d7daf0504a","versionType":"git"},{"lessThan":"978108902ee4ef2b348ff7ec36ad014dc5bc6dc6","status":"affected","version":"f3441d4125fc98995858550a5521b8d7daf0504a","versionType":"git"},{"lessThan":"d666540d217e8d420544ebdfbadeedd623562733","status":"affected","version":"f3441d4125fc98995858550a5521b8d7daf0504a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/call_object.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8AD2A-FCEB-42B6-8B79-66822D8E7C37","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*","matchCriteriaId":"3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix key reference count leak from call->key\n\nWhen creating a client call in rxrpc_alloc_client_call(), the code obtains\na reference to the key. This is never cleaned up and gets leaked when the\ncall is destroyed.\n\nFix this by freeing call->key in rxrpc_destroy_call().\n\nBefore the patch, it shows the key reference counter elevated:\n\n$ cat /proc/keys | grep afs@54321\n1bffe9cd I--Q--i 8053480 4169w 3b010000 1000 1000 rxrpc afs@54321: ka\n$\n\nAfter the patch, the invalidated key is removed when the code exits:\n\n$ cat /proc/keys | grep afs@54321\n$"},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nrxrpc: Corrige la fuga del contador de referencias de clave de call -> key\n\nAl crear una llamada de cliente en rxrpc_alloc_client_call(), el código obtiene una referencia a la clave. Esta nunca se limpia y se fuga cuando se destruye la llamada.\n\nSoluciona esto liberando call -> key en rxrpc_destroy_call().\n\nAntes del parche, muestra el contador de referencias de clave elevado:\n\n$ cat /proc/keys | grep afs@54321\n1bffe9cd I- -Q- -i 8053480 4169w 3b010000 1000 1000 rxrpc afs@54321: ka\n$\n\nDespués del parche, la clave invalidada se elimina cuando el código sale:\n\n$ cat /proc/keys | grep afs@54321\n$"}],"id":"CVE-2026-31639","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31639","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:18.427651Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:43.240","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2e6ef713b1598f6acd7f302fa6b12b6731c89914"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/978108902ee4ef2b348ff7ec36ad014dc5bc6dc6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d666540d217e8d420544ebdfbadeedd623562733"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e6b7943c5dc875647499da09bf4d50a8557ab0c3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f1a7a3ab0f35f83cf11bba906b9e948cf3788c28"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31640.json b/data/2026/CVE-2026-31640.json index d182862695..27e2b89904 100644 --- a/data/2026/CVE-2026-31640.json +++ b/data/2026/CVE-2026-31640.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/trace/events/rxrpc.h","net/rxrpc/conn_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9132b1a7bf83b4a8042fffbc99d075b727a16742","status":"affected","version":"5800b1cf3fd8ccab752a101865be1e76dac33142","versionType":"git"},{"lessThan":"20386e7f8d97475b8d815873e246423317ec4260","status":"affected","version":"5800b1cf3fd8ccab752a101865be1e76dac33142","versionType":"git"},{"lessThan":"b33f5741bb187db8ff32e8f5b96def77cc94dfca","status":"affected","version":"5800b1cf3fd8ccab752a101865be1e76dac33142","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/trace/events/rxrpc.h","net/rxrpc/conn_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix use of wrong skb when comparing queued RESP challenge serial\n\nIn rxrpc_post_response(), the code should be comparing the challenge serial\nnumber from the cached response before deciding to switch to a newer\nresponse, but looks at the newer packet private data instead, rendering the\ncomparison always false.\n\nFix this by switching to look at the older packet.\n\nFix further[1] to substitute the new packet in place of the old one if\nnewer and also to release whichever we don't use."}],"id":"CVE-2026-31640","lastModified":"2026-06-17T10:34:08.743","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:43.357","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/20386e7f8d97475b8d815873e246423317ec4260"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9132b1a7bf83b4a8042fffbc99d075b727a16742"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b33f5741bb187db8ff32e8f5b96def77cc94dfca"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/trace/events/rxrpc.h","net/rxrpc/conn_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9132b1a7bf83b4a8042fffbc99d075b727a16742","status":"affected","version":"5800b1cf3fd8ccab752a101865be1e76dac33142","versionType":"git"},{"lessThan":"20386e7f8d97475b8d815873e246423317ec4260","status":"affected","version":"5800b1cf3fd8ccab752a101865be1e76dac33142","versionType":"git"},{"lessThan":"b33f5741bb187db8ff32e8f5b96def77cc94dfca","status":"affected","version":"5800b1cf3fd8ccab752a101865be1e76dac33142","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/trace/events/rxrpc.h","net/rxrpc/conn_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix use of wrong skb when comparing queued RESP challenge serial\n\nIn rxrpc_post_response(), the code should be comparing the challenge serial\nnumber from the cached response before deciding to switch to a newer\nresponse, but looks at the newer packet private data instead, rendering the\ncomparison always false.\n\nFix this by switching to look at the older packet.\n\nFix further[1] to substitute the new packet in place of the old one if\nnewer and also to release whichever we don't use."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: Corrección del uso de un skb incorrecto al comparar el número de serie de desafío RESP en cola\n\nEn rxrpc_post_response(), el código debería comparar el número de serie de desafío de la respuesta en caché antes de decidir cambiar a una respuesta más reciente, pero en su lugar, examina los datos privados del paquete más reciente, lo que hace que la comparación sea siempre falsa.\n\nEsto se corrige cambiando para examinar el paquete más antiguo.\n\nSe corrige además[1] para sustituir el paquete nuevo en lugar del antiguo si es más reciente y también para liberar el que no utilicemos."}],"id":"CVE-2026-31640","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:43.357","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/20386e7f8d97475b8d815873e246423317ec4260"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9132b1a7bf83b4a8042fffbc99d075b727a16742"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b33f5741bb187db8ff32e8f5b96def77cc94dfca"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31641.json b/data/2026/CVE-2026-31641.json index 84f8a211a2..fcdb9d93df 100644 --- a/data/2026/CVE-2026-31641.json +++ b/data/2026/CVE-2026-31641.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3e04596cba8a86cbff9c3f4bf0a524a3a488773c","status":"affected","version":"0ca100ff4df64f5d0f6c1dd5080c3e096786bea6","versionType":"git"},{"lessThan":"49875b360c2b83a3c226e189c502e501d83e6445","status":"affected","version":"0ca100ff4df64f5d0f6c1dd5080c3e096786bea6","versionType":"git"},{"lessThan":"d179a868dd755b0cfcf7582e00943d702b9943b8","status":"affected","version":"0ca100ff4df64f5d0f6c1dd5080c3e096786bea6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.26.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix RxGK token loading to check bounds\n\nrxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length\nfrom the XDR token as u32 values and passes each through round_up(x, 4)\nbefore using the rounded value for validation and allocation. When the raw\nlength is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and\nkzalloc both use 0 while the subsequent memcpy still copies the original\n~4 GiB value, producing a heap buffer overflow reachable from an\nunprivileged add_key() call.\n\nFix this by:\n\n (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket\n lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with\n the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX.\n\n (2) Sizing the flexible-array allocation from the validated raw key\n length via struct_size_t() instead of the rounded value.\n\n (3) Caching the raw lengths so that the later field assignments and\n memcpy calls do not re-read from the token, eliminating a class of\n TOCTOU re-parse.\n\nThe control path (valid token with lengths within bounds) is unaffected."}],"id":"CVE-2026-31641","lastModified":"2026-08-18T12:18:05.953","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.5,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]},"published":"2026-04-24T15:16:43.463","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3e04596cba8a86cbff9c3f4bf0a524a3a488773c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/49875b360c2b83a3c226e189c502e501d83e6445"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d179a868dd755b0cfcf7582e00943d702b9943b8"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27288"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:55618"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31641"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461548"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31641.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3e04596cba8a86cbff9c3f4bf0a524a3a488773c","status":"affected","version":"0ca100ff4df64f5d0f6c1dd5080c3e096786bea6","versionType":"git"},{"lessThan":"49875b360c2b83a3c226e189c502e501d83e6445","status":"affected","version":"0ca100ff4df64f5d0f6c1dd5080c3e096786bea6","versionType":"git"},{"lessThan":"d179a868dd755b0cfcf7582e00943d702b9943b8","status":"affected","version":"0ca100ff4df64f5d0f6c1dd5080c3e096786bea6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.26.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"unaffected","packageName":"kpatch-patch","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix RxGK token loading to check bounds\n\nrxrpc_preparse_xdr_yfs_rxgk() reads the raw key length and ticket length\nfrom the XDR token as u32 values and passes each through round_up(x, 4)\nbefore using the rounded value for validation and allocation. When the raw\nlength is >= 0xfffffffd, round_up() wraps to 0, so the bounds check and\nkzalloc both use 0 while the subsequent memcpy still copies the original\n~4 GiB value, producing a heap buffer overflow reachable from an\nunprivileged add_key() call.\n\nFix this by:\n\n (1) Rejecting raw key lengths above AFSTOKEN_GK_KEY_MAX and raw ticket\n lengths above AFSTOKEN_GK_TOKEN_MAX before rounding, consistent with\n the caps that the RxKAD path already enforces via AFSTOKEN_RK_TIX_MAX.\n\n (2) Sizing the flexible-array allocation from the validated raw key\n length via struct_size_t() instead of the rounded value.\n\n (3) Caching the raw lengths so that the later field assignments and\n memcpy calls do not re-read from the token, eliminating a class of\n TOCTOU re-parse.\n\nThe control path (valid token with lengths within bounds) is unaffected."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: rxrpc: Solución para la carga de tokens RxGK para verificar los límites rxrpc_preparse_xdr_yfs_rxgk() lee la longitud de clave sin procesar y la longitud de ticket del token XDR como valores u32 y pasa cada uno a través de round_up(x, 4) antes de usar el valor redondeado para validación y asignación. Cuando la longitud sin procesar es mayor o igual que 0x fffffffd, round_up() se ajusta a 0, por lo que la verificación de límites y kzalloc usan 0 mientras que el memcpy posterior aún copia el valor original de ~4 GiB, produciendo un desbordamiento de búfer de pila alcanzable desde una llamada add_key() no privilegiada. Esto se soluciona mediante: (1) Rechazando longitudes de clave sin procesar superiores a AFSTOKEN_GK_KEY_MAX y longitudes de ticket sin procesar superiores a AFSTOKEN_GK_TOKEN_MAX antes del redondeo, consistente con los límites que la ruta RxKAD ya impone a través de AFSTOKEN_RK_TIX_MAX. (2) Dimensionando la asignación de array flexible a partir de la longitud de clave sin procesar validada a través de struct_size_t() en lugar del valor redondeado. (3) Almacenando en caché las longitudes sin procesar para que las asignaciones de campo posteriores y las llamadas memcpy no vuelvan a leer del token, eliminando una clase de re-análisis TOCTOU. La ruta de control (token válido con longitudes dentro de los límites) no se ve afectada."}],"id":"CVE-2026-31641","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.5,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]},"published":"2026-04-24T15:16:43.463","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3e04596cba8a86cbff9c3f4bf0a524a3a488773c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/49875b360c2b83a3c226e189c502e501d83e6445"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d179a868dd755b0cfcf7582e00943d702b9943b8"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:27288"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:55618"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31641"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461548"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31641.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31642.json b/data/2026/CVE-2026-31642.json index b25160fc81..48cdcdc0cb 100644 --- a/data/2026/CVE-2026-31642.json +++ b/data/2026/CVE-2026-31642.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/trace/events/rxrpc.h","net/rxrpc/call_object.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3e47a38e584b905359fe0ce5be5165d1e8592a90","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"b15b1ce96777b88989a6a4de8d01efbcd81ad2d7","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"280efb85e9759881a9d31d0874baa04583cb6c09","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"93fc15be44a35b8e3c58d0238ac0d9b7c53465ff","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"c63abf25203b50243fe228090526f9dbf37727bd","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"3be718f659683ad89fad6f1eb66bee99727cae64","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"ac5f54691be06a32246179d41be2d73598036deb","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"146d4ab94cf129ee06cd467cb5c71368a6b5bad6","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/trace/events/rxrpc.h","net/rxrpc/call_object.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.13"},{"lessThan":"4.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36F24990-3D13-46FD-890A-DD2DC4FCEF1C","versionEndExcluding":"6.6.135","versionStartIncluding":"4.13.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.13:-:*:*:*:*:*:*","matchCriteriaId":"40253A59-8422-42B7-B45F-FF9C4A824F3E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix call removal to use RCU safe deletion\n\nFix rxrpc call removal from the rxnet->calls list to use list_del_rcu()\nrather than list_del_init() to prevent stuffing up reading\n/proc/net/rxrpc/calls from potentially getting into an infinite loop.\n\nThis, however, means that list_empty() no longer works on an entry that's\nbeen deleted from the list, making it harder to detect prior deletion. Fix\nthis by:\n\nFirstly, make rxrpc_destroy_all_calls() only dump the first ten calls that\nare unexpectedly still on the list. Limiting the number of steps means\nthere's no need to call cond_resched() or to remove calls from the list\nhere, thereby eliminating the need for rxrpc_put_call() to check for that.\n\nrxrpc_put_call() can then be fixed to unconditionally delete the call from\nthe list as it is the only place that the deletion occurs."}],"id":"CVE-2026-31642","lastModified":"2026-11-06T16:18:05.400","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31642","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:22.714337Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:43.567","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/146d4ab94cf129ee06cd467cb5c71368a6b5bad6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/280efb85e9759881a9d31d0874baa04583cb6c09"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3be718f659683ad89fad6f1eb66bee99727cae64"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3e47a38e584b905359fe0ce5be5165d1e8592a90"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/93fc15be44a35b8e3c58d0238ac0d9b7c53465ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac5f54691be06a32246179d41be2d73598036deb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b15b1ce96777b88989a6a4de8d01efbcd81ad2d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c63abf25203b50243fe228090526f9dbf37727bd"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/trace/events/rxrpc.h","net/rxrpc/call_object.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3e47a38e584b905359fe0ce5be5165d1e8592a90","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"b15b1ce96777b88989a6a4de8d01efbcd81ad2d7","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"280efb85e9759881a9d31d0874baa04583cb6c09","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"93fc15be44a35b8e3c58d0238ac0d9b7c53465ff","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"c63abf25203b50243fe228090526f9dbf37727bd","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"3be718f659683ad89fad6f1eb66bee99727cae64","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"ac5f54691be06a32246179d41be2d73598036deb","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"},{"lessThan":"146d4ab94cf129ee06cd467cb5c71368a6b5bad6","status":"affected","version":"2baec2c3f854d1f79c7bb28386484e144e864a14","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/trace/events/rxrpc.h","net/rxrpc/call_object.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.13"},{"lessThan":"4.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36F24990-3D13-46FD-890A-DD2DC4FCEF1C","versionEndExcluding":"6.6.135","versionStartIncluding":"4.13.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.13:-:*:*:*:*:*:*","matchCriteriaId":"40253A59-8422-42B7-B45F-FF9C4A824F3E","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix call removal to use RCU safe deletion\n\nFix rxrpc call removal from the rxnet->calls list to use list_del_rcu()\nrather than list_del_init() to prevent stuffing up reading\n/proc/net/rxrpc/calls from potentially getting into an infinite loop.\n\nThis, however, means that list_empty() no longer works on an entry that's\nbeen deleted from the list, making it harder to detect prior deletion. Fix\nthis by:\n\nFirstly, make rxrpc_destroy_all_calls() only dump the first ten calls that\nare unexpectedly still on the list. Limiting the number of steps means\nthere's no need to call cond_resched() or to remove calls from the list\nhere, thereby eliminating the need for rxrpc_put_call() to check for that.\n\nrxrpc_put_call() can then be fixed to unconditionally delete the call from\nthe list as it is the only place that the deletion occurs."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: Corrección de la eliminación de llamadas para usar la eliminación segura de RCU\n\nCorrige la eliminación de llamadas rxrpc de la lista rxnet -> calls para usar list_del_rcu() en lugar de list_del_init() para evitar que la lectura de /proc/ net/rxrpc/calls se atasque y potencialmente entre en un bucle infinito.\n\nEsto, sin embargo, significa que list_empty() ya no funciona en una entrada que ha sido eliminada de la lista, lo que dificulta la detección de una eliminación previa. Soluciona esto mediante:\n\nEn primer lugar, haz que rxrpc_destroy_all_calls() solo vuelque las primeras diez llamadas que inesperadamente aún están en la lista. Limitar el número de pasos significa que no es necesario llamar a cond_resched() o eliminar llamadas de la lista aquí, eliminando así la necesidad de que rxrpc_put_call() lo compruebe.\n\nrxrpc_put_call() puede entonces ser corregido para eliminar incondicionalmente la llamada de la lista, ya que es el único lugar donde ocurre la eliminación."}],"id":"CVE-2026-31642","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31642","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:22.714337Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:43.567","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/146d4ab94cf129ee06cd467cb5c71368a6b5bad6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/280efb85e9759881a9d31d0874baa04583cb6c09"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3be718f659683ad89fad6f1eb66bee99727cae64"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3e47a38e584b905359fe0ce5be5165d1e8592a90"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/93fc15be44a35b8e3c58d0238ac0d9b7c53465ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac5f54691be06a32246179d41be2d73598036deb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b15b1ce96777b88989a6a4de8d01efbcd81ad2d7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c63abf25203b50243fe228090526f9dbf37727bd"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-835"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31643.json b/data/2026/CVE-2026-31643.json index 9aad741e96..b01b4754c1 100644 --- a/data/2026/CVE-2026-31643.json +++ b/data/2026/CVE-2026-31643.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d5f76f812d2c0ea6dd651b0586be49e85ecca085","status":"affected","version":"0ca100ff4df64f5d0f6c1dd5080c3e096786bea6","versionType":"git"},{"lessThan":"01f51318feb626deee1d0c8a190198cd7857d599","status":"affected","version":"0ca100ff4df64f5d0f6c1dd5080c3e096786bea6","versionType":"git"},{"lessThan":"b555912b9b21075e8298015f888ffe3ff60b1a97","status":"affected","version":"0ca100ff4df64f5d0f6c1dd5080c3e096786bea6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix key parsing memleak\n\nIn rxrpc_preparse_xdr_yfs_rxgk(), the memory attached to token->rxgk can be\nleaked in a few error paths after it's allocated.\n\nFix this by freeing it in the \"reject_token:\" case."}],"id":"CVE-2026-31643","lastModified":"2026-06-17T10:34:09.090","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:43.673","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/01f51318feb626deee1d0c8a190198cd7857d599"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b555912b9b21075e8298015f888ffe3ff60b1a97"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5f76f812d2c0ea6dd651b0586be49e85ecca085"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d5f76f812d2c0ea6dd651b0586be49e85ecca085","status":"affected","version":"0ca100ff4df64f5d0f6c1dd5080c3e096786bea6","versionType":"git"},{"lessThan":"01f51318feb626deee1d0c8a190198cd7857d599","status":"affected","version":"0ca100ff4df64f5d0f6c1dd5080c3e096786bea6","versionType":"git"},{"lessThan":"b555912b9b21075e8298015f888ffe3ff60b1a97","status":"affected","version":"0ca100ff4df64f5d0f6c1dd5080c3e096786bea6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/key.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EAE31F43-AAC5-4801-B2B2-119D62A532A2","versionEndExcluding":"6.18.23","versionStartIncluding":"6.16.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*","matchCriteriaId":"6238B17D-C12B-458F-A138-97039BFC4595","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix key parsing memleak\n\nIn rxrpc_preparse_xdr_yfs_rxgk(), the memory attached to token->rxgk can be\nleaked in a few error paths after it's allocated.\n\nFix this by freeing it in the \"reject_token:\" case."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: Solución a la fuga de memoria en el análisis de claves\n\nEn rxrpc_preparse_xdr_yfs_rxgk(), la memoria adjunta a token -> rxgk puede fugarse en algunas rutas de error después de ser asignada.\n\nEsto se soluciona liberándola en el caso ’reject_token:’."}],"id":"CVE-2026-31643","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:43.673","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/01f51318feb626deee1d0c8a190198cd7857d599"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b555912b9b21075e8298015f888ffe3ff60b1a97"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5f76f812d2c0ea6dd651b0586be49e85ecca085"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31644.json b/data/2026/CVE-2026-31644.json index a8b43c9b65..5c856b0cb2 100644 --- a/data/2026/CVE-2026-31644.json +++ b/data/2026/CVE-2026-31644.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"691082c0b93c13a5e068c0905f673060bddc204e","status":"affected","version":"89ba464fcf548d64bc7215dfe769f791330ae8b6","versionType":"git"},{"lessThan":"92a673019943770930e2a8bfd52e1aad47a1fc1f","status":"affected","version":"89ba464fcf548d64bc7215dfe769f791330ae8b6","versionType":"git"},{"lessThan":"9950e9199b3dfdfbde0b8d96ba947d7b11243801","status":"affected","version":"89ba464fcf548d64bc7215dfe769f791330ae8b6","versionType":"git"},{"lessThan":"59c3d55a946cacdb4181600723c20ac4f4c20c84","status":"affected","version":"89ba464fcf548d64bc7215dfe769f791330ae8b6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36D94B3B-76E2-4F07-B407-336CB238EB63","versionEndExcluding":"6.12.82","versionStartIncluding":"6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.12:-:*:*:*:*:*:*","matchCriteriaId":"0E698080-7669-4132-8817-4C674EEBCE54","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix use-after-free and leak in lan966x_fdma_reload()\n\nWhen lan966x_fdma_reload() fails to allocate new RX buffers, the restore\npath restarts DMA using old descriptors whose pages were already freed\nvia lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can\nrelease pages back to the buddy allocator, the hardware may DMA into\nmemory now owned by other kernel subsystems.\n\nAdditionally, on the restore path, the newly created page pool (if\nallocation partially succeeded) is overwritten without being destroyed,\nleaking it.\n\nFix both issues by deferring the release of old pages until after the\nnew allocation succeeds. Save the old page array before the allocation\nso old pages can be freed on the success path. On the failure path, the\nold descriptors, pages and page pool are all still valid, making the\nrestore safe. Also ensure the restore path re-enables NAPI and wakes\nthe netdev, matching the success path."}],"id":"CVE-2026-31644","lastModified":"2026-06-17T10:34:09.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:43.770","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/59c3d55a946cacdb4181600723c20ac4f4c20c84"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/691082c0b93c13a5e068c0905f673060bddc204e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/92a673019943770930e2a8bfd52e1aad47a1fc1f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9950e9199b3dfdfbde0b8d96ba947d7b11243801"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"691082c0b93c13a5e068c0905f673060bddc204e","status":"affected","version":"89ba464fcf548d64bc7215dfe769f791330ae8b6","versionType":"git"},{"lessThan":"92a673019943770930e2a8bfd52e1aad47a1fc1f","status":"affected","version":"89ba464fcf548d64bc7215dfe769f791330ae8b6","versionType":"git"},{"lessThan":"9950e9199b3dfdfbde0b8d96ba947d7b11243801","status":"affected","version":"89ba464fcf548d64bc7215dfe769f791330ae8b6","versionType":"git"},{"lessThan":"59c3d55a946cacdb4181600723c20ac4f4c20c84","status":"affected","version":"89ba464fcf548d64bc7215dfe769f791330ae8b6","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36D94B3B-76E2-4F07-B407-336CB238EB63","versionEndExcluding":"6.12.82","versionStartIncluding":"6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.12:-:*:*:*:*:*:*","matchCriteriaId":"0E698080-7669-4132-8817-4C674EEBCE54","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix use-after-free and leak in lan966x_fdma_reload()\n\nWhen lan966x_fdma_reload() fails to allocate new RX buffers, the restore\npath restarts DMA using old descriptors whose pages were already freed\nvia lan966x_fdma_rx_free_pages(). Since page_pool_put_full_page() can\nrelease pages back to the buddy allocator, the hardware may DMA into\nmemory now owned by other kernel subsystems.\n\nAdditionally, on the restore path, the newly created page pool (if\nallocation partially succeeded) is overwritten without being destroyed,\nleaking it.\n\nFix both issues by deferring the release of old pages until after the\nnew allocation succeeds. Save the old page array before the allocation\nso old pages can be freed on the success path. On the failure path, the\nold descriptors, pages and page pool are all still valid, making the\nrestore safe. Also ensure the restore path re-enables NAPI and wakes\nthe netdev, matching the success path."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: lan966x: soluciona el uso después de liberación y la fuga en lan966x_fdma_reload()\n\nCuando lan966x_fdma_reload() falla al asignar nuevos búferes RX, la ruta de restauración reinicia el DMA usando descriptores antiguos cuyas páginas ya fueron liberadas a través de lan966x_fdma_rx_free_pages(). Dado que page_pool_put_full_page() puede liberar páginas de vuelta al asignador buddy, el hardware puede realizar DMA en memoria ahora propiedad de otros subsistemas del kernel.\n\nAdemás, en la ruta de restauración, el pool de páginas recién creado (si la asignación tuvo éxito parcialmente) es sobrescrito sin ser destruido, provocando su fuga.\n\nSoluciona ambos problemas posponiendo la liberación de páginas antiguas hasta después de que la nueva asignación tenga éxito. Guarda el array de páginas antiguas antes de la asignación para que las páginas antiguas puedan ser liberadas en la ruta de éxito. En la ruta de fallo, los descriptores antiguos, las páginas y el pool de páginas siguen siendo todos válidos, haciendo que la restauración sea segura. También asegura que la ruta de restauración vuelva a habilitar NAPI y despierte el netdev, coincidiendo con la ruta de éxito."}],"id":"CVE-2026-31644","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-24T15:16:43.770","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/59c3d55a946cacdb4181600723c20ac4f4c20c84"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/691082c0b93c13a5e068c0905f673060bddc204e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/92a673019943770930e2a8bfd52e1aad47a1fc1f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9950e9199b3dfdfbde0b8d96ba947d7b11243801"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31645.json b/data/2026/CVE-2026-31645.json index f332de31c1..ccc43a7a5d 100644 --- a/data/2026/CVE-2026-31645.json +++ b/data/2026/CVE-2026-31645.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a229a4dc87302fa131f3394b09b0efd8c255a5ac","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"73e940c4249dc5ec6422d1fae535d192fb125955","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"22e1ee9f22b5c3bb702bb6d4167d770002a85b2b","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"4941e234cfd67ac911fb259642b453f9f76aac41","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"076344a6ad9d1308faaed1402fdcfdda68b604ab","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"91AC109E-E13B-4314-992F-122FB084974B","versionEndExcluding":"6.12.82","versionStartIncluding":"6.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*","matchCriteriaId":"3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix page pool leak in error paths\n\nlan966x_fdma_rx_alloc() creates a page pool but does not destroy it if\nthe subsequent fdma_alloc_coherent() call fails, leaking the pool.\n\nSimilarly, lan966x_fdma_init() frees the coherent DMA memory when\nlan966x_fdma_tx_alloc() fails but does not destroy the page pool that\nwas successfully created by lan966x_fdma_rx_alloc(), leaking it.\n\nAdd the missing page_pool_destroy() calls in both error paths."}],"id":"CVE-2026-31645","lastModified":"2026-10-21T13:18:40.777","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:43.873","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/076344a6ad9d1308faaed1402fdcfdda68b604ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/22e1ee9f22b5c3bb702bb6d4167d770002a85b2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4941e234cfd67ac911fb259642b453f9f76aac41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/73e940c4249dc5ec6422d1fae535d192fb125955"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a229a4dc87302fa131f3394b09b0efd8c255a5ac"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a229a4dc87302fa131f3394b09b0efd8c255a5ac","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"73e940c4249dc5ec6422d1fae535d192fb125955","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"22e1ee9f22b5c3bb702bb6d4167d770002a85b2b","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"4941e234cfd67ac911fb259642b453f9f76aac41","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"076344a6ad9d1308faaed1402fdcfdda68b604ab","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"91AC109E-E13B-4314-992F-122FB084974B","versionEndExcluding":"6.12.82","versionStartIncluding":"6.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*","matchCriteriaId":"3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix page pool leak in error paths\n\nlan966x_fdma_rx_alloc() creates a page pool but does not destroy it if\nthe subsequent fdma_alloc_coherent() call fails, leaking the pool.\n\nSimilarly, lan966x_fdma_init() frees the coherent DMA memory when\nlan966x_fdma_tx_alloc() fails but does not destroy the page pool that\nwas successfully created by lan966x_fdma_rx_alloc(), leaking it.\n\nAdd the missing page_pool_destroy() calls in both error paths."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: lan966x: corregir fuga de pool de páginas en rutas de error\n\nlan966x_fdma_rx_alloc() crea un pool de páginas pero no lo destruye si la llamada subsiguiente a fdma_alloc_coherent() falla, fugando el pool.\n\nDe manera similar, lan966x_fdma_init() libera la memoria DMA coherente cuando lan966x_fdma_tx_alloc() falla pero no destruye el pool de páginas que fue creado exitosamente por lan966x_fdma_rx_alloc(), fugándolo.\n\nAñadir las llamadas faltantes a page_pool_destroy() en ambas rutas de error."}],"id":"CVE-2026-31645","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:43.873","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/076344a6ad9d1308faaed1402fdcfdda68b604ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/22e1ee9f22b5c3bb702bb6d4167d770002a85b2b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4941e234cfd67ac911fb259642b453f9f76aac41"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/73e940c4249dc5ec6422d1fae535d192fb125955"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a229a4dc87302fa131f3394b09b0efd8c255a5ac"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31646.json b/data/2026/CVE-2026-31646.json index 14581ee3a6..65027db064 100644 --- a/data/2026/CVE-2026-31646.json +++ b/data/2026/CVE-2026-31646.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e63265f188ea39dcf5f546770650027528f3bd0f","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"305832c53551cfbe6e5b81ca7ee765e60f4fe8e9","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"b5dcb41ba891b55157006cac79825c78a32b409e","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"7caf90d9ab97951a58d1de85ab7e7d7cca7a4513","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"3fd0da4fd8851a7e62d009b7db6c4a05b092bc19","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8AD2A-FCEB-42B6-8B79-66822D8E7C37","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*","matchCriteriaId":"3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()\n\npage_pool_create() can return an ERR_PTR on failure. The return value\nis used unconditionally in the loop that follows, passing the error\npointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(),\nwhich dereferences it, causing a kernel oops.\n\nAdd an IS_ERR check after page_pool_create() to return early on failure."}],"id":"CVE-2026-31646","lastModified":"2026-06-17T10:34:09.407","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:43.967","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/305832c53551cfbe6e5b81ca7ee765e60f4fe8e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3fd0da4fd8851a7e62d009b7db6c4a05b092bc19"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7caf90d9ab97951a58d1de85ab7e7d7cca7a4513"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5dcb41ba891b55157006cac79825c78a32b409e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e63265f188ea39dcf5f546770650027528f3bd0f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e63265f188ea39dcf5f546770650027528f3bd0f","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"305832c53551cfbe6e5b81ca7ee765e60f4fe8e9","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"b5dcb41ba891b55157006cac79825c78a32b409e","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"7caf90d9ab97951a58d1de85ab7e7d7cca7a4513","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"},{"lessThan":"3fd0da4fd8851a7e62d009b7db6c4a05b092bc19","status":"affected","version":"11871aba19748b3387e83a2db6360aa7119e9a1a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.2"},{"lessThan":"6.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8AD2A-FCEB-42B6-8B79-66822D8E7C37","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*","matchCriteriaId":"3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()\n\npage_pool_create() can return an ERR_PTR on failure. The return value\nis used unconditionally in the loop that follows, passing the error\npointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(),\nwhich dereferences it, causing a kernel oops.\n\nAdd an IS_ERR check after page_pool_create() to return early on failure."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: lan966x: corregir el manejo de errores de page_pool en lan966x_fdma_rx_alloc_page_pool()\n\npage_pool_create() puede devolver un ERR_PTR en caso de fallo. El valor de retorno se usa incondicionalmente en el bucle que sigue, pasando el puntero de error a través de xdp_rxq_info_reg_mem_model() a page_pool_use_xdp_mem(), que lo desreferencia, causando un kernel oops.\n\nAñadir una comprobación IS_ERR después de page_pool_create() para retornar anticipadamente en caso de fallo."}],"id":"CVE-2026-31646","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:43.967","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/305832c53551cfbe6e5b81ca7ee765e60f4fe8e9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3fd0da4fd8851a7e62d009b7db6c4a05b092bc19"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7caf90d9ab97951a58d1de85ab7e7d7cca7a4513"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b5dcb41ba891b55157006cac79825c78a32b409e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e63265f188ea39dcf5f546770650027528f3bd0f"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31647.json b/data/2026/CVE-2026-31647.json index d6253f8864..b562f94fbf 100644 --- a/data/2026/CVE-2026-31647.json +++ b/data/2026/CVE-2026-31647.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/intel/idpf/idpf_virtchnl.c","drivers/net/ethernet/intel/idpf/idpf_virtchnl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b448529f2f2921c6fe82fd4e985cc7c05cbf02a3","status":"affected","version":"34c21fa894a1af6166f4284c81d1dc21efed8f38","versionType":"git"},{"lessThan":"e02c974fc331f04b5ba2007d4bc6862df8a43148","status":"affected","version":"34c21fa894a1af6166f4284c81d1dc21efed8f38","versionType":"git"},{"lessThan":"3bb632c6b6d8154e9019beda4a43a4b518ee3e8a","status":"affected","version":"34c21fa894a1af6166f4284c81d1dc21efed8f38","versionType":"git"},{"lessThan":"591478118293c1bd628de330a99eb1eb2ef8d76b","status":"affected","version":"34c21fa894a1af6166f4284c81d1dc21efed8f38","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/intel/idpf/idpf_virtchnl.c","drivers/net/ethernet/intel/idpf/idpf_virtchnl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4A76C099-8DB9-474D-90CA-61674BD1ED6E","versionEndExcluding":"6.12.83","versionStartIncluding":"6.9.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*","matchCriteriaId":"3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling\n\nSwitch from using the completion's raw spinlock to a local lock in the\nidpf_vc_xn struct. The conversion is safe because complete/_all() are\ncalled outside the lock and there is no reason to share the completion\nlock in the current logic. This avoids invalid wait context reported by\nthe kernel due to the async handler taking BH spinlock:\n\n[ 805.726977] =============================\n[ 805.726991] [ BUG: Invalid wait context ]\n[ 805.727006] 7.0.0-rc2-net-devq-031026+ #28 Tainted: G S OE\n[ 805.727026] -----------------------------\n[ 805.727038] kworker/u261:0/572 is trying to lock:\n[ 805.727051] ff190da6a8dbb6a0 (&vport_config->mac_filter_list_lock){+...}-{3:3}, at: idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727099] other info that might help us debug this:\n[ 805.727111] context-{5:5}\n[ 805.727119] 3 locks held by kworker/u261:0/572:\n[ 805.727132] #0: ff190da6db3e6148 ((wq_completion)idpf-0000:83:00.0-mbx){+.+.}-{0:0}, at: process_one_work+0x4b5/0x730\n[ 805.727163] #1: ff3c6f0a6131fe50 ((work_completion)(&(&adapter->mbx_task)->work)){+.+.}-{0:0}, at: process_one_work+0x1e5/0x730\n[ 805.727191] #2: ff190da765190020 (&x->wait#34){+.+.}-{2:2}, at: idpf_recv_mb_msg+0xc8/0x710 [idpf]\n[ 805.727218] stack backtrace:\n...\n[ 805.727238] Workqueue: idpf-0000:83:00.0-mbx idpf_mbx_task [idpf]\n[ 805.727247] Call Trace:\n[ 805.727249] \n[ 805.727251] dump_stack_lvl+0x77/0xb0\n[ 805.727259] __lock_acquire+0xb3b/0x2290\n[ 805.727268] ? __irq_work_queue_local+0x59/0x130\n[ 805.727275] lock_acquire+0xc6/0x2f0\n[ 805.727277] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727284] ? _printk+0x5b/0x80\n[ 805.727290] _raw_spin_lock_bh+0x38/0x50\n[ 805.727298] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727303] idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727310] idpf_recv_mb_msg+0x1c8/0x710 [idpf]\n[ 805.727317] process_one_work+0x226/0x730\n[ 805.727322] worker_thread+0x19e/0x340\n[ 805.727325] ? __pfx_worker_thread+0x10/0x10\n[ 805.727328] kthread+0xf4/0x130\n[ 805.727333] ? __pfx_kthread+0x10/0x10\n[ 805.727336] ret_from_fork+0x32c/0x410\n[ 805.727345] ? __pfx_kthread+0x10/0x10\n[ 805.727347] ret_from_fork_asm+0x1a/0x30\n[ 805.727354] "}],"id":"CVE-2026-31647","lastModified":"2026-11-06T16:18:05.700","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31647","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:26.991090Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:44.073","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3bb632c6b6d8154e9019beda4a43a4b518ee3e8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/591478118293c1bd628de330a99eb1eb2ef8d76b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b448529f2f2921c6fe82fd4e985cc7c05cbf02a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e02c974fc331f04b5ba2007d4bc6862df8a43148"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/intel/idpf/idpf_virtchnl.c","drivers/net/ethernet/intel/idpf/idpf_virtchnl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b448529f2f2921c6fe82fd4e985cc7c05cbf02a3","status":"affected","version":"34c21fa894a1af6166f4284c81d1dc21efed8f38","versionType":"git"},{"lessThan":"e02c974fc331f04b5ba2007d4bc6862df8a43148","status":"affected","version":"34c21fa894a1af6166f4284c81d1dc21efed8f38","versionType":"git"},{"lessThan":"3bb632c6b6d8154e9019beda4a43a4b518ee3e8a","status":"affected","version":"34c21fa894a1af6166f4284c81d1dc21efed8f38","versionType":"git"},{"lessThan":"591478118293c1bd628de330a99eb1eb2ef8d76b","status":"affected","version":"34c21fa894a1af6166f4284c81d1dc21efed8f38","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/intel/idpf/idpf_virtchnl.c","drivers/net/ethernet/intel/idpf/idpf_virtchnl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.9"},{"lessThan":"6.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4A76C099-8DB9-474D-90CA-61674BD1ED6E","versionEndExcluding":"6.12.83","versionStartIncluding":"6.9.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.9:-:*:*:*:*:*:*","matchCriteriaId":"3F2A4A3D-068A-4CF2-A09F-9C7937DDB0A5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling\n\nSwitch from using the completion's raw spinlock to a local lock in the\nidpf_vc_xn struct. The conversion is safe because complete/_all() are\ncalled outside the lock and there is no reason to share the completion\nlock in the current logic. This avoids invalid wait context reported by\nthe kernel due to the async handler taking BH spinlock:\n\n[ 805.726977] =============================\n[ 805.726991] [ BUG: Invalid wait context ]\n[ 805.727006] 7.0.0-rc2-net-devq-031026+ #28 Tainted: G S OE\n[ 805.727026] -----------------------------\n[ 805.727038] kworker/u261:0/572 is trying to lock:\n[ 805.727051] ff190da6a8dbb6a0 (&vport_config->mac_filter_list_lock){+...}-{3:3}, at: idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727099] other info that might help us debug this:\n[ 805.727111] context-{5:5}\n[ 805.727119] 3 locks held by kworker/u261:0/572:\n[ 805.727132] #0: ff190da6db3e6148 ((wq_completion)idpf-0000:83:00.0-mbx){+.+.}-{0:0}, at: process_one_work+0x4b5/0x730\n[ 805.727163] #1: ff3c6f0a6131fe50 ((work_completion)(&(&adapter->mbx_task)->work)){+.+.}-{0:0}, at: process_one_work+0x1e5/0x730\n[ 805.727191] #2: ff190da765190020 (&x->wait#34){+.+.}-{2:2}, at: idpf_recv_mb_msg+0xc8/0x710 [idpf]\n[ 805.727218] stack backtrace:\n...\n[ 805.727238] Workqueue: idpf-0000:83:00.0-mbx idpf_mbx_task [idpf]\n[ 805.727247] Call Trace:\n[ 805.727249] \n[ 805.727251] dump_stack_lvl+0x77/0xb0\n[ 805.727259] __lock_acquire+0xb3b/0x2290\n[ 805.727268] ? __irq_work_queue_local+0x59/0x130\n[ 805.727275] lock_acquire+0xc6/0x2f0\n[ 805.727277] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727284] ? _printk+0x5b/0x80\n[ 805.727290] _raw_spin_lock_bh+0x38/0x50\n[ 805.727298] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727303] idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727310] idpf_recv_mb_msg+0x1c8/0x710 [idpf]\n[ 805.727317] process_one_work+0x226/0x730\n[ 805.727322] worker_thread+0x19e/0x340\n[ 805.727325] ? __pfx_worker_thread+0x10/0x10\n[ 805.727328] kthread+0xf4/0x130\n[ 805.727333] ? __pfx_kthread+0x10/0x10\n[ 805.727336] ret_from_fork+0x32c/0x410\n[ 805.727345] ? __pfx_kthread+0x10/0x10\n[ 805.727347] ret_from_fork_asm+0x1a/0x30\n[ 805.727354] "},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nidpf: corrige el anidamiento de spinlock raw/bh de PREEMPT_RT para el manejo asíncrono de VC\n\nCambia de usar el spinlock raw de la finalización a un bloqueo local en la estructura idpf_vc_xn. La conversión es segura porque complete/_all() se llaman fuera del bloqueo y no hay razón para compartir el bloqueo de finalización en la lógica actual. Esto evita el contexto de espera inválido reportado por el kernel debido a que el gestor asíncrono toma el spinlock BH:\n\n[ 805.726977] =============================\n[ 805.726991] [ BUG: Invalid wait context ]\n[ 805.727006] 7.0.0-rc2-net-devq-031026+ #28 Tainted: G S OE\n[ 805.727026] - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n[ 805.727038] kworker/u261:0/572 is trying to lock:\n[ 805.727051] ff190da6a8dbb6a0 (ref:vport_config -> mac_filter_list_lock){+...}-{3:3}, at: idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727099] other info that might help us debug this:\n[ 805.727111] context-{5:5}\n[ 805.727119] 3 locks held by kworker/u261:0/572:\n[ 805.727132] #0: ff190da6db3e6148 ((wq_completion)idpf-0000:83:00.0-mbx){+.+.}-{0:0}, at: process_one_work+0x4b5/0x730\n[ 805.727163] #1: ff3c6f0a6131fe50 ((work_completion)(&(ref:adapter -> mbx_task) -> work)){+.+.}-{0:0}, at: process_one_work+0x1e5/0x730\n[ 805.727191] #2: ff190da765190020 (&x -> wait#34){+.+.}-{2:2}, at: idpf_recv_mb_msg+0xc8/0x710 [idpf]\n[ 805.727218] stack backtrace:\n...\n[ 805.727238] Workqueue: idpf-0000:83:00.0-mbx idpf_mbx_task [idpf]\n[ 805.727247] Call Trace:\n[ 805.727249] [TASK]\n[ 805.727251] dump_stack_lvl+0x77/0xb0\n[ 805.727259] __lock_acquire+0xb3b/0x 2290\n[ 805.727268] ? __irq_work_queue_local+0x59/0x130\n[ 805.727275] lock_acquire+0xc6/0x2f0\n[ 805.727277] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727284] ? _printk+0x5b/0x80\n[ 805.727290] _raw_spin_lock_bh+0x38/0x50\n[ 805.727298] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727303] idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727310] idpf_recv_mb_msg+0x1c8/0x710 [idpf]\n[ 805.727317] process_one_work+0x226/0x730\n[ 805.727322] worker_thread+0x19e/0x340\n[ 805.727325] ? __pfx_worker_thread+0x10/0x10\n[ 805.727328] kthread+0xf4/0x130\n[ 805.727333] ? __pfx_kthread+0x10/0x10\n[ 805.727336] ret_from_fork+0x32c/0x410\n[ 805.727345] ? __pfx_kthread+0x10/0x10\n[ 805.727347] ret_from_fork_asm+0x1a/0x30\n[ 805.727354] [/TASK]"}],"id":"CVE-2026-31647","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31647","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:26.991090Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:44.073","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3bb632c6b6d8154e9019beda4a43a4b518ee3e8a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/591478118293c1bd628de330a99eb1eb2ef8d76b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b448529f2f2921c6fe82fd4e985cc7c05cbf02a3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e02c974fc331f04b5ba2007d4bc6862df8a43148"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31648.json b/data/2026/CVE-2026-31648.json index 39d7803fdf..1c036897ed 100644 --- a/data/2026/CVE-2026-31648.json +++ b/data/2026/CVE-2026-31648.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/filemap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"88591194df736a508dd5461ab2167a61e98caac1","status":"affected","version":"fe601b70eac6cd266e8d7d55030e90a73ed0e339","versionType":"git"},{"lessThan":"633ab680c405ac390e6bec5b74aaf46197c837b6","status":"affected","version":"743a2753a02e805347969f6f89f38b736850d808","versionType":"git"},{"lessThan":"576543bedd616254032d4ebe54a90076f9e31740","status":"affected","version":"743a2753a02e805347969f6f89f38b736850d808","versionType":"git"},{"lessThan":"9316a820b9aae07d44469d6485376dad824c5b3f","status":"affected","version":"743a2753a02e805347969f6f89f38b736850d808","versionType":"git"},{"lessThan":"f58df566524ebcdfa394329c64f47e3c9257516e","status":"affected","version":"743a2753a02e805347969f6f89f38b736850d808","versionType":"git"},{"status":"affected","version":"84ede15f27c06b111d1398dfa80b6fac4b135e34","versionType":"git"},{"lessThan":"6.6.135","status":"affected","version":"6.6.117","versionType":"semver"},{"lessThan":"6.2","status":"affected","version":"6.1.159","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/filemap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D2FBDB74-1C6D-4EFA-A89D-6D81FE2C56FB","versionEndExcluding":"6.2","versionStartIncluding":"6.1.159","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6D175589-8DDA-429E-9807-0C672E770B50","versionEndExcluding":"6.6.135","versionStartIncluding":"6.6.117","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36D94B3B-76E2-4F07-B407-336CB238EB63","versionEndExcluding":"6.12.82","versionStartIncluding":"6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.12:-:*:*:*:*:*:*","matchCriteriaId":"0E698080-7669-4132-8817-4C674EEBCE54","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: filemap: fix nr_pages calculation overflow in filemap_map_pages()\n\nWhen running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I\nencountered some very strange crash issues showing up as \"Bad page state\":\n\n\"\n[ 734.496287] BUG: Bad page state in process stress-ng-env pfn:415735fb\n[ 734.496427] page: refcount:0 mapcount:1 mapping:0000000000000000 index:0x4cf316 pfn:0x415735fb\n[ 734.496434] flags: 0x57fffe000000800(owner_2|node=1|zone=2|lastcpupid=0x3ffff)\n[ 734.496439] raw: 057fffe000000800 0000000000000000 dead000000000122 0000000000000000\n[ 734.496440] raw: 00000000004cf316 0000000000000000 0000000000000000 0000000000000000\n[ 734.496442] page dumped because: nonzero mapcount\n\"\n\nAfter analyzing this page’s state, it is hard to understand why the\nmapcount is not 0 while the refcount is 0, since this page is not where\nthe issue first occurred. By enabling the CONFIG_DEBUG_VM config, I can\nreproduce the crash as well and captured the first warning where the issue\nappears:\n\n\"\n[ 734.469226] page: refcount:33 mapcount:0 mapping:00000000bef2d187 index:0x81a0 pfn:0x415735c0\n[ 734.469304] head: order:5 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n[ 734.469315] memcg:ffff000807a8ec00\n[ 734.469320] aops:ext4_da_aops ino:100b6f dentry name(?):\"stress-ng-mmaptorture-9397-0-2736200540\"\n[ 734.469335] flags: 0x57fffe400000069(locked|uptodate|lru|head|node=1|zone=2|lastcpupid=0x3ffff)\n......\n[ 734.469364] page dumped because: VM_WARN_ON_FOLIO((_Generic((page + nr_pages - 1),\nconst struct page *: (const struct folio *)_compound_head(page + nr_pages - 1), struct page *:\n(struct folio *)_compound_head(page + nr_pages - 1))) != folio)\n[ 734.469390] ------------[ cut here ]------------\n[ 734.469393] WARNING: ./include/linux/rmap.h:351 at folio_add_file_rmap_ptes+0x3b8/0x468,\nCPU#90: stress-ng-mlock/9430\n[ 734.469551] folio_add_file_rmap_ptes+0x3b8/0x468 (P)\n[ 734.469555] set_pte_range+0xd8/0x2f8\n[ 734.469566] filemap_map_folio_range+0x190/0x400\n[ 734.469579] filemap_map_pages+0x348/0x638\n[ 734.469583] do_fault_around+0x140/0x198\n......\n[ 734.469640] el0t_64_sync+0x184/0x188\n\"\n\nThe code that triggers the warning is: \"VM_WARN_ON_FOLIO(page_folio(page +\nnr_pages - 1) != folio, folio)\", which indicates that set_pte_range()\ntried to map beyond the large folio’s size.\n\nBy adding more debug information, I found that 'nr_pages' had overflowed\nin filemap_map_pages(), causing set_pte_range() to establish mappings for\na range exceeding the folio size, potentially corrupting fields of pages\nthat do not belong to this folio (e.g., page->_mapcount).\n\nAfter above analysis, I think the possible race is as follows:\n\nCPU 0 CPU 1\nfilemap_map_pages() ext4_setattr()\n //get and lock folio with old inode->i_size\n next_uptodate_folio()\n\n .......\n //shrink the inode->i_size\n i_size_write(inode, attr->ia_size);\n\n //calculate the end_pgoff with the new inode->i_size\n file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1;\n end_pgoff = min(end_pgoff, file_end);\n\n ......\n //nr_pages can be overflowed, cause xas.xa_index > end_pgoff\n end = folio_next_index(folio) - 1;\n nr_pages = min(end, end_pgoff) - xas.xa_index + 1;\n\n ......\n //map large folio\n filemap_map_folio_range()\n ......\n //truncate folios\n truncate_pagecache(inode, inode->i_size);\n\nTo fix this issue, move the 'end_pgoff' calculation before\nnext_uptodate_folio(), so the retrieved folio stays consistent with the\nfile end to avoid \n---truncated---"}],"id":"CVE-2026-31648","lastModified":"2026-10-19T19:18:02.773","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31648","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:29.453800Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:44.193","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/576543bedd616254032d4ebe54a90076f9e31740"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/633ab680c405ac390e6bec5b74aaf46197c837b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/88591194df736a508dd5461ab2167a61e98caac1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9316a820b9aae07d44469d6485376dad824c5b3f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f58df566524ebcdfa394329c64f47e3c9257516e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/filemap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"88591194df736a508dd5461ab2167a61e98caac1","status":"affected","version":"fe601b70eac6cd266e8d7d55030e90a73ed0e339","versionType":"git"},{"lessThan":"633ab680c405ac390e6bec5b74aaf46197c837b6","status":"affected","version":"743a2753a02e805347969f6f89f38b736850d808","versionType":"git"},{"lessThan":"576543bedd616254032d4ebe54a90076f9e31740","status":"affected","version":"743a2753a02e805347969f6f89f38b736850d808","versionType":"git"},{"lessThan":"9316a820b9aae07d44469d6485376dad824c5b3f","status":"affected","version":"743a2753a02e805347969f6f89f38b736850d808","versionType":"git"},{"lessThan":"f58df566524ebcdfa394329c64f47e3c9257516e","status":"affected","version":"743a2753a02e805347969f6f89f38b736850d808","versionType":"git"},{"status":"affected","version":"84ede15f27c06b111d1398dfa80b6fac4b135e34","versionType":"git"},{"lessThan":"6.6.135","status":"affected","version":"6.6.117","versionType":"semver"},{"lessThan":"6.2","status":"affected","version":"6.1.159","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/filemap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.12"},{"lessThan":"6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D2FBDB74-1C6D-4EFA-A89D-6D81FE2C56FB","versionEndExcluding":"6.2","versionStartIncluding":"6.1.159","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6D175589-8DDA-429E-9807-0C672E770B50","versionEndExcluding":"6.6.135","versionStartIncluding":"6.6.117","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"36D94B3B-76E2-4F07-B407-336CB238EB63","versionEndExcluding":"6.12.82","versionStartIncluding":"6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.12:-:*:*:*:*:*:*","matchCriteriaId":"0E698080-7669-4132-8817-4C674EEBCE54","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm: filemap: fix nr_pages calculation overflow in filemap_map_pages()\n\nWhen running stress-ng on my Arm64 machine with v7.0-rc3 kernel, I\nencountered some very strange crash issues showing up as \"Bad page state\":\n\n\"\n[ 734.496287] BUG: Bad page state in process stress-ng-env pfn:415735fb\n[ 734.496427] page: refcount:0 mapcount:1 mapping:0000000000000000 index:0x4cf316 pfn:0x415735fb\n[ 734.496434] flags: 0x57fffe000000800(owner_2|node=1|zone=2|lastcpupid=0x3ffff)\n[ 734.496439] raw: 057fffe000000800 0000000000000000 dead000000000122 0000000000000000\n[ 734.496440] raw: 00000000004cf316 0000000000000000 0000000000000000 0000000000000000\n[ 734.496442] page dumped because: nonzero mapcount\n\"\n\nAfter analyzing this page’s state, it is hard to understand why the\nmapcount is not 0 while the refcount is 0, since this page is not where\nthe issue first occurred. By enabling the CONFIG_DEBUG_VM config, I can\nreproduce the crash as well and captured the first warning where the issue\nappears:\n\n\"\n[ 734.469226] page: refcount:33 mapcount:0 mapping:00000000bef2d187 index:0x81a0 pfn:0x415735c0\n[ 734.469304] head: order:5 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n[ 734.469315] memcg:ffff000807a8ec00\n[ 734.469320] aops:ext4_da_aops ino:100b6f dentry name(?):\"stress-ng-mmaptorture-9397-0-2736200540\"\n[ 734.469335] flags: 0x57fffe400000069(locked|uptodate|lru|head|node=1|zone=2|lastcpupid=0x3ffff)\n......\n[ 734.469364] page dumped because: VM_WARN_ON_FOLIO((_Generic((page + nr_pages - 1),\nconst struct page *: (const struct folio *)_compound_head(page + nr_pages - 1), struct page *:\n(struct folio *)_compound_head(page + nr_pages - 1))) != folio)\n[ 734.469390] ------------[ cut here ]------------\n[ 734.469393] WARNING: ./include/linux/rmap.h:351 at folio_add_file_rmap_ptes+0x3b8/0x468,\nCPU#90: stress-ng-mlock/9430\n[ 734.469551] folio_add_file_rmap_ptes+0x3b8/0x468 (P)\n[ 734.469555] set_pte_range+0xd8/0x2f8\n[ 734.469566] filemap_map_folio_range+0x190/0x400\n[ 734.469579] filemap_map_pages+0x348/0x638\n[ 734.469583] do_fault_around+0x140/0x198\n......\n[ 734.469640] el0t_64_sync+0x184/0x188\n\"\n\nThe code that triggers the warning is: \"VM_WARN_ON_FOLIO(page_folio(page +\nnr_pages - 1) != folio, folio)\", which indicates that set_pte_range()\ntried to map beyond the large folio’s size.\n\nBy adding more debug information, I found that 'nr_pages' had overflowed\nin filemap_map_pages(), causing set_pte_range() to establish mappings for\na range exceeding the folio size, potentially corrupting fields of pages\nthat do not belong to this folio (e.g., page->_mapcount).\n\nAfter above analysis, I think the possible race is as follows:\n\nCPU 0 CPU 1\nfilemap_map_pages() ext4_setattr()\n //get and lock folio with old inode->i_size\n next_uptodate_folio()\n\n .......\n //shrink the inode->i_size\n i_size_write(inode, attr->ia_size);\n\n //calculate the end_pgoff with the new inode->i_size\n file_end = DIV_ROUND_UP(i_size_read(mapping->host), PAGE_SIZE) - 1;\n end_pgoff = min(end_pgoff, file_end);\n\n ......\n //nr_pages can be overflowed, cause xas.xa_index > end_pgoff\n end = folio_next_index(folio) - 1;\n nr_pages = min(end, end_pgoff) - xas.xa_index + 1;\n\n ......\n //map large folio\n filemap_map_folio_range()\n ......\n //truncate folios\n truncate_pagecache(inode, inode->i_size);\n\nTo fix this issue, move the 'end_pgoff' calculation before\nnext_uptodate_folio(), so the retrieved folio stays consistent with the\nfile end to avoid \n---truncated---"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: mm: filemap: corrección del desbordamiento de cálculo de nr_pages en filemap_map_pages() Al ejecutar stress-ng en mi máquina Arm64 con el kernel v7.0-rc3, encontré algunos problemas de bloqueo muy extraños que aparecían como ’estado de página incorrecto’: “\n[ 734.496287] BUG: Bad page state in process stress-ng-env pfn:415735fb\n[ 734.496427] page: refcount:0 mapcount:1 mapping:0000000000000000 index:0x 4cf316 pfn:0x 415735fb\n[ 734.496434] flags: 0x 57fffe000000800(owner_2|node=1|zone=2|lastcpupid=0x 3ffff)\n[ 734.496439] raw: 057fffe000000800 0000000000000000 dead000000000122 0000000000000000\n[ 734.496440] raw: 00000000004cf316 0000000000000000 0000000000000000 0000000000000000\n[ 734.496442] page dumped because: nonzero mapcount\n” Después de analizar el estado de esta página, es difícil entender por qué el mapcount no es 0 mientras que el refcount es 0, ya que esta página no es donde el problema ocurrió por primera vez. Al habilitar la configuración CONFIG_DEBUG_VM, también puedo reproducir el bloqueo y capturé la primera advertencia donde aparece el problema: “\n[ 734.469226] page: refcount:33 mapcount:0 mapping:00000000bef2d187 index:0x 81a0 pfn:0x 415735c0\n[ 734.469304] head: order:5 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n[ 734.469315] memcg:ffff000807a8ec00\n[ 734.469320] aops:ext4_da_aops ino:100b6f dentry name(?):”stress-ng-mmaptorture-9397-0-2736200540“\n[ 734.469335] flags: 0x 57fffe400000069(locked|uptodate|lru|head|node=1|zone=2|lastcpupid=0x 3ffff)\n......\n[ 734.469364] page dumped because: VM_WARN_ON_FOLIO((_Generic((page + nr_pages - 1),\nconst struct page *: (const struct folio *)_compound_head(page + nr_pages - 1), struct page *:\n(struct folio *)_compound_head(page + nr_pages - 1))) != folio)\n[ 734.469390] - - - - - - - - - - - -[ cut here ]- - - - - - - - - - - -\n[ 734.469393] WARNING: ./include/linux/rmap.h:351 at folio_add_file_rmap_ptes+0x3b8/0x468,\nCPU#90: stress-ng-mlock/9430\n[ 734.469551] folio_add_file_rmap_ptes+0x3b8/0x468 (P)\n[ 734.469555] set_pte_range+0xd8/0x2f8\n[ 734.469566] filemap_map_folio_range+0x190/0x400\n[ 734.469579] filemap_map_pages+0x348/0x638\n[ 734.469583] do_fault_around+0x140/0x198\n......\n[ 734.469640] el0t_64_sync+0x184/0x188\n” El código que activa la advertencia es: ’VM_WARN_ON_FOLIO(page_folio(page + nr_pages - 1) != folio, folio)’, lo que indica que set_pte_range() intentó mapear más allá del tamaño del folio grande. Al añadir más información de depuración, encontré que ’nr_pages’ había desbordado en filemap_map_pages(), causando que set_pte_range() estableciera mapeos para un rango que excedía el tamaño del folio, potencialmente corrompiendo campos de páginas que no pertenecen a este folio (p. ej., page -> _mapcount). Después del análisis anterior, creo que la posible condición de carrera es la siguiente: CPU 0 CPU 1\nfilemap_map_pages() ext4_setattr() //obtener y bloquear folio con el antiguo inode -> i_size next_uptodate_folio() ....... //reducir el inode -> i_size i_size_write(inode, attr -> ia_size); //calcular el end_pgoff con el nuevo inode -> i_size file_end = DIV_ROUND_UP(i_size_read(mapping -> host), PAGE_SIZE) - 1; end_pgoff = min(end_pgoff, file_end); ...... //nr_pages puede desbordarse, causando xas.xa_index > end_pgoff end = folio_next_index(folio) - 1; nr_pages = min(end, end_pgoff) - xas.xa_index + 1; ...... //mapear folio grande filemap_map_folio_range() ...... //truncar folios truncate_pagecache(inode, inode -> i_size); Para solucionar este problema, mueva el cálculo de ’end_pgoff’ antes de next --TRUNCADO--"}],"id":"CVE-2026-31648","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31648","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:29.453800Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:44.193","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/576543bedd616254032d4ebe54a90076f9e31740"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/633ab680c405ac390e6bec5b74aaf46197c837b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/88591194df736a508dd5461ab2167a61e98caac1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9316a820b9aae07d44469d6485376dad824c5b3f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f58df566524ebcdfa394329c64f47e3c9257516e"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31649.json b/data/2026/CVE-2026-31649.json index bd3a501b5f..d1cff2b02c 100644 --- a/data/2026/CVE-2026-31649.json +++ b/data/2026/CVE-2026-31649.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/stmicro/stmmac/chain_mode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"513e06735f5be575b409d195822195348b164e48","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"275bdf762e82082f064e60a92448fa2ac43cf95b","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"a2b68a9a476b9544ff31f1fbcd5d80867a8a5e2f","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"b7b8012193fd98236d7ae05d4b553f010a77b2ef","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"2c91b39912278d0878f9ba60ba04d2518b18a08d","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"6fca757c20396dc2e604dcc61922264e9e3dc803","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"10d12b9240ebf96c785f0e2e4228318cd5f3a3eb","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"51f4e090b9f87b40c21b6daadb5c06e6c0a07b67","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/stmicro/stmmac/chain_mode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8136AA8-F2F0-4960-9AAF-176AC6ACEA92","versionEndExcluding":"5.10.253","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.2:-:*:*:*:*:*:*","matchCriteriaId":"2BEBAC7C-43AE-4D02-A957-26F89F27E0AC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix integer underflow in chain mode\n\nThe jumbo_frm() chain-mode implementation unconditionally computes\n\n len = nopaged_len - bmax;\n\nwhere nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is\nBUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit()\ndecides to invoke jumbo_frm() based on skb->len (total length including\npage fragments):\n\n is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc);\n\nWhen a packet has a small linear portion (nopaged_len <= bmax) but a\nlarge total length due to page fragments (skb->len > bmax), the\nsubtraction wraps as an unsigned integer, producing a huge len value\n(~0xFFFFxxxx). This causes the while (len != 0) loop to execute\nhundreds of thousands of iterations, passing skb->data + bmax * i\npointers far beyond the skb buffer to dma_map_single(). On IOMMU-less\nSoCs (the typical deployment for stmmac), this maps arbitrary kernel\nmemory to the DMA engine, constituting a kernel memory disclosure and\npotential memory corruption from hardware.\n\nFix this by introducing a buf_len local variable clamped to\nmin(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then\nalways safe: it is zero when the linear portion fits within a single\ndescriptor, causing the while (len != 0) loop to be skipped naturally,\nand the fragment loop in stmmac_xmit() handles page fragments afterward."}],"id":"CVE-2026-31649","lastModified":"2026-11-10T13:19:01.430","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31649","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:32.382744Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:44.330","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10d12b9240ebf96c785f0e2e4228318cd5f3a3eb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/275bdf762e82082f064e60a92448fa2ac43cf95b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c91b39912278d0878f9ba60ba04d2518b18a08d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/513e06735f5be575b409d195822195348b164e48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51f4e090b9f87b40c21b6daadb5c06e6c0a07b67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6fca757c20396dc2e604dcc61922264e9e3dc803"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a2b68a9a476b9544ff31f1fbcd5d80867a8a5e2f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b7b8012193fd98236d7ae05d4b553f010a77b2ef"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/stmicro/stmmac/chain_mode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"513e06735f5be575b409d195822195348b164e48","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"275bdf762e82082f064e60a92448fa2ac43cf95b","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"a2b68a9a476b9544ff31f1fbcd5d80867a8a5e2f","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"b7b8012193fd98236d7ae05d4b553f010a77b2ef","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"2c91b39912278d0878f9ba60ba04d2518b18a08d","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"6fca757c20396dc2e604dcc61922264e9e3dc803","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"10d12b9240ebf96c785f0e2e4228318cd5f3a3eb","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"},{"lessThan":"51f4e090b9f87b40c21b6daadb5c06e6c0a07b67","status":"affected","version":"286a837217204b1ef105e3a554d0757e4fdfaac1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/stmicro/stmmac/chain_mode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8136AA8-F2F0-4960-9AAF-176AC6ACEA92","versionEndExcluding":"5.10.253","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.2:-:*:*:*:*:*:*","matchCriteriaId":"2BEBAC7C-43AE-4D02-A957-26F89F27E0AC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix integer underflow in chain mode\n\nThe jumbo_frm() chain-mode implementation unconditionally computes\n\n len = nopaged_len - bmax;\n\nwhere nopaged_len = skb_headlen(skb) (linear bytes only) and bmax is\nBUF_SIZE_8KiB or BUF_SIZE_2KiB. However, the caller stmmac_xmit()\ndecides to invoke jumbo_frm() based on skb->len (total length including\npage fragments):\n\n is_jumbo = stmmac_is_jumbo_frm(priv, skb->len, enh_desc);\n\nWhen a packet has a small linear portion (nopaged_len <= bmax) but a\nlarge total length due to page fragments (skb->len > bmax), the\nsubtraction wraps as an unsigned integer, producing a huge len value\n(~0xFFFFxxxx). This causes the while (len != 0) loop to execute\nhundreds of thousands of iterations, passing skb->data + bmax * i\npointers far beyond the skb buffer to dma_map_single(). On IOMMU-less\nSoCs (the typical deployment for stmmac), this maps arbitrary kernel\nmemory to the DMA engine, constituting a kernel memory disclosure and\npotential memory corruption from hardware.\n\nFix this by introducing a buf_len local variable clamped to\nmin(nopaged_len, bmax). Computing len = nopaged_len - buf_len is then\nalways safe: it is zero when the linear portion fits within a single\ndescriptor, causing the while (len != 0) loop to be skipped naturally,\nand the fragment loop in stmmac_xmit() handles page fragments afterward."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nnet: stmmac: corrección de subdesbordamiento de enteros en modo cadena\n\nLa implementación en modo cadena de jumbo_frm() calcula incondicionalmente\n\nlen = nopaged_len - bmax;\n\ndonde nopaged_len = skb_headlen(skb) (solo bytes lineales) y bmax es BUF_SIZE_8KiB o BUF_SIZE_2KiB. Sin embargo, la función llamadora stmmac_xmit() decide invocar jumbo_frm() basándose en skb -> len (longitud total incluyendo fragmentos de página):\n\nis_jumbo = stmmac_is_jumbo_frm(priv, skb -> len, enh_desc);\n\nCuando un paquete tiene una pequeña porción lineal (nopaged_len <= bmax) pero una gran longitud total debido a fragmentos de página (skb -> len > bmax), la resta desborda como un entero sin signo, produciendo un valor de len enorme (~0x FFFFxxxx). Esto hace que el bucle while (len != 0) se ejecute cientos de miles de iteraciones, pasando punteros skb -> data + bmax * i mucho más allá del búfer skb a dma_map_single(). En SoCs sin IOMMU (la implementación típica para stmmac), esto mapea memoria arbitraria del kernel al motor DMA, constituyendo una divulgación de memoria del kernel y una potencial corrupción de memoria desde el hardware.\n\nEsto se soluciona introduciendo una variable local buf_len limitada a min(nopaged_len, bmax). Calcular len = nopaged_len - buf_len es entonces siempre seguro: es cero cuando la porción lineal cabe dentro de un solo descriptor, haciendo que el bucle while (len != 0) se omita de forma natural, y el bucle de fragmentos en stmmac_xmit() maneja los fragmentos de página después."}],"id":"CVE-2026-31649","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31649","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:32.382744Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:44.330","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/10d12b9240ebf96c785f0e2e4228318cd5f3a3eb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/275bdf762e82082f064e60a92448fa2ac43cf95b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2c91b39912278d0878f9ba60ba04d2518b18a08d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/513e06735f5be575b409d195822195348b164e48"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51f4e090b9f87b40c21b6daadb5c06e6c0a07b67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6fca757c20396dc2e604dcc61922264e9e3dc803"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a2b68a9a476b9544ff31f1fbcd5d80867a8a5e2f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b7b8012193fd98236d7ae05d4b553f010a77b2ef"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31650.json b/data/2026/CVE-2026-31650.json index b0b68fd1a1..957c36183d 100644 --- a/data/2026/CVE-2026-31650.json +++ b/data/2026/CVE-2026-31650.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mmc/host/vub300.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4b5251eebc2b1dedbb33fedf1b1109fea161b846","status":"affected","version":"117a9c589ce0cf68065c007a02fd94da01e1181a","versionType":"git"},{"lessThan":"ea7468f61be033f4e18b95f2912010ed1d175d75","status":"affected","version":"dcfdd698dc521c6046e9b80c16281575efb25d23","versionType":"git"},{"lessThan":"ef0448c569b37ceabdd038e9faa311e5179127b0","status":"affected","version":"dcfdd698dc521c6046e9b80c16281575efb25d23","versionType":"git"},{"lessThan":"8f4d20a710225ec7a565f6a0459862d3b1f32330","status":"affected","version":"dcfdd698dc521c6046e9b80c16281575efb25d23","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mmc/host/vub300.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0DC92196-2D7B-4F07-A19F-B43E0624C441","versionEndExcluding":"6.18.23","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix use-after-free on disconnect\n\nThe vub300 driver maintains an explicit reference count for the\ncontroller and its driver data and the last reference can in theory be\ndropped after the driver has been unbound.\n\nThis specifically means that the controller allocation must not be\ndevice managed as that can lead to use-after-free.\n\nNote that the lifetime is currently also incorrectly tied the parent USB\ndevice rather than interface, which can lead to memory leaks if the\ndriver is unbound without its device being physically disconnected (e.g.\non probe deferral).\n\nFix both issues by reverting to non-managed allocation of the controller."}],"id":"CVE-2026-31650","lastModified":"2026-10-21T13:18:40.907","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:44.473","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4b5251eebc2b1dedbb33fedf1b1109fea161b846"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f4d20a710225ec7a565f6a0459862d3b1f32330"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea7468f61be033f4e18b95f2912010ed1d175d75"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef0448c569b37ceabdd038e9faa311e5179127b0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mmc/host/vub300.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4b5251eebc2b1dedbb33fedf1b1109fea161b846","status":"affected","version":"117a9c589ce0cf68065c007a02fd94da01e1181a","versionType":"git"},{"lessThan":"ea7468f61be033f4e18b95f2912010ed1d175d75","status":"affected","version":"dcfdd698dc521c6046e9b80c16281575efb25d23","versionType":"git"},{"lessThan":"ef0448c569b37ceabdd038e9faa311e5179127b0","status":"affected","version":"dcfdd698dc521c6046e9b80c16281575efb25d23","versionType":"git"},{"lessThan":"8f4d20a710225ec7a565f6a0459862d3b1f32330","status":"affected","version":"dcfdd698dc521c6046e9b80c16281575efb25d23","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mmc/host/vub300.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0DC92196-2D7B-4F07-A19F-B43E0624C441","versionEndExcluding":"6.18.23","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix use-after-free on disconnect\n\nThe vub300 driver maintains an explicit reference count for the\ncontroller and its driver data and the last reference can in theory be\ndropped after the driver has been unbound.\n\nThis specifically means that the controller allocation must not be\ndevice managed as that can lead to use-after-free.\n\nNote that the lifetime is currently also incorrectly tied the parent USB\ndevice rather than interface, which can lead to memory leaks if the\ndriver is unbound without its device being physically disconnected (e.g.\non probe deferral).\n\nFix both issues by reverting to non-managed allocation of the controller."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmmc: vub300: corregir uso después de liberación al desconectar\n\nEl controlador vub300 mantiene un conteo de referencias explícito para el controlador y sus datos de controlador y la última referencia puede en teoría ser liberada después de que el controlador haya sido desvinculado.\n\nEsto significa específicamente que la asignación del controlador no debe ser gestionada por el dispositivo, ya que eso puede llevar a uso después de liberación.\n\nTenga en cuenta que la vida útil está actualmente también incorrectamente ligada al dispositivo USB padre en lugar de a la interfaz, lo que puede llevar a fugas de memoria si el controlador es desvinculado sin que su dispositivo sea físicamente desconectado (p. ej., en aplazamiento de sondeo).\n\nCorregir ambos problemas revirtiendo a la asignación no gestionada del controlador."}],"id":"CVE-2026-31650","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:44.473","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4b5251eebc2b1dedbb33fedf1b1109fea161b846"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8f4d20a710225ec7a565f6a0459862d3b1f32330"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea7468f61be033f4e18b95f2912010ed1d175d75"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ef0448c569b37ceabdd038e9faa311e5179127b0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31651.json b/data/2026/CVE-2026-31651.json index cce1f4c8c3..1ca8f89295 100644 --- a/data/2026/CVE-2026-31651.json +++ b/data/2026/CVE-2026-31651.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mmc/host/vub300.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6446516e626ce7c44bdadbcbb3d7677a2c52ce93","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"ba3b9429de94958dc0060d9816a915dd75c34919","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"517b58e1d067115f80d198feee10192da4c424d0","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"6468cab1173f44f7a4b7a05ce8abfdfd1ce1557a","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"53f2642d77ab5f1f303388bff5500363c6cf962c","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"c83a282615d8f7ba28cebddd54600b419d562d82","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"8d09e75759cb2afc0732acfb5a14a93c03805a61","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"dff34ef879c5e73298443956a8b391311ba78d57","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mmc/host/vub300.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.0"},{"lessThan":"3.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D9DAAC1B-DEB7-46CC-B206-48044C143468","versionEndExcluding":"5.10.253","versionStartIncluding":"3.0.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.0:-:*:*:*:*:*:*","matchCriteriaId":"2E4912EC-CC92-41CA-A2DA-027291975A84","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix NULL-deref on disconnect\n\nMake sure to deregister the controller before dropping the reference to\nthe driver data on disconnect to avoid NULL-pointer dereferences or\nuse-after-free."}],"id":"CVE-2026-31651","lastModified":"2026-11-10T13:19:01.673","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:44.573","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/517b58e1d067115f80d198feee10192da4c424d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/53f2642d77ab5f1f303388bff5500363c6cf962c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6446516e626ce7c44bdadbcbb3d7677a2c52ce93"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6468cab1173f44f7a4b7a05ce8abfdfd1ce1557a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d09e75759cb2afc0732acfb5a14a93c03805a61"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba3b9429de94958dc0060d9816a915dd75c34919"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c83a282615d8f7ba28cebddd54600b419d562d82"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dff34ef879c5e73298443956a8b391311ba78d57"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/mmc/host/vub300.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"6446516e626ce7c44bdadbcbb3d7677a2c52ce93","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"ba3b9429de94958dc0060d9816a915dd75c34919","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"517b58e1d067115f80d198feee10192da4c424d0","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"6468cab1173f44f7a4b7a05ce8abfdfd1ce1557a","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"53f2642d77ab5f1f303388bff5500363c6cf962c","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"c83a282615d8f7ba28cebddd54600b419d562d82","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"8d09e75759cb2afc0732acfb5a14a93c03805a61","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"},{"lessThan":"dff34ef879c5e73298443956a8b391311ba78d57","status":"affected","version":"88095e7b473a3d9ec3b9c60429576e9cbd327c89","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/mmc/host/vub300.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.0"},{"lessThan":"3.0","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D9DAAC1B-DEB7-46CC-B206-48044C143468","versionEndExcluding":"5.10.253","versionStartIncluding":"3.0.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.0:-:*:*:*:*:*:*","matchCriteriaId":"2E4912EC-CC92-41CA-A2DA-027291975A84","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix NULL-deref on disconnect\n\nMake sure to deregister the controller before dropping the reference to\nthe driver data on disconnect to avoid NULL-pointer dereferences or\nuse-after-free."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmmc: vub300: corregir desreferencia nula al desconectar\n\nAsegúrese de anular el registro del controlador antes de eliminar la referencia a los datos del controlador al desconectar para evitar desreferencias de puntero nulo o uso después de liberación."}],"id":"CVE-2026-31651","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:44.573","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/517b58e1d067115f80d198feee10192da4c424d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/53f2642d77ab5f1f303388bff5500363c6cf962c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6446516e626ce7c44bdadbcbb3d7677a2c52ce93"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6468cab1173f44f7a4b7a05ce8abfdfd1ce1557a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8d09e75759cb2afc0732acfb5a14a93c03805a61"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ba3b9429de94958dc0060d9816a915dd75c34919"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c83a282615d8f7ba28cebddd54600b419d562d82"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/dff34ef879c5e73298443956a8b391311ba78d57"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31652.json b/data/2026/CVE-2026-31652.json index 593cbd9e26..d11c30bf7e 100644 --- a/data/2026/CVE-2026-31652.json +++ b/data/2026/CVE-2026-31652.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/damon/stat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"447f8870b484f6596d7a7130e72bd0a3f1e037bb","status":"affected","version":"405f61996d9d2e9d497cd9f6b66f41dc28d3d1d8","versionType":"git"},{"lessThan":"16c92e9bf55fa049ddb5e894dc0623dacd46a620","status":"affected","version":"405f61996d9d2e9d497cd9f6b66f41dc28d3d1d8","versionType":"git"},{"lessThan":"4c04c6b47c361612b1d70cec8f7a60b1482d1400","status":"affected","version":"405f61996d9d2e9d497cd9f6b66f41dc28d3d1d8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/damon/stat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0DC92196-2D7B-4F07-A19F-B43E0624C441","versionEndExcluding":"6.18.23","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/stat: deallocate damon_call() failure leaking damon_ctx\n\ndamon_stat_start() always allocates the module's damon_ctx object\n(damon_stat_context). Meanwhile, if damon_call() in the function fails,\nthe damon_ctx object is not deallocated. Hence, if the damon_call() is\nfailed, and the user writes Y to “enabled” again, the previously\nallocated damon_ctx object is leaked.\n\nThis cannot simply be fixed by deallocating the damon_ctx object when\ndamon_call() fails. That's because damon_call() failure doesn't guarantee\nthe kdamond main function, which accesses the damon_ctx object, is\ncompletely finished. In other words, if damon_stat_start() deallocates\nthe damon_ctx object after damon_call() failure, the not-yet-terminated\nkdamond could access the freed memory (use-after-free).\n\nFix the leak while avoiding the use-after-free by keeping returning\ndamon_stat_start() without deallocating the damon_ctx object after\ndamon_call() failure, but deallocating it when the function is invoked\nagain and the kdamond is completely terminated. If the kdamond is not yet\nterminated, simply return -EAGAIN, as the kdamond will soon be terminated.\n\nThe issue was discovered [1] by sashiko."}],"id":"CVE-2026-31652","lastModified":"2026-06-17T10:34:10.147","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:44.697","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/16c92e9bf55fa049ddb5e894dc0623dacd46a620"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/447f8870b484f6596d7a7130e72bd0a3f1e037bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c04c6b47c361612b1d70cec8f7a60b1482d1400"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/damon/stat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"447f8870b484f6596d7a7130e72bd0a3f1e037bb","status":"affected","version":"405f61996d9d2e9d497cd9f6b66f41dc28d3d1d8","versionType":"git"},{"lessThan":"16c92e9bf55fa049ddb5e894dc0623dacd46a620","status":"affected","version":"405f61996d9d2e9d497cd9f6b66f41dc28d3d1d8","versionType":"git"},{"lessThan":"4c04c6b47c361612b1d70cec8f7a60b1482d1400","status":"affected","version":"405f61996d9d2e9d497cd9f6b66f41dc28d3d1d8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/damon/stat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0DC92196-2D7B-4F07-A19F-B43E0624C441","versionEndExcluding":"6.18.23","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/stat: deallocate damon_call() failure leaking damon_ctx\n\ndamon_stat_start() always allocates the module's damon_ctx object\n(damon_stat_context). Meanwhile, if damon_call() in the function fails,\nthe damon_ctx object is not deallocated. Hence, if the damon_call() is\nfailed, and the user writes Y to “enabled” again, the previously\nallocated damon_ctx object is leaked.\n\nThis cannot simply be fixed by deallocating the damon_ctx object when\ndamon_call() fails. That's because damon_call() failure doesn't guarantee\nthe kdamond main function, which accesses the damon_ctx object, is\ncompletely finished. In other words, if damon_stat_start() deallocates\nthe damon_ctx object after damon_call() failure, the not-yet-terminated\nkdamond could access the freed memory (use-after-free).\n\nFix the leak while avoiding the use-after-free by keeping returning\ndamon_stat_start() without deallocating the damon_ctx object after\ndamon_call() failure, but deallocating it when the function is invoked\nagain and the kdamond is completely terminated. If the kdamond is not yet\nterminated, simply return -EAGAIN, as the kdamond will soon be terminated.\n\nThe issue was discovered [1] by sashiko."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/damon/stat: desasignar el damon_ctx que se fuga por fallo de damon_call()\n\ndamon_stat_start() siempre asigna el objeto damon_ctx del módulo (damon_stat_context). Mientras tanto, si damon_call() en la función falla, el objeto damon_ctx no es desasignado. Por lo tanto, si damon_call() falla, y el usuario escribe Y en ’enabled’ de nuevo, el objeto damon_ctx previamente asignado se fuga.\n\nEsto no puede ser simplemente corregido desasignando el objeto damon_ctx cuando damon_call() falla. Esto se debe a que el fallo de damon_call() no garantiza que la función principal de kdamond, que accede al objeto damon_ctx, esté completamente terminada. En otras palabras, si damon_stat_start() desasigna el objeto damon_ctx después del fallo de damon_call(), el kdamond aún no terminado podría acceder a la memoria liberada (uso después de liberación).\n\nCorregir la fuga evitando el uso después de liberación, haciendo que damon_stat_start() siga retornando sin desasignar el objeto damon_ctx después del fallo de damon_call(), pero desasignándolo cuando la función es invocada de nuevo y el kdamond está completamente terminado. Si el kdamond aún no está terminado, simplemente retornar -EAGAIN, ya que el kdamond pronto será terminado.\n\nEl problema fue descubierto [1] por sashiko."}],"id":"CVE-2026-31652","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:44.697","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/16c92e9bf55fa049ddb5e894dc0623dacd46a620"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/447f8870b484f6596d7a7130e72bd0a3f1e037bb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c04c6b47c361612b1d70cec8f7a60b1482d1400"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31653.json b/data/2026/CVE-2026-31653.json index 2390ec5b4e..c4a2ac520a 100644 --- a/data/2026/CVE-2026-31653.json +++ b/data/2026/CVE-2026-31653.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b9dadf026a9fb681ed32a0646adc10ab485bf3b1","status":"affected","version":"04a06b139ec08aa63d7377f6d3e5218f8ddb1c5d","versionType":"git"},{"lessThan":"0655f5cf1735508394ef8af98ddcfab3ac1c1cc5","status":"affected","version":"04a06b139ec08aa63d7377f6d3e5218f8ddb1c5d","versionType":"git"},{"lessThan":"0199390a6b92fc21860e1b858abf525c7e73b956","status":"affected","version":"04a06b139ec08aa63d7377f6d3e5218f8ddb1c5d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0DC92196-2D7B-4F07-A19F-B43E0624C441","versionEndExcluding":"6.18.23","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: dealloc repeat_call_control if damon_call() fails\n\ndamon_call() for repeat_call_control of DAMON_SYSFS could fail if somehow\nthe kdamond is stopped before the damon_call(). It could happen, for\nexample, when te damon context was made for monitroing of a virtual\naddress processes, and the process is terminated immediately, before the\ndamon_call() invocation. In the case, the dyanmically allocated\nrepeat_call_control is not deallocated and leaked.\n\nFix the leak by deallocating the repeat_call_control under the\ndamon_call() failure.\n\nThis issue is discovered by sashiko [1]."}],"id":"CVE-2026-31653","lastModified":"2026-06-17T10:34:10.253","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:44.793","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0199390a6b92fc21860e1b858abf525c7e73b956"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0655f5cf1735508394ef8af98ddcfab3ac1c1cc5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b9dadf026a9fb681ed32a0646adc10ab485bf3b1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b9dadf026a9fb681ed32a0646adc10ab485bf3b1","status":"affected","version":"04a06b139ec08aa63d7377f6d3e5218f8ddb1c5d","versionType":"git"},{"lessThan":"0655f5cf1735508394ef8af98ddcfab3ac1c1cc5","status":"affected","version":"04a06b139ec08aa63d7377f6d3e5218f8ddb1c5d","versionType":"git"},{"lessThan":"0199390a6b92fc21860e1b858abf525c7e73b956","status":"affected","version":"04a06b139ec08aa63d7377f6d3e5218f8ddb1c5d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/damon/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0DC92196-2D7B-4F07-A19F-B43E0624C441","versionEndExcluding":"6.18.23","versionStartIncluding":"6.17.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*","matchCriteriaId":"7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/sysfs: dealloc repeat_call_control if damon_call() fails\n\ndamon_call() for repeat_call_control of DAMON_SYSFS could fail if somehow\nthe kdamond is stopped before the damon_call(). It could happen, for\nexample, when te damon context was made for monitroing of a virtual\naddress processes, and the process is terminated immediately, before the\ndamon_call() invocation. In the case, the dyanmically allocated\nrepeat_call_control is not deallocated and leaked.\n\nFix the leak by deallocating the repeat_call_control under the\ndamon_call() failure.\n\nThis issue is discovered by sashiko [1]."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/damon/sysfs: desasigna repeat_call_control si damon_call() falla\n\ndamon_call() para repeat_call_control de DAMON_SYSFS podría fallar si de alguna manera el kdamond se detiene antes de la damon_call(). Podría ocurrir, por ejemplo, cuando el contexto de damon fue creado para la monitorización de procesos de dirección virtual, y el proceso termina inmediatamente, antes de la invocación de damon_call(). En ese caso, el repeat_call_control asignado dinámicamente no es desasignado y se fuga.\n\nSoluciona la fuga desasignando el repeat_call_control en caso de fallo de damon_call().\n\nEste problema es descubierto por sashiko [1]."}],"id":"CVE-2026-31653","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:44.793","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0199390a6b92fc21860e1b858abf525c7e73b956"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0655f5cf1735508394ef8af98ddcfab3ac1c1cc5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b9dadf026a9fb681ed32a0646adc10ab485bf3b1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31654.json b/data/2026/CVE-2026-31654.json index b98431b459..b38c6ea150 100644 --- a/data/2026/CVE-2026-31654.json +++ b/data/2026/CVE-2026-31654.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/vma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"61fc8eaf2ab214b32c7bce52597c80cf0ca41ada","status":"affected","version":"605f6586ecf78395f0185ab24c368fb46a06e434","versionType":"git"},{"lessThan":"894f99eb535edc4514f756818f3c4f688ba53a59","status":"affected","version":"605f6586ecf78395f0185ab24c368fb46a06e434","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/vma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"81C784D8-FFE0-423D-9B8B-CA906B4037AC","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vma: fix memory leak in __mmap_region()\n\ncommit 605f6586ecf7 (\"mm/vma: do not leak memory when .mmap_prepare\nswaps the file\") handled the success path by skipping get_file() via\nfile_doesnt_need_get, but missed the error path.\n\nWhen /dev/zero is mmap'd with MAP_SHARED, mmap_zero_prepare() calls\nshmem_zero_setup_desc() which allocates a new shmem file to back the\nmapping. If __mmap_new_vma() subsequently fails, this replacement\nfile is never fput()'d - the original is released by\nksys_mmap_pgoff(), but nobody releases the new one.\n\nAdd fput() for the swapped file in the error path.\n\nReproducible with fault injection.\n\nFAULT_INJECTION: forcing a failure.\nname failslab, interval 1, probability 0, space 0, times 1\nCPU: 2 UID: 0 PID: 366 Comm: syz.7.14 Not tainted 7.0.0-rc6 #2 PREEMPT(full)\nHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n \n dump_stack_lvl+0x164/0x1f0\n should_fail_ex+0x525/0x650\n should_failslab+0xdf/0x140\n kmem_cache_alloc_noprof+0x78/0x630\n vm_area_alloc+0x24/0x160\n __mmap_region+0xf6b/0x2660\n mmap_region+0x2eb/0x3a0\n do_mmap+0xc79/0x1240\n vm_mmap_pgoff+0x252/0x4c0\n ksys_mmap_pgoff+0xf8/0x120\n __x64_sys_mmap+0x12a/0x190\n do_syscall_64+0xa9/0x580\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n \n\nkmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nBUG: memory leak\nunreferenced object 0xffff8881118aca80 (size 360):\n comm \"syz.7.14\", pid 366, jiffies 4294913255\n hex dump (first 32 bytes):\n 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........\n ff ff ff ff ff ff ff ff c0 28 4d ae ff ff ff ff .........(M.....\n backtrace (crc db0f53bc):\n kmem_cache_alloc_noprof+0x3ab/0x630\n alloc_empty_file+0x5a/0x1e0\n alloc_file_pseudo+0x135/0x220\n __shmem_file_setup+0x274/0x420\n shmem_zero_setup_desc+0x9c/0x170\n mmap_zero_prepare+0x123/0x140\n __mmap_region+0xdda/0x2660\n mmap_region+0x2eb/0x3a0\n do_mmap+0xc79/0x1240\n vm_mmap_pgoff+0x252/0x4c0\n ksys_mmap_pgoff+0xf8/0x120\n __x64_sys_mmap+0x12a/0x190\n do_syscall_64+0xa9/0x580\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFound by syzkaller."}],"id":"CVE-2026-31654","lastModified":"2026-06-17T10:34:10.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:44.890","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/61fc8eaf2ab214b32c7bce52597c80cf0ca41ada"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/894f99eb535edc4514f756818f3c4f688ba53a59"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/vma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"61fc8eaf2ab214b32c7bce52597c80cf0ca41ada","status":"affected","version":"605f6586ecf78395f0185ab24c368fb46a06e434","versionType":"git"},{"lessThan":"894f99eb535edc4514f756818f3c4f688ba53a59","status":"affected","version":"605f6586ecf78395f0185ab24c368fb46a06e434","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/vma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"81C784D8-FFE0-423D-9B8B-CA906B4037AC","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vma: fix memory leak in __mmap_region()\n\ncommit 605f6586ecf7 (\"mm/vma: do not leak memory when .mmap_prepare\nswaps the file\") handled the success path by skipping get_file() via\nfile_doesnt_need_get, but missed the error path.\n\nWhen /dev/zero is mmap'd with MAP_SHARED, mmap_zero_prepare() calls\nshmem_zero_setup_desc() which allocates a new shmem file to back the\nmapping. If __mmap_new_vma() subsequently fails, this replacement\nfile is never fput()'d - the original is released by\nksys_mmap_pgoff(), but nobody releases the new one.\n\nAdd fput() for the swapped file in the error path.\n\nReproducible with fault injection.\n\nFAULT_INJECTION: forcing a failure.\nname failslab, interval 1, probability 0, space 0, times 1\nCPU: 2 UID: 0 PID: 366 Comm: syz.7.14 Not tainted 7.0.0-rc6 #2 PREEMPT(full)\nHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n \n dump_stack_lvl+0x164/0x1f0\n should_fail_ex+0x525/0x650\n should_failslab+0xdf/0x140\n kmem_cache_alloc_noprof+0x78/0x630\n vm_area_alloc+0x24/0x160\n __mmap_region+0xf6b/0x2660\n mmap_region+0x2eb/0x3a0\n do_mmap+0xc79/0x1240\n vm_mmap_pgoff+0x252/0x4c0\n ksys_mmap_pgoff+0xf8/0x120\n __x64_sys_mmap+0x12a/0x190\n do_syscall_64+0xa9/0x580\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n \n\nkmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak)\nBUG: memory leak\nunreferenced object 0xffff8881118aca80 (size 360):\n comm \"syz.7.14\", pid 366, jiffies 4294913255\n hex dump (first 32 bytes):\n 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........\n ff ff ff ff ff ff ff ff c0 28 4d ae ff ff ff ff .........(M.....\n backtrace (crc db0f53bc):\n kmem_cache_alloc_noprof+0x3ab/0x630\n alloc_empty_file+0x5a/0x1e0\n alloc_file_pseudo+0x135/0x220\n __shmem_file_setup+0x274/0x420\n shmem_zero_setup_desc+0x9c/0x170\n mmap_zero_prepare+0x123/0x140\n __mmap_region+0xdda/0x2660\n mmap_region+0x2eb/0x3a0\n do_mmap+0xc79/0x1240\n vm_mmap_pgoff+0x252/0x4c0\n ksys_mmap_pgoff+0xf8/0x120\n __x64_sys_mmap+0x12a/0x190\n do_syscall_64+0xa9/0x580\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFound by syzkaller."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/vma: soluciona fuga de memoria en __mmap_region()\n\nEl commit 605f6586ecf7 (’mm/vma: no filtrar memoria cuando .mmap_prepare intercambia el archivo’) manejó la ruta de éxito al omitir get_file() a través de file_doesnt_need_get, pero omitió la ruta de error.\n\nCuando /dev/zero se mapea con MAP_SHARED, mmap_zero_prepare() llama a shmem_zero_setup_desc() que asigna un nuevo archivo shmem para respaldar el mapeo. Si __mmap_new_vma() falla posteriormente, este archivo de reemplazo nunca se libera con fput(); el original es liberado por ksys_mmap_pgoff(), pero nadie libera el nuevo.\n\nAñadir fput() para el archivo intercambiado en la ruta de error.\n\nReproducible con inyección de fallos.\n\nFAULT_INJECTION: forzando un fallo.\nnombre failslab, intervalo 1, probabilidad 0, espacio 0, veces 1\nCPU: 2 UID: 0 PID: 366 Comm: syz.7.14 Not tainted 7.0.0-rc6 #2 PREEMPT(full)\nNombre del hardware: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRastro de llamada:\n [TASK]\n dump_stack_lvl+0x164/0x1f0\n should_fail_ex+0x525/0x650\n should_failslab+0xdf/0x140\n kmem_cache_alloc_noprof+0x78/0x630\n vm_area_alloc+0x24/0x160\n __mmap_region+0xf6b/0x 2660\n mmap_region+0x2eb/0x3a0\n do_mmap+0xc79/0x 1240\n vm_mmap_pgoff+0x252/0x4c0\n ksys_mmap_pgoff+0xf8/0x120\n __x64_sys_mmap+0x12a/0x190\n do_syscall_64+0xa9/0x580\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n [/TASK]\n\nkmemleak: 1 nueva fuga de memoria sospechosa (ver /sys/kernel/debug/kmemleak)\nERROR: fuga de memoria\nobjeto sin referencia 0x ffff8881118aca80 (tamaño 360):\n comm ’syz.7.14’, pid 366, jiffies 4294913255\n volcado hexadecimal (primeros 32 bytes):\n 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........\n ff ff ff ff ff ff ff ff c0 28 4d ae ff ff ff ff .........(M.....\n rastro de pila (crc db0f53bc):\n kmem_cache_alloc_noprof+0x3ab/0x630\n alloc_empty_file+0x5a/0x1e0\n alloc_file_pseudo+0x135/0x220\n __shmem_file_setup+0x274/0x420\n shmem_zero_setup_desc+0x9c/0x170\n mmap_zero_prepare+0x123/0x140\n __mmap_region+0xdda/0x 2660\n mmap_region+0x2eb/0x3a0\n do_mmap+0xc79/0x 1240\n vm_mmap_pgoff+0x252/0x4c0\n ksys_mmap_pgoff+0xf8/0x120\n __x64_sys_mmap+0x12a/0x190\n do_syscall_64+0xa9/0x580\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nEncontrado por syzkaller."}],"id":"CVE-2026-31654","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:44.890","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/61fc8eaf2ab214b32c7bce52597c80cf0ca41ada"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/894f99eb535edc4514f756818f3c4f688ba53a59"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31655.json b/data/2026/CVE-2026-31655.json index b68c8a12a2..7e98500039 100644 --- a/data/2026/CVE-2026-31655.json +++ b/data/2026/CVE-2026-31655.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pmdomain/imx/imx8mp-blk-ctrl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d215b525ace9af310b26a24232289770d5834dc3","status":"affected","version":"77b0ddb42add47748c661f714e6f4b116a6e8759","versionType":"git"},{"lessThan":"80fd0de89805a3f92dc320f5ab5a18007c260374","status":"affected","version":"77b0ddb42add47748c661f714e6f4b116a6e8759","versionType":"git"},{"lessThan":"3086374e8bc7fd65f2cc62ef52351c6d662f1543","status":"affected","version":"77b0ddb42add47748c661f714e6f4b116a6e8759","versionType":"git"},{"lessThan":"e44919669f07b8f113ad49a248b44ca4f119bc94","status":"affected","version":"77b0ddb42add47748c661f714e6f4b116a6e8759","versionType":"git"},{"lessThan":"d1ef779d02b5df4e8bff4083b20bfea587b43c4b","status":"affected","version":"77b0ddb42add47748c661f714e6f4b116a6e8759","versionType":"git"},{"lessThan":"e91d5f94acf68618ea3ad9c92ac28614e791ae7d","status":"affected","version":"77b0ddb42add47748c661f714e6f4b116a6e8759","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pmdomain/imx/imx8mp-blk-ctrl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.1"},{"lessThan":"6.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"981AB7F8-2AED-47D4-86EA-06AE40304DA5","versionEndExcluding":"6.6.135","versionStartIncluding":"6.1.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.1:-:*:*:*:*:*:*","matchCriteriaId":"DE093B34-F4CD-4052-8122-730D6537A91A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled\n\nKeep the NOC_HDCP clock always enabled to fix the potential hang\ncaused by the NoC ADB400 port power down handshake."}],"id":"CVE-2026-31655","lastModified":"2026-11-06T16:18:05.883","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31655","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:31.738508Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:44.993","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3086374e8bc7fd65f2cc62ef52351c6d662f1543"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/80fd0de89805a3f92dc320f5ab5a18007c260374"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d1ef779d02b5df4e8bff4083b20bfea587b43c4b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d215b525ace9af310b26a24232289770d5834dc3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e44919669f07b8f113ad49a248b44ca4f119bc94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e91d5f94acf68618ea3ad9c92ac28614e791ae7d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pmdomain/imx/imx8mp-blk-ctrl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d215b525ace9af310b26a24232289770d5834dc3","status":"affected","version":"77b0ddb42add47748c661f714e6f4b116a6e8759","versionType":"git"},{"lessThan":"80fd0de89805a3f92dc320f5ab5a18007c260374","status":"affected","version":"77b0ddb42add47748c661f714e6f4b116a6e8759","versionType":"git"},{"lessThan":"3086374e8bc7fd65f2cc62ef52351c6d662f1543","status":"affected","version":"77b0ddb42add47748c661f714e6f4b116a6e8759","versionType":"git"},{"lessThan":"e44919669f07b8f113ad49a248b44ca4f119bc94","status":"affected","version":"77b0ddb42add47748c661f714e6f4b116a6e8759","versionType":"git"},{"lessThan":"d1ef779d02b5df4e8bff4083b20bfea587b43c4b","status":"affected","version":"77b0ddb42add47748c661f714e6f4b116a6e8759","versionType":"git"},{"lessThan":"e91d5f94acf68618ea3ad9c92ac28614e791ae7d","status":"affected","version":"77b0ddb42add47748c661f714e6f4b116a6e8759","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pmdomain/imx/imx8mp-blk-ctrl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.1"},{"lessThan":"6.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"981AB7F8-2AED-47D4-86EA-06AE40304DA5","versionEndExcluding":"6.6.135","versionStartIncluding":"6.1.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.1:-:*:*:*:*:*:*","matchCriteriaId":"DE093B34-F4CD-4052-8122-730D6537A91A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled\n\nKeep the NOC_HDCP clock always enabled to fix the potential hang\ncaused by the NoC ADB400 port power down handshake."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\npmdomain: imx8mp-blk-ctrl: Mantener el reloj NOC_HDCP habilitado\n\nMantener el reloj NOC_HDCP siempre habilitado para solucionar el posible bloqueo causado por el handshake de apagado del puerto NoC ADB400."}],"id":"CVE-2026-31655","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31655","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:31.738508Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:44.993","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3086374e8bc7fd65f2cc62ef52351c6d662f1543"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/80fd0de89805a3f92dc320f5ab5a18007c260374"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d1ef779d02b5df4e8bff4083b20bfea587b43c4b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d215b525ace9af310b26a24232289770d5834dc3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e44919669f07b8f113ad49a248b44ca4f119bc94"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e91d5f94acf68618ea3ad9c92ac28614e791ae7d"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31656.json b/data/2026/CVE-2026-31656.json index a38a79bfd1..f8cffd827f 100644 --- a/data/2026/CVE-2026-31656.json +++ b/data/2026/CVE-2026-31656.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"82034799c6c14b3104668878c3f3e5786f777126","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"70d3e622b10092fc483e28e57b4e8c49d9cc7f68","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"8ce44d28a84fd5e053a88b04872a89d95c0779d4","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"ca3f48c3567dd49efdc55b80029ae74659c682ee","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"a00e92bf6583d019a4fb2c2df7007e6c9b269ce7","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"2af8b200cae3fdd0e917ecc2753b28bb40c876c1","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"455d98ed527fc94eed90406f90ab2391464ca657","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"4c71fd099513bfa8acab529b626e1f0097b76061","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6A1B622D-B57C-432F-A03B-40A25B6C1E06","versionEndExcluding":"5.15.203","versionStartIncluding":"5.5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:*","matchCriteriaId":"EE98F46A-F7D9-4609-B6A0-882E7F0D378C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat\n\nA use-after-free / refcount underflow is possible when the heartbeat\nworker and intel_engine_park_heartbeat() race to release the same\nengine->heartbeat.systole request.\n\nThe heartbeat worker reads engine->heartbeat.systole and calls\ni915_request_put() on it when the request is complete, but clears\nthe pointer in a separate, non-atomic step. Concurrently, a request\nretirement on another CPU can drop the engine wakeref to zero, triggering\n__engine_park() -> intel_engine_park_heartbeat(). If the heartbeat\ntimer is pending at that point, cancel_delayed_work() returns true and\nintel_engine_park_heartbeat() reads the stale non-NULL systole pointer\nand calls i915_request_put() on it again, causing a refcount underflow:\n\n```\n<4> [487.221889] Workqueue: i915-unordered engine_retire [i915]\n<4> [487.222640] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n...\n<4> [487.222707] Call Trace:\n<4> [487.222711] \n<4> [487.222716] intel_engine_park_heartbeat.part.0+0x6f/0x80 [i915]\n<4> [487.223115] intel_engine_park_heartbeat+0x25/0x40 [i915]\n<4> [487.223566] __engine_park+0xb9/0x650 [i915]\n<4> [487.223973] ____intel_wakeref_put_last+0x2e/0xb0 [i915]\n<4> [487.224408] __intel_wakeref_put_last+0x72/0x90 [i915]\n<4> [487.224797] intel_context_exit_engine+0x7c/0x80 [i915]\n<4> [487.225238] intel_context_exit+0xf1/0x1b0 [i915]\n<4> [487.225695] i915_request_retire.part.0+0x1b9/0x530 [i915]\n<4> [487.226178] i915_request_retire+0x1c/0x40 [i915]\n<4> [487.226625] engine_retire+0x122/0x180 [i915]\n<4> [487.227037] process_one_work+0x239/0x760\n<4> [487.227060] worker_thread+0x200/0x3f0\n<4> [487.227068] ? __pfx_worker_thread+0x10/0x10\n<4> [487.227075] kthread+0x10d/0x150\n<4> [487.227083] ? __pfx_kthread+0x10/0x10\n<4> [487.227092] ret_from_fork+0x3d4/0x480\n<4> [487.227099] ? __pfx_kthread+0x10/0x10\n<4> [487.227107] ret_from_fork_asm+0x1a/0x30\n<4> [487.227141] \n```\n\nFix this by replacing the non-atomic pointer read + separate clear with\nxchg() in both racing paths. xchg() is a single indivisible hardware\ninstruction that atomically reads the old pointer and writes NULL. This\nguarantees only one of the two concurrent callers obtains the non-NULL\npointer and performs the put, the other gets NULL and skips it.\n\n(cherry picked from commit 13238dc0ee4f9ab8dafa2cca7295736191ae2f42)"}],"id":"CVE-2026-31656","lastModified":"2026-10-19T19:18:03.193","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31656","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:35.318678Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:45.097","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2af8b200cae3fdd0e917ecc2753b28bb40c876c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/455d98ed527fc94eed90406f90ab2391464ca657"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c71fd099513bfa8acab529b626e1f0097b76061"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70d3e622b10092fc483e28e57b4e8c49d9cc7f68"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/82034799c6c14b3104668878c3f3e5786f777126"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ce44d28a84fd5e053a88b04872a89d95c0779d4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a00e92bf6583d019a4fb2c2df7007e6c9b269ce7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca3f48c3567dd49efdc55b80029ae74659c682ee"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"82034799c6c14b3104668878c3f3e5786f777126","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"70d3e622b10092fc483e28e57b4e8c49d9cc7f68","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"8ce44d28a84fd5e053a88b04872a89d95c0779d4","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"ca3f48c3567dd49efdc55b80029ae74659c682ee","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"a00e92bf6583d019a4fb2c2df7007e6c9b269ce7","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"2af8b200cae3fdd0e917ecc2753b28bb40c876c1","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"455d98ed527fc94eed90406f90ab2391464ca657","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"},{"lessThan":"4c71fd099513bfa8acab529b626e1f0097b76061","status":"affected","version":"058179e72e0956a2dfe4927db6cbe5fbfb2406aa","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/i915/gt/intel_engine_heartbeat.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6A1B622D-B57C-432F-A03B-40A25B6C1E06","versionEndExcluding":"5.15.203","versionStartIncluding":"5.5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:*","matchCriteriaId":"EE98F46A-F7D9-4609-B6A0-882E7F0D378C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat\n\nA use-after-free / refcount underflow is possible when the heartbeat\nworker and intel_engine_park_heartbeat() race to release the same\nengine->heartbeat.systole request.\n\nThe heartbeat worker reads engine->heartbeat.systole and calls\ni915_request_put() on it when the request is complete, but clears\nthe pointer in a separate, non-atomic step. Concurrently, a request\nretirement on another CPU can drop the engine wakeref to zero, triggering\n__engine_park() -> intel_engine_park_heartbeat(). If the heartbeat\ntimer is pending at that point, cancel_delayed_work() returns true and\nintel_engine_park_heartbeat() reads the stale non-NULL systole pointer\nand calls i915_request_put() on it again, causing a refcount underflow:\n\n```\n<4> [487.221889] Workqueue: i915-unordered engine_retire [i915]\n<4> [487.222640] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n...\n<4> [487.222707] Call Trace:\n<4> [487.222711] \n<4> [487.222716] intel_engine_park_heartbeat.part.0+0x6f/0x80 [i915]\n<4> [487.223115] intel_engine_park_heartbeat+0x25/0x40 [i915]\n<4> [487.223566] __engine_park+0xb9/0x650 [i915]\n<4> [487.223973] ____intel_wakeref_put_last+0x2e/0xb0 [i915]\n<4> [487.224408] __intel_wakeref_put_last+0x72/0x90 [i915]\n<4> [487.224797] intel_context_exit_engine+0x7c/0x80 [i915]\n<4> [487.225238] intel_context_exit+0xf1/0x1b0 [i915]\n<4> [487.225695] i915_request_retire.part.0+0x1b9/0x530 [i915]\n<4> [487.226178] i915_request_retire+0x1c/0x40 [i915]\n<4> [487.226625] engine_retire+0x122/0x180 [i915]\n<4> [487.227037] process_one_work+0x239/0x760\n<4> [487.227060] worker_thread+0x200/0x3f0\n<4> [487.227068] ? __pfx_worker_thread+0x10/0x10\n<4> [487.227075] kthread+0x10d/0x150\n<4> [487.227083] ? __pfx_kthread+0x10/0x10\n<4> [487.227092] ret_from_fork+0x3d4/0x480\n<4> [487.227099] ? __pfx_kthread+0x10/0x10\n<4> [487.227107] ret_from_fork_asm+0x1a/0x30\n<4> [487.227141] \n```\n\nFix this by replacing the non-atomic pointer read + separate clear with\nxchg() in both racing paths. xchg() is a single indivisible hardware\ninstruction that atomically reads the old pointer and writes NULL. This\nguarantees only one of the two concurrent callers obtains the non-NULL\npointer and performs the put, the other gets NULL and skips it.\n\n(cherry picked from commit 13238dc0ee4f9ab8dafa2cca7295736191ae2f42)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: drm/i915/gt: corregir desbordamiento negativo de contador de referencias en intel_engine_park_heartbeat Un uso después de liberación / desbordamiento negativo de contador de referencias es posible cuando el worker de heartbeat y intel_engine_park_heartbeat() compiten para liberar la misma solicitud engine -> heartbeat.systole. El worker de heartbeat lee engine -> heartbeat.systole y llama a i915_request_put() sobre ella cuando la solicitud está completa, pero borra el puntero en un paso separado y no atómico. Simultáneamente, una retirada de solicitud en otra CPU puede reducir el wakeref del motor a cero, lo que activa __engine_park() -> intel_engine_park_heartbeat(). Si el temporizador de heartbeat está pendiente en ese momento, cancel_delayed_work() devuelve verdadero e intel_engine_park_heartbeat() lee el puntero systole obsoleto no nulo y llama a i915_request_put() sobre él de nuevo, causando un desbordamiento negativo de contador de referencias: ””“\nmenor que 4> [487.221889] Workqueue: i915-unordered engine_retire [i915]\nmenor que 4> [487.222640] RIP: 0010:refcount_warn_saturate+0x68/0xb0\n...\nmenor que 4> [487.222707] Call Trace:\nmenor que 4> [487.222711] [TASK]\nmenor que 4> [487.222716] intel_engine_park_heartbeat.part.0+0x6f/0x80 [i915]\nmenor que 4> [487.223115] intel_engine_park_heartbeat+0x25/0x40 [i915]\nmenor que 4> [487.223566] __engine_park+0xb9/0x650 [i915]\nmenor que 4> [487.223973] ____intel_wakeref_put_last+0x2e/0xb0 [i915]\nmenor que 4> [487.224408] __intel_wakeref_put_last+0x72/0x90 [i915]\nmenor que 4> [487.224797] intel_context_exit_engine+0x7c/0x80 [i915]\nmenor que 4> [487.225238] intel_context_exit+0xf1/0x1b0 [i915]\nmenor que 4> [487.225695] i915_request_retire.part.0+0x1b9/0x530 [i915]\nmenor que 4> [487.226178] i915_request_retire+0x1c/0x40 [i915]\nmenor que 4> [487.226625] engine_retire+0x122/0x180 [i915]\nmenor que 4> [487.227037] process_one_work+0x239/0x760\nmenor que 4> [487.227060] worker_thread+0x200/0x3f0\nmenor que 4> [487.227068] ? __pfx_worker_thread+0x10/0x10\nmenor que 4> [487.227075] kthread+0x10d/0x150\nmenor que 4> [487.227083] ? __pfx_kthread+0x10/0x10\nmenor que 4> [487.227092] ret_from_fork+0x3d4/0x480\nmenor que 4> [487.227099] ? __pfx_kthread+0x10/0x10\nmenor que 4> [487.227107] ret_from_fork_asm+0x1a/0x30\nmenor que 4> [487.227141] [/TASK]\n””” Solucione esto reemplazando la lectura de puntero no atómica + borrado separado con xchg() en ambas rutas de carrera. xchg() es una única instrucción de hardware indivisible que lee atómicamente el puntero antiguo y escribe NULL. Esto garantiza que solo uno de los dos llamadores concurrentes obtiene el puntero no nulo y realiza el ’put’, el otro obtiene NULL y lo omite. (seleccionado de la confirmación 13238dc0ee4f9ab8dafa2cca7295736191ae2f42)"}],"id":"CVE-2026-31656","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31656","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:35.318678Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:45.097","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2af8b200cae3fdd0e917ecc2753b28bb40c876c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/455d98ed527fc94eed90406f90ab2391464ca657"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4c71fd099513bfa8acab529b626e1f0097b76061"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/70d3e622b10092fc483e28e57b4e8c49d9cc7f68"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/82034799c6c14b3104668878c3f3e5786f777126"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ce44d28a84fd5e053a88b04872a89d95c0779d4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a00e92bf6583d019a4fb2c2df7007e6c9b269ce7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ca3f48c3567dd49efdc55b80029ae74659c682ee"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31657.json b/data/2026/CVE-2026-31657.json index 8a1cc85632..42fb305cc2 100644 --- a/data/2026/CVE-2026-31657.json +++ b/data/2026/CVE-2026-31657.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/batman-adv/bridge_loop_avoidance.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5202f071b367ffbc8e279fc7a00db14f5e587f52","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"69d1ce9c72eca91203ffdb8d08bacd511100aec6","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"f4858832ddef2f39f21e30b7226bbcd3c4b2bc96","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"2f55b58b5a0bbed192d60c444a45a49cdf1b545f","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"7962b522222628596ca9ecc8722efc95367aadbd","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"4dee4c0688443aaf5bbec74aa203c851d1d53c35","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"1f2dc36c297d27733f1b380ea644cf15a361bd7b","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"82d8701b2c930d0e96b0dbc9115a218d791cb0d2","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/batman-adv/bridge_loop_avoidance.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.5"},{"lessThan":"3.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"17B3C5B3-0F63-4D6D-A3AA-C6184C350124","versionEndExcluding":"6.1.169","versionStartIncluding":"3.5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.5:-:*:*:*:*:*:*","matchCriteriaId":"71555F5B-DEB2-417A-8E33-90276DD2EFB8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: hold claim backbone gateways by reference\n\nbatadv_bla_add_claim() can replace claim->backbone_gw and drop the old\ngateway's last reference while readers still follow the pointer.\n\nThe netlink claim dump path dereferences claim->backbone_gw->orig and\ntakes claim->backbone_gw->crc_lock without pinning the underlying\nbackbone gateway. batadv_bla_check_claim() still has the same naked\npointer access pattern.\n\nReuse batadv_bla_claim_get_backbone_gw() in both readers so they operate\non a stable gateway reference until the read-side work is complete.\nThis keeps the dump and claim-check paths aligned with the lifetime\nrules introduced for the other BLA claim readers."}],"id":"CVE-2026-31657","lastModified":"2026-10-19T19:18:03.380","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31657","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:37.875669Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:45.227","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1f2dc36c297d27733f1b380ea644cf15a361bd7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2f55b58b5a0bbed192d60c444a45a49cdf1b545f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4dee4c0688443aaf5bbec74aa203c851d1d53c35"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5202f071b367ffbc8e279fc7a00db14f5e587f52"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/69d1ce9c72eca91203ffdb8d08bacd511100aec6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7962b522222628596ca9ecc8722efc95367aadbd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/82d8701b2c930d0e96b0dbc9115a218d791cb0d2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f4858832ddef2f39f21e30b7226bbcd3c4b2bc96"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/batman-adv/bridge_loop_avoidance.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5202f071b367ffbc8e279fc7a00db14f5e587f52","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"69d1ce9c72eca91203ffdb8d08bacd511100aec6","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"f4858832ddef2f39f21e30b7226bbcd3c4b2bc96","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"2f55b58b5a0bbed192d60c444a45a49cdf1b545f","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"7962b522222628596ca9ecc8722efc95367aadbd","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"4dee4c0688443aaf5bbec74aa203c851d1d53c35","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"1f2dc36c297d27733f1b380ea644cf15a361bd7b","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"},{"lessThan":"82d8701b2c930d0e96b0dbc9115a218d791cb0d2","status":"affected","version":"23721387c409087fd3b97e274f34d3ddc0970b74","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/batman-adv/bridge_loop_avoidance.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.5"},{"lessThan":"3.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"17B3C5B3-0F63-4D6D-A3AA-C6184C350124","versionEndExcluding":"6.1.169","versionStartIncluding":"3.5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.5:-:*:*:*:*:*:*","matchCriteriaId":"71555F5B-DEB2-417A-8E33-90276DD2EFB8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: hold claim backbone gateways by reference\n\nbatadv_bla_add_claim() can replace claim->backbone_gw and drop the old\ngateway's last reference while readers still follow the pointer.\n\nThe netlink claim dump path dereferences claim->backbone_gw->orig and\ntakes claim->backbone_gw->crc_lock without pinning the underlying\nbackbone gateway. batadv_bla_check_claim() still has the same naked\npointer access pattern.\n\nReuse batadv_bla_claim_get_backbone_gw() in both readers so they operate\non a stable gateway reference until the read-side work is complete.\nThis keeps the dump and claim-check paths aligned with the lifetime\nrules introduced for the other BLA claim readers."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbatman-adv: mantener las pasarelas troncales de reclamo por referencia\n\nbatadv_bla_add_claim() puede reemplazar claim -> backbone_gw y liberar la última referencia de la pasarela antigua mientras los lectores aún siguen el puntero.\n\nLa ruta de volcado de reclamo de netlink desreferencia claim -> backbone_gw -> orig y toma claim -> backbone_gw -> crc_lock sin fijar la pasarela troncal subyacente. batadv_bla_check_claim() aún tiene el mismo patrón de acceso de puntero desnudo.\n\nReutilizar batadv_bla_claim_get_backbone_gw() en ambos lectores para que operen en una referencia de pasarela estable hasta que el trabajo del lado de lectura esté completo. Esto mantiene las rutas de volcado y de verificación de reclamo alineadas con las reglas de vida útil introducidas para los otros lectores de reclamo BLA."}],"id":"CVE-2026-31657","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31657","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:37.875669Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:45.227","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1f2dc36c297d27733f1b380ea644cf15a361bd7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2f55b58b5a0bbed192d60c444a45a49cdf1b545f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4dee4c0688443aaf5bbec74aa203c851d1d53c35"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/5202f071b367ffbc8e279fc7a00db14f5e587f52"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/69d1ce9c72eca91203ffdb8d08bacd511100aec6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7962b522222628596ca9ecc8722efc95367aadbd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/82d8701b2c930d0e96b0dbc9115a218d791cb0d2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f4858832ddef2f39f21e30b7226bbcd3c4b2bc96"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31658.json b/data/2026/CVE-2026-31658.json index fd66a43f83..090cb1e3f8 100644 --- a/data/2026/CVE-2026-31658.json +++ b/data/2026/CVE-2026-31658.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/altera/altera_tse_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ae2cd46f57f422b51aedd406ff5d75cbff401d5d","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"cb1d318702fdf643061350d164250198df4116f2","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"d5ec406f0543bd6cdfd563b08015fdec8c4d5712","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"2eb9d67704ca8f1101f7435b85f113ede471f9f2","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"9f3ec44aeb58501d11834048d5d0dbaeacb6d4e7","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"60f462cd2716d86bd2174f9d5e035c9278f30480","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"3aca300e88afe56afb000cdc4c65383014fb17f9","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"6dede3967619b5944003227a5d09fdc21ed57d10","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/altera/altera_tse_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.15"},{"lessThan":"3.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DA21F47A-22D3-42CD-9040-94231664F332","versionEndExcluding":"5.10.253","versionStartIncluding":"3.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.15:-:*:*:*:*:*:*","matchCriteriaId":"F138B0D1-8A71-47E3-B203-17061370DFD9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()\n\nWhen dma_map_single() fails in tse_start_xmit(), the function returns\nNETDEV_TX_OK without freeing the skb. Since NETDEV_TX_OK tells the\nstack the packet was consumed, the skb is never freed, leaking memory\non every DMA mapping failure.\n\nAdd dev_kfree_skb_any() before returning to properly free the skb."}],"id":"CVE-2026-31658","lastModified":"2026-11-10T13:19:01.860","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:45.337","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2eb9d67704ca8f1101f7435b85f113ede471f9f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3aca300e88afe56afb000cdc4c65383014fb17f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/60f462cd2716d86bd2174f9d5e035c9278f30480"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6dede3967619b5944003227a5d09fdc21ed57d10"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9f3ec44aeb58501d11834048d5d0dbaeacb6d4e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ae2cd46f57f422b51aedd406ff5d75cbff401d5d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cb1d318702fdf643061350d164250198df4116f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5ec406f0543bd6cdfd563b08015fdec8c4d5712"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/altera/altera_tse_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ae2cd46f57f422b51aedd406ff5d75cbff401d5d","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"cb1d318702fdf643061350d164250198df4116f2","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"d5ec406f0543bd6cdfd563b08015fdec8c4d5712","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"2eb9d67704ca8f1101f7435b85f113ede471f9f2","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"9f3ec44aeb58501d11834048d5d0dbaeacb6d4e7","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"60f462cd2716d86bd2174f9d5e035c9278f30480","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"3aca300e88afe56afb000cdc4c65383014fb17f9","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"},{"lessThan":"6dede3967619b5944003227a5d09fdc21ed57d10","status":"affected","version":"bbd2190ce96d8fce031f0526c1f970b68adc9d1a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/altera/altera_tse_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.15"},{"lessThan":"3.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DA21F47A-22D3-42CD-9040-94231664F332","versionEndExcluding":"5.10.253","versionStartIncluding":"3.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.15:-:*:*:*:*:*:*","matchCriteriaId":"F138B0D1-8A71-47E3-B203-17061370DFD9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()\n\nWhen dma_map_single() fails in tse_start_xmit(), the function returns\nNETDEV_TX_OK without freeing the skb. Since NETDEV_TX_OK tells the\nstack the packet was consumed, the skb is never freed, leaking memory\non every DMA mapping failure.\n\nAdd dev_kfree_skb_any() before returning to properly free the skb."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: altera-tse: solucionar fuga de skb en error de mapeo DMA en tse_start_xmit()\n\nCuando dma_map_single() falla en tse_start_xmit(), la función devuelve NETDEV_TX_OK sin liberar el skb. Dado que NETDEV_TX_OK le dice a la pila que el paquete fue consumido, el skb nunca es liberado, fugando memoria en cada fallo de mapeo DMA.\n\nAñadir dev_kfree_skb_any() antes de regresar para liberar correctamente el skb."}],"id":"CVE-2026-31658","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:45.337","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2eb9d67704ca8f1101f7435b85f113ede471f9f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3aca300e88afe56afb000cdc4c65383014fb17f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/60f462cd2716d86bd2174f9d5e035c9278f30480"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6dede3967619b5944003227a5d09fdc21ed57d10"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9f3ec44aeb58501d11834048d5d0dbaeacb6d4e7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ae2cd46f57f422b51aedd406ff5d75cbff401d5d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cb1d318702fdf643061350d164250198df4116f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d5ec406f0543bd6cdfd563b08015fdec8c4d5712"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31659.json b/data/2026/CVE-2026-31659.json index 39f1c7d8d2..7469946251 100644 --- a/data/2026/CVE-2026-31659.json +++ b/data/2026/CVE-2026-31659.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/batman-adv/translation-table.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7e5d007e0df946bffb8542fb112e0044014a5897","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"2997f4bd1f982e7013709946e00be89b507693fa","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"95c71365a2222908441b54d6f2c315e0c79fcec3","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"69d61639bc7e963c3b645e570279d731e7c89062","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"f970646b9a39539d1bac86822ac78b5915455ea9","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"de6c1dc3c7d01a152607e6fcecee4d5288283f10","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"cf2199171ef799ca7270019125f4a91bd20ad4d9","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"3a359bf5c61d52e7f09754108309d637532164a6","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/batman-adv/translation-table.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.13"},{"lessThan":"3.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6549DFC-0811-4ACB-AAC7-1960F001987F","versionEndExcluding":"5.10.253","versionStartIncluding":"3.13.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.13:-:*:*:*:*:*:*","matchCriteriaId":"0F72A71E-B6B2-40F2-A21D-BF7CE1514976","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: reject oversized global TT response buffers\n\nbatadv_tt_prepare_tvlv_global_data() builds the allocation length for a\nglobal TT response in 16-bit temporaries. When a remote originator\nadvertises a large enough global TT, the TT payload length plus the VLAN\nheader offset can exceed 65535 and wrap before kmalloc().\n\nThe full-table response path still uses the original TT payload length when\nit fills tt_change, so the wrapped allocation is too small and\nbatadv_tt_prepare_tvlv_global_data() writes past the end of the heap object\nbefore the later packet-size check runs.\n\nFix this by rejecting TT responses whose TVLV value length cannot fit in\nthe 16-bit TVLV payload length field."}],"id":"CVE-2026-31659","lastModified":"2026-10-19T19:18:03.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31659","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:40.590672Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:45.457","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2997f4bd1f982e7013709946e00be89b507693fa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a359bf5c61d52e7f09754108309d637532164a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/69d61639bc7e963c3b645e570279d731e7c89062"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e5d007e0df946bffb8542fb112e0044014a5897"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95c71365a2222908441b54d6f2c315e0c79fcec3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cf2199171ef799ca7270019125f4a91bd20ad4d9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de6c1dc3c7d01a152607e6fcecee4d5288283f10"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f970646b9a39539d1bac86822ac78b5915455ea9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/batman-adv/translation-table.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7e5d007e0df946bffb8542fb112e0044014a5897","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"2997f4bd1f982e7013709946e00be89b507693fa","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"95c71365a2222908441b54d6f2c315e0c79fcec3","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"69d61639bc7e963c3b645e570279d731e7c89062","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"f970646b9a39539d1bac86822ac78b5915455ea9","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"de6c1dc3c7d01a152607e6fcecee4d5288283f10","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"cf2199171ef799ca7270019125f4a91bd20ad4d9","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"},{"lessThan":"3a359bf5c61d52e7f09754108309d637532164a6","status":"affected","version":"7ea7b4a142758deaf46c1af0ca9ceca6dd55138b","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/batman-adv/translation-table.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.13"},{"lessThan":"3.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6549DFC-0811-4ACB-AAC7-1960F001987F","versionEndExcluding":"5.10.253","versionStartIncluding":"3.13.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.13:-:*:*:*:*:*:*","matchCriteriaId":"0F72A71E-B6B2-40F2-A21D-BF7CE1514976","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: reject oversized global TT response buffers\n\nbatadv_tt_prepare_tvlv_global_data() builds the allocation length for a\nglobal TT response in 16-bit temporaries. When a remote originator\nadvertises a large enough global TT, the TT payload length plus the VLAN\nheader offset can exceed 65535 and wrap before kmalloc().\n\nThe full-table response path still uses the original TT payload length when\nit fills tt_change, so the wrapped allocation is too small and\nbatadv_tt_prepare_tvlv_global_data() writes past the end of the heap object\nbefore the later packet-size check runs.\n\nFix this by rejecting TT responses whose TVLV value length cannot fit in\nthe 16-bit TVLV payload length field."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbatman-adv: rechazar búferes de respuesta TT global sobredimensionados\n\nbatadv_tt_prepare_tvlv_global_data() construye la longitud de asignación para una respuesta TT global en temporales de 16 bits. Cuando un originador remoto anuncia un TT global lo suficientemente grande, la longitud de la carga útil del TT más el desplazamiento de la cabecera VLAN puede exceder 65535 y desbordarse antes de kmalloc().\n\nLa ruta de respuesta de tabla completa todavía utiliza la longitud original de la carga útil del TT cuando llena tt_change, por lo que la asignación desbordada es demasiado pequeña y batadv_tt_prepare_tvlv_global_data() escribe más allá del final del objeto de la pila antes de que se ejecute la comprobación posterior del tamaño del paquete.\n\nSolucionar esto al rechazar respuestas TT cuya longitud de valor TVLV no puede caber en el campo de longitud de carga útil TVLV de 16 bits."}],"id":"CVE-2026-31659","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31659","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:40.590672Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:45.457","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2997f4bd1f982e7013709946e00be89b507693fa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a359bf5c61d52e7f09754108309d637532164a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/69d61639bc7e963c3b645e570279d731e7c89062"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e5d007e0df946bffb8542fb112e0044014a5897"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/95c71365a2222908441b54d6f2c315e0c79fcec3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cf2199171ef799ca7270019125f4a91bd20ad4d9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/de6c1dc3c7d01a152607e6fcecee4d5288283f10"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f970646b9a39539d1bac86822ac78b5915455ea9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31660.json b/data/2026/CVE-2026-31660.json index be8cd7dc0a..34aa571782 100644 --- a/data/2026/CVE-2026-31660.json +++ b/data/2026/CVE-2026-31660.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nfc/pn533/uart.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2ca64fb7e2d2ae14619dd204d4f2f0a601f421fb","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"8b71299d587d9e4c830c18afb884c80ddb30ad28","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"16649adc2e19509104245ea1f349b629d858f11f","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"07cb6c72e66ba548679f22ac29ad588da8999279","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"a9495069b43b8634c1ae0042e888766c34f66637","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"21ae2cda66a55c759607bbf1d23cbaa42019d2de","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"7e37da42eda45d7859d9273fc7e225d8df458038","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"c71ba669b570c7b3f86ec875be222ea11dacb352","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nfc/pn533/uart.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"45E871E1-B00E-4E88-83A3-60B38EAF2B8A","versionEndExcluding":"5.10.253","versionStartIncluding":"5.5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:*","matchCriteriaId":"EE98F46A-F7D9-4609-B6A0-882E7F0D378C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: allocate rx skb before consuming bytes\n\npn532_receive_buf() reports the number of accepted bytes to the serdev\ncore. The current code consumes bytes into recv_skb and may already hand\na complete frame to pn533_recv_frame() before allocating a fresh receive\nbuffer.\n\nIf that alloc_skb() fails, the callback returns 0 even though it has\nalready consumed bytes, and it leaves recv_skb as NULL for the next\nreceive callback. That breaks the receive_buf() accounting contract and\ncan also lead to a NULL dereference on the next skb_put_u8().\n\nAllocate the receive skb lazily before consuming the next byte instead.\nIf allocation fails, return the number of bytes already accepted."}],"id":"CVE-2026-31660","lastModified":"2026-06-17T10:34:11.080","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:45.577","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07cb6c72e66ba548679f22ac29ad588da8999279"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/16649adc2e19509104245ea1f349b629d858f11f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21ae2cda66a55c759607bbf1d23cbaa42019d2de"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ca64fb7e2d2ae14619dd204d4f2f0a601f421fb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e37da42eda45d7859d9273fc7e225d8df458038"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8b71299d587d9e4c830c18afb884c80ddb30ad28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a9495069b43b8634c1ae0042e888766c34f66637"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c71ba669b570c7b3f86ec875be222ea11dacb352"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/nfc/pn533/uart.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"2ca64fb7e2d2ae14619dd204d4f2f0a601f421fb","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"8b71299d587d9e4c830c18afb884c80ddb30ad28","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"16649adc2e19509104245ea1f349b629d858f11f","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"07cb6c72e66ba548679f22ac29ad588da8999279","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"a9495069b43b8634c1ae0042e888766c34f66637","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"21ae2cda66a55c759607bbf1d23cbaa42019d2de","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"7e37da42eda45d7859d9273fc7e225d8df458038","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"},{"lessThan":"c71ba669b570c7b3f86ec875be222ea11dacb352","status":"affected","version":"c656aa4c27b17a8c70da223ed5ab42145800d6b5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/nfc/pn533/uart.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"45E871E1-B00E-4E88-83A3-60B38EAF2B8A","versionEndExcluding":"5.10.253","versionStartIncluding":"5.5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.5:-:*:*:*:*:*:*","matchCriteriaId":"EE98F46A-F7D9-4609-B6A0-882E7F0D378C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: allocate rx skb before consuming bytes\n\npn532_receive_buf() reports the number of accepted bytes to the serdev\ncore. The current code consumes bytes into recv_skb and may already hand\na complete frame to pn533_recv_frame() before allocating a fresh receive\nbuffer.\n\nIf that alloc_skb() fails, the callback returns 0 even though it has\nalready consumed bytes, and it leaves recv_skb as NULL for the next\nreceive callback. That breaks the receive_buf() accounting contract and\ncan also lead to a NULL dereference on the next skb_put_u8().\n\nAllocate the receive skb lazily before consuming the next byte instead.\nIf allocation fails, return the number of bytes already accepted."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnfc: pn533: asignar rx skb antes de consumir bytes\n\npn532_receive_buf() informa el número de bytes aceptados al núcleo serdev. El código actual consume bytes en recv_skb y puede que ya entregue una trama completa a pn533_recv_frame() antes de asignar un nuevo búfer de recepción.\n\nSi ese alloc_skb() falla, la devolución de llamada devuelve 0 a pesar de que ya ha consumido bytes, y deja recv_skb como NULL para la siguiente devolución de llamada de recepción. Eso rompe el contrato de contabilidad de receive_buf() y también puede llevar a una desreferencia NULL en el siguiente skb_put_u8().\n\nEn su lugar, asignar el skb de recepción de forma perezosa antes de consumir el siguiente byte. Si la asignación falla, devolver el número de bytes ya aceptados."}],"id":"CVE-2026-31660","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-24T15:16:45.577","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07cb6c72e66ba548679f22ac29ad588da8999279"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/16649adc2e19509104245ea1f349b629d858f11f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/21ae2cda66a55c759607bbf1d23cbaa42019d2de"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ca64fb7e2d2ae14619dd204d4f2f0a601f421fb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/7e37da42eda45d7859d9273fc7e225d8df458038"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8b71299d587d9e4c830c18afb884c80ddb30ad28"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a9495069b43b8634c1ae0042e888766c34f66637"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c71ba669b570c7b3f86ec875be222ea11dacb352"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-Other"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31661.json b/data/2026/CVE-2026-31661.json index 5add5e1184..d617b275ba 100644 --- a/data/2026/CVE-2026-31661.json +++ b/data/2026/CVE-2026-31661.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f449676bab54fea1440775c8c915dadb323fe015","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"3c204a0fd079fa7a867151a47d830ad1c2db5177","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"0f87777b74bcce29b966ec42d9aa8f9edd9b1667","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"4bf41c2731a0549e21f66180ff780b1e036639ab","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"77263f053963dea9f3962505ac0c768853d7dc59","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"b27fa888e4a426a3bcf6f6ab24701d888d9bf5aa","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"01f1330d3d1bee07e0c42d40cc48b7be8b6dad84","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"12cd7632757a54ce586e36040210b1a738a0fc53","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8136AA8-F2F0-4960-9AAF-176AC6ACEA92","versionEndExcluding":"5.10.253","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.2:-:*:*:*:*:*:*","matchCriteriaId":"2BEBAC7C-43AE-4D02-A957-26F89F27E0AC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmsmac: Fix dma_free_coherent() size\n\ndma_alloc_consistent() may change the size to align it. The new size is\nsaved in alloced.\n\nChange the free size to match the allocation size."}],"id":"CVE-2026-31661","lastModified":"2026-11-06T16:18:06.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31661","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:42.907917Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:45.703","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/01f1330d3d1bee07e0c42d40cc48b7be8b6dad84"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f87777b74bcce29b966ec42d9aa8f9edd9b1667"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/12cd7632757a54ce586e36040210b1a738a0fc53"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c204a0fd079fa7a867151a47d830ad1c2db5177"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4bf41c2731a0549e21f66180ff780b1e036639ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/77263f053963dea9f3962505ac0c768853d7dc59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b27fa888e4a426a3bcf6f6ab24701d888d9bf5aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f449676bab54fea1440775c8c915dadb323fe015"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f449676bab54fea1440775c8c915dadb323fe015","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"3c204a0fd079fa7a867151a47d830ad1c2db5177","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"0f87777b74bcce29b966ec42d9aa8f9edd9b1667","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"4bf41c2731a0549e21f66180ff780b1e036639ab","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"77263f053963dea9f3962505ac0c768853d7dc59","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"b27fa888e4a426a3bcf6f6ab24701d888d9bf5aa","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"01f1330d3d1bee07e0c42d40cc48b7be8b6dad84","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"},{"lessThan":"12cd7632757a54ce586e36040210b1a738a0fc53","status":"affected","version":"5b435de0d786869c95d1962121af0d7df2542009","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.2"},{"lessThan":"3.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A8136AA8-F2F0-4960-9AAF-176AC6ACEA92","versionEndExcluding":"5.10.253","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:3.2:-:*:*:*:*:*:*","matchCriteriaId":"2BEBAC7C-43AE-4D02-A957-26F89F27E0AC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmsmac: Fix dma_free_coherent() size\n\ndma_alloc_consistent() may change the size to align it. The new size is\nsaved in alloced.\n\nChange the free size to match the allocation size."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: brcmsmac: Corregir el tamaño de dma_free_coherent()\n\ndma_alloc_consistent() puede cambiar el tamaño para alinearlo. El nuevo tamaño se guarda en alloced.\n\nCambiar el tamaño de liberación para que coincida con el tamaño de asignación."}],"id":"CVE-2026-31661","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31661","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:42.907917Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:45.703","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/01f1330d3d1bee07e0c42d40cc48b7be8b6dad84"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f87777b74bcce29b966ec42d9aa8f9edd9b1667"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/12cd7632757a54ce586e36040210b1a738a0fc53"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c204a0fd079fa7a867151a47d830ad1c2db5177"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4bf41c2731a0549e21f66180ff780b1e036639ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/77263f053963dea9f3962505ac0c768853d7dc59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b27fa888e4a426a3bcf6f6ab24701d888d9bf5aa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f449676bab54fea1440775c8c915dadb323fe015"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31662.json b/data/2026/CVE-2026-31662.json index d5618fb38a..25adadea38 100644 --- a/data/2026/CVE-2026-31662.json +++ b/data/2026/CVE-2026-31662.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/tipc/group.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a7db57ccca21f5801609065473c89a38229ecb92","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"575faea557f1a184a5f09661bd47ebd3ef3769f8","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"3bcf7aca63f0bcd679ae28e9b99823c608e59ce3","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"a2ea1ef0167d7a84730638d05c20ccdc421b14b6","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"1b6f13f626665cac67ba5a012765427680518711","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"48a5fe38772b6f039522469ee6131a67838221a8","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/tipc/group.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B17827E3-86FD-498B-B936-E57F1C08BF4A","versionEndExcluding":"5.10.253","versionStartIncluding":"4.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.15:-:*:*:*:*:*:*","matchCriteriaId":"3B4D39AF-668B-442B-8085-639A6D4FA5AC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG\n\nThe GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements\nbc_ackers on every inbound group ACK, even when the same member has\nalready acknowledged the current broadcast round.\n\nBecause bc_ackers is a u16, a duplicate ACK received after the last\nlegitimate ACK wraps the counter to 65535. Once wrapped,\ntipc_group_bc_cong() keeps reporting congestion and later group\nbroadcasts on the affected socket stay blocked until the group is\nrecreated.\n\nFix this by ignoring duplicate or stale ACKs before touching bc_acked or\nbc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and\nprevents the underflow path."}],"id":"CVE-2026-31662","lastModified":"2026-10-19T19:18:03.737","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31662","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:44.605157Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:45.820","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1b6f13f626665cac67ba5a012765427680518711"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3bcf7aca63f0bcd679ae28e9b99823c608e59ce3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48a5fe38772b6f039522469ee6131a67838221a8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/575faea557f1a184a5f09661bd47ebd3ef3769f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a2ea1ef0167d7a84730638d05c20ccdc421b14b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7db57ccca21f5801609065473c89a38229ecb92"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/tipc/group.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a7db57ccca21f5801609065473c89a38229ecb92","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"575faea557f1a184a5f09661bd47ebd3ef3769f8","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"3bcf7aca63f0bcd679ae28e9b99823c608e59ce3","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"a2ea1ef0167d7a84730638d05c20ccdc421b14b6","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"1b6f13f626665cac67ba5a012765427680518711","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"},{"lessThan":"48a5fe38772b6f039522469ee6131a67838221a8","status":"affected","version":"2f487712b89376fce267223bbb0db93d393d4b09","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/tipc/group.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B17827E3-86FD-498B-B936-E57F1C08BF4A","versionEndExcluding":"5.10.253","versionStartIncluding":"4.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.15:-:*:*:*:*:*:*","matchCriteriaId":"3B4D39AF-668B-442B-8085-639A6D4FA5AC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG\n\nThe GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements\nbc_ackers on every inbound group ACK, even when the same member has\nalready acknowledged the current broadcast round.\n\nBecause bc_ackers is a u16, a duplicate ACK received after the last\nlegitimate ACK wraps the counter to 65535. Once wrapped,\ntipc_group_bc_cong() keeps reporting congestion and later group\nbroadcasts on the affected socket stay blocked until the group is\nrecreated.\n\nFix this by ignoring duplicate or stale ACKs before touching bc_acked or\nbc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and\nprevents the underflow path."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntipc: corregir el desbordamiento inferior de bc_ackers en GRP_ACK_MSG duplicados\n\nEl gestor GRP_ACK_MSG en tipc_group_proto_rcv() actualmente decrementa bc_ackers en cada ACK de grupo entrante, incluso cuando el mismo miembro ya ha acusado recibo de la ronda de difusión actual.\n\nDebido a que bc_ackers es un u16, un ACK duplicado recibido después del último ACK legítimo envuelve el contador a 65535. Una vez envuelto, tipc_group_bc_cong() sigue informando de congestión y las posteriores difusiones de grupo en el socket afectado permanecen bloqueadas hasta que el grupo es recreado.\n\nCorregir esto ignorando los ACKs duplicados u obsoletos antes de modificar bc_acked o bc_ackers. Esto hace que el manejo repetido de GRP_ACK_MSG sea idempotente y previene la ruta de desbordamiento inferior."}],"id":"CVE-2026-31662","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31662","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:44.605157Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:45.820","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1b6f13f626665cac67ba5a012765427680518711"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36ec4fdd6250dcd5e73eb09ea92ed92e9cc28412"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3bcf7aca63f0bcd679ae28e9b99823c608e59ce3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/48a5fe38772b6f039522469ee6131a67838221a8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/575faea557f1a184a5f09661bd47ebd3ef3769f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a2ea1ef0167d7a84730638d05c20ccdc421b14b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7db57ccca21f5801609065473c89a38229ecb92"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0bb732eaf77f9ac2f2638bdac9e39b81e0a9682"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-191"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-190"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31663.json b/data/2026/CVE-2026-31663.json index 22c2ee7be1..4dff0a18c6 100644 --- a/data/2026/CVE-2026-31663.json +++ b/data/2026/CVE-2026-31663.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/xfrm4_input.c","net/ipv6/xfrm6_input.c","net/xfrm/xfrm_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4d06caedea587c59cc2cc893ceecc57c75c64312","status":"affected","version":"acf568ee859f098279eadf551612f103afdacb4e","versionType":"git"},{"lessThan":"94439cbe478b53f92223da9aae95fffb28623c3f","status":"affected","version":"acf568ee859f098279eadf551612f103afdacb4e","versionType":"git"},{"lessThan":"4236c30b437b80f673b9e08c8fae38b8d471ac9e","status":"affected","version":"acf568ee859f098279eadf551612f103afdacb4e","versionType":"git"},{"lessThan":"0f451b43c88bf2b9c038b414be580efee42e031b","status":"affected","version":"acf568ee859f098279eadf551612f103afdacb4e","versionType":"git"},{"lessThan":"5002beda5cac69d522dc54da0d5d463ed9c963d2","status":"affected","version":"acf568ee859f098279eadf551612f103afdacb4e","versionType":"git"},{"lessThan":"1c428b03840094410c5fb6a5db30640486bbbfcb","status":"affected","version":"acf568ee859f098279eadf551612f103afdacb4e","versionType":"git"},{"status":"affected","version":"69895c5ea0ca2e8d7de1e6d36965d0ab9730787f","versionType":"git"},{"status":"affected","version":"833760100588acfb267dac4d6a02ab9931237739","versionType":"git"},{"status":"affected","version":"e095ecaec6d94aa2156cceb98a85d409b51190f3","versionType":"git"},{"lessThan":"3.3","status":"affected","version":"3.2.100","versionType":"semver"},{"lessThan":"3.17","status":"affected","version":"3.16.55","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.24","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/xfrm4_input.c","net/ipv6/xfrm6_input.c","net/xfrm/xfrm_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.94","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.55.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.164.1.rt7.505.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.164.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.49.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6B10F87F-6387-4CE3-9159-D77EB163C9AD","versionEndExcluding":"3.3","versionStartIncluding":"3.2.100","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9F9D919-846F-4FDC-882F-B49219EA19E9","versionEndExcluding":"3.17","versionStartIncluding":"3.16.55","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4C6AA567-92EC-46CF-9ED1-2B04B2B29BFB","versionEndExcluding":"4.15","versionStartIncluding":"4.14.24","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"45125EC8-B49D-48DD-92B9-2E4D1295531E","versionEndExcluding":"6.18.23","versionStartIncluding":"4.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.15:-:*:*:*:*:*:*","matchCriteriaId":"3B4D39AF-668B-442B-8085-639A6D4FA5AC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold dev ref until after transport_finish NF_HOOK\n\nAfter async crypto completes, xfrm_input_resume() calls dev_put()\nimmediately on re-entry before the skb reaches transport_finish.\nThe skb->dev pointer is then used inside NF_HOOK and its okfn,\nwhich can race with device teardown.\n\nRemove the dev_put from the async resumption entry and instead\ndrop the reference after the NF_HOOK call in transport_finish,\nusing a saved device pointer since NF_HOOK may consume the skb.\nThis covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip\nthe okfn.\n\nFor non-transport exits (decaps, gro, drop) and secondary\nasync return points, release the reference inline when\nasync is set."}],"id":"CVE-2026-31663","lastModified":"2026-10-30T13:18:41.830","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31663","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:47.294620Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:45.947","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f451b43c88bf2b9c038b414be580efee42e031b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c428b03840094410c5fb6a5db30640486bbbfcb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4236c30b437b80f673b9e08c8fae38b8d471ac9e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4d06caedea587c59cc2cc893ceecc57c75c64312"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5002beda5cac69d522dc54da0d5d463ed9c963d2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/94439cbe478b53f92223da9aae95fffb28623c3f"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:67471"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:68531"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:68532"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:68570"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31663"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461462"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31663.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-826"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/xfrm4_input.c","net/ipv6/xfrm6_input.c","net/xfrm/xfrm_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4d06caedea587c59cc2cc893ceecc57c75c64312","status":"affected","version":"acf568ee859f098279eadf551612f103afdacb4e","versionType":"git"},{"lessThan":"94439cbe478b53f92223da9aae95fffb28623c3f","status":"affected","version":"acf568ee859f098279eadf551612f103afdacb4e","versionType":"git"},{"lessThan":"4236c30b437b80f673b9e08c8fae38b8d471ac9e","status":"affected","version":"acf568ee859f098279eadf551612f103afdacb4e","versionType":"git"},{"lessThan":"0f451b43c88bf2b9c038b414be580efee42e031b","status":"affected","version":"acf568ee859f098279eadf551612f103afdacb4e","versionType":"git"},{"lessThan":"5002beda5cac69d522dc54da0d5d463ed9c963d2","status":"affected","version":"acf568ee859f098279eadf551612f103afdacb4e","versionType":"git"},{"lessThan":"1c428b03840094410c5fb6a5db30640486bbbfcb","status":"affected","version":"acf568ee859f098279eadf551612f103afdacb4e","versionType":"git"},{"status":"affected","version":"69895c5ea0ca2e8d7de1e6d36965d0ab9730787f","versionType":"git"},{"status":"affected","version":"833760100588acfb267dac4d6a02ab9931237739","versionType":"git"},{"status":"affected","version":"e095ecaec6d94aa2156cceb98a85d409b51190f3","versionType":"git"},{"lessThan":"3.3","status":"affected","version":"3.2.100","versionType":"semver"},{"lessThan":"3.17","status":"affected","version":"3.16.55","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.24","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/xfrm4_input.c","net/ipv6/xfrm6_input.c","net/xfrm/xfrm_input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.94","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:6.12.0-211.55.1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8::nfv"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.164.1.rt7.505.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.18.0-553.164.1.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.14.0-687.49.1.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"],"defaultStatus":"unaffected","packageName":"kernel","product":"Red Hat Enterprise Linux 6","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"affected","packageName":"kernel","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"],"defaultStatus":"affected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 7","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"kernel-rt","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6B10F87F-6387-4CE3-9159-D77EB163C9AD","versionEndExcluding":"3.3","versionStartIncluding":"3.2.100","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9F9D919-846F-4FDC-882F-B49219EA19E9","versionEndExcluding":"3.17","versionStartIncluding":"3.16.55","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4C6AA567-92EC-46CF-9ED1-2B04B2B29BFB","versionEndExcluding":"4.15","versionStartIncluding":"4.14.24","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"45125EC8-B49D-48DD-92B9-2E4D1295531E","versionEndExcluding":"6.18.23","versionStartIncluding":"4.15.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.15:-:*:*:*:*:*:*","matchCriteriaId":"3B4D39AF-668B-442B-8085-639A6D4FA5AC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold dev ref until after transport_finish NF_HOOK\n\nAfter async crypto completes, xfrm_input_resume() calls dev_put()\nimmediately on re-entry before the skb reaches transport_finish.\nThe skb->dev pointer is then used inside NF_HOOK and its okfn,\nwhich can race with device teardown.\n\nRemove the dev_put from the async resumption entry and instead\ndrop the reference after the NF_HOOK call in transport_finish,\nusing a saved device pointer since NF_HOOK may consume the skb.\nThis covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip\nthe okfn.\n\nFor non-transport exits (decaps, gro, drop) and secondary\nasync return points, release the reference inline when\nasync is set."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm: mantener la referencia del dispositivo hasta después de transport_finish NF_HOOK\n\nDespués de que la criptografía asíncrona se completa, xfrm_input_resume() llama a dev_put() inmediatamente al reingresar antes de que el skb alcance transport_finish. El puntero skb -> dev se utiliza entonces dentro de NF_HOOK y su okfn, lo que puede generar una condición de carrera con el desmantelamiento del dispositivo.\n\nEliminar el dev_put de la entrada de reanudación asíncrona y en su lugar liberar la referencia después de la llamada a NF_HOOK en transport_finish, utilizando un puntero de dispositivo guardado ya que NF_HOOK puede consumir el skb. Esto cubre las rutas NF_DROP, NF_QUEUE y NF_STOLEN que omiten el okfn.\n\nPara salidas no de transporte (decaps, gro, drop) y puntos de retorno asíncronos secundarios, liberar la referencia en línea cuando async está configurado."}],"id":"CVE-2026-31663","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.0,"impactScore":5.9,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31663","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:47.294620Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:45.947","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0f451b43c88bf2b9c038b414be580efee42e031b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c428b03840094410c5fb6a5db30640486bbbfcb"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4236c30b437b80f673b9e08c8fae38b8d471ac9e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4d06caedea587c59cc2cc893ceecc57c75c64312"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5002beda5cac69d522dc54da0d5d463ed9c963d2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/94439cbe478b53f92223da9aae95fffb28623c3f"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:67471"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:68531"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:68532"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:68570"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-31663"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461462"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31663.json"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-826"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31664.json b/data/2026/CVE-2026-31664.json index 49c09ec200..9109786415 100644 --- a/data/2026/CVE-2026-31664.json +++ b/data/2026/CVE-2026-31664.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a5127501c8d30b5728791b1e340284ca5c9cc4bd","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"e6f4ffe8596947a595c9544e73a73adcb0568b88","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ac6985903db047eaff54db929e4bf6b06782788e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"c221ed63a2769a0af8bd849dfe25740048f34ef4","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"eda30846ea54f8ed218468e5480c8305ca645e37","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"b1dfd6b27df35ef4f87825aa5f607378d23ff0f2","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"e1af65c669ebb1666c54576614c01a7f9ffcfff6","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"71a98248c63c535eaa4d4c22f099b68d902006d0","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2FCFBA57-878B-4D11-8528-850CE9FB4CB7","versionEndExcluding":"6.1.169","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: clear trailing padding in build_polexpire()\n\nbuild_expire() clears the trailing padding bytes of struct\nxfrm_user_expire after setting the hard field via memset_after(),\nbut the analogous function build_polexpire() does not do this for\nstruct xfrm_user_polexpire.\n\nThe padding bytes after the __u8 hard field are left\nuninitialized from the heap allocation, and are then sent to\nuserspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,\nleaking kernel heap memory contents.\n\nAdd the missing memset_after() call, matching build_expire()."}],"id":"CVE-2026-31664","lastModified":"2026-11-10T13:19:02.050","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31664","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:47.430869Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.043","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/71a98248c63c535eaa4d4c22f099b68d902006d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a5127501c8d30b5728791b1e340284ca5c9cc4bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac6985903db047eaff54db929e4bf6b06782788e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b1dfd6b27df35ef4f87825aa5f607378d23ff0f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c221ed63a2769a0af8bd849dfe25740048f34ef4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e1af65c669ebb1666c54576614c01a7f9ffcfff6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e6f4ffe8596947a595c9544e73a73adcb0568b88"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eda30846ea54f8ed218468e5480c8305ca645e37"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a5127501c8d30b5728791b1e340284ca5c9cc4bd","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"e6f4ffe8596947a595c9544e73a73adcb0568b88","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ac6985903db047eaff54db929e4bf6b06782788e","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"c221ed63a2769a0af8bd849dfe25740048f34ef4","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"eda30846ea54f8ed218468e5480c8305ca645e37","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"b1dfd6b27df35ef4f87825aa5f607378d23ff0f2","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"e1af65c669ebb1666c54576614c01a7f9ffcfff6","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"71a98248c63c535eaa4d4c22f099b68d902006d0","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2FCFBA57-878B-4D11-8528-850CE9FB4CB7","versionEndExcluding":"6.1.169","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: clear trailing padding in build_polexpire()\n\nbuild_expire() clears the trailing padding bytes of struct\nxfrm_user_expire after setting the hard field via memset_after(),\nbut the analogous function build_polexpire() does not do this for\nstruct xfrm_user_polexpire.\n\nThe padding bytes after the __u8 hard field are left\nuninitialized from the heap allocation, and are then sent to\nuserspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,\nleaking kernel heap memory contents.\n\nAdd the missing memset_after() call, matching build_expire()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm: limpiar el relleno final en build_polexpire()\n\nbuild_expire() limpia los bytes de relleno final de la estructura xfrm_user_expire después de establecer el campo hard a través de memset_after(), pero la función análoga build_polexpire() no hace esto para la estructura xfrm_user_polexpire.\n\nLos bytes de relleno después del campo __u8 hard se dejan sin inicializar de la asignación de memoria del heap, y luego se envían al espacio de usuario a través de multidifusión de netlink a los oyentes de XFRMNLGRP_EXPIRE, filtrando el contenido de la memoria del heap del kernel.\n\nAñadir la llamada a memset_after() faltante, coincidiendo con build_expire()."}],"id":"CVE-2026-31664","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31664","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:47.430869Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.043","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/71a98248c63c535eaa4d4c22f099b68d902006d0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a5127501c8d30b5728791b1e340284ca5c9cc4bd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ac6985903db047eaff54db929e4bf6b06782788e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b1dfd6b27df35ef4f87825aa5f607378d23ff0f2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c221ed63a2769a0af8bd849dfe25740048f34ef4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e1af65c669ebb1666c54576614c01a7f9ffcfff6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e6f4ffe8596947a595c9544e73a73adcb0568b88"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eda30846ea54f8ed218468e5480c8305ca645e37"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31665.json b/data/2026/CVE-2026-31665.json index 46c3bdff6f..4d9d9381be 100644 --- a/data/2026/CVE-2026-31665.json +++ b/data/2026/CVE-2026-31665.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/netfilter/nf_conntrack_timeout.h","net/netfilter/nft_ct.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c458fc1c278a65ad5381083121d39a479973ebed","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"c581e5c8f2b59158f62efe61c1a3dc36189081ff","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"f16fe84879a5280f05ebbcea593a189ba0f3e79a","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"070abdf1b04325b21a20a2a0c39a2208af107275","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"b42aca3660dc2627a29a38131597ca610dc451f9","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"d0983b48c10d1509fd795c155f8b1e832e1369ff","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"f8dca15a1b190787bbd03285304b569631160eda","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/netfilter/nf_conntrack_timeout.h","net/netfilter/nft_ct.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DCA68506-DA89-4BB0-BB51-9DE08D03AA32","versionEndExcluding":"5.10.253","versionStartIncluding":"4.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.19:-:*:*:*:*:*:*","matchCriteriaId":"CFDAD450-8799-4C2D-80CE-2AA45DEC35CE","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: fix use-after-free in timeout object destroy\n\nnft_ct_timeout_obj_destroy() frees the timeout object with kfree()\nimmediately after nf_ct_untimeout(), without waiting for an RCU grace\nperiod. Concurrent packet processing on other CPUs may still hold\nRCU-protected references to the timeout object obtained via\nrcu_dereference() in nf_ct_timeout_data().\n\nAdd an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer\nfreeing until after an RCU grace period, matching the approach already\nused in nfnetlink_cttimeout.c.\n\nKASAN report:\n BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0\n Read of size 4 at addr ffff8881035fe19c by task exploit/80\n\n Call Trace:\n nf_conntrack_tcp_packet+0x1381/0x29d0\n nf_conntrack_in+0x612/0x8b0\n nf_hook_slow+0x70/0x100\n __ip_local_out+0x1b2/0x210\n tcp_sendmsg_locked+0x722/0x1580\n __sys_sendto+0x2d8/0x320\n\n Allocated by task 75:\n nft_ct_timeout_obj_init+0xf6/0x290\n nft_obj_init+0x107/0x1b0\n nf_tables_newobj+0x680/0x9c0\n nfnetlink_rcv_batch+0xc29/0xe00\n\n Freed by task 26:\n nft_obj_destroy+0x3f/0xa0\n nf_tables_trans_destroy_work+0x51c/0x5c0\n process_one_work+0x2c4/0x5a0"}],"id":"CVE-2026-31665","lastModified":"2026-11-10T13:19:02.283","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31665","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:49.929083Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.157","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/070abdf1b04325b21a20a2a0c39a2208af107275"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b42aca3660dc2627a29a38131597ca610dc451f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c458fc1c278a65ad5381083121d39a479973ebed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c581e5c8f2b59158f62efe61c1a3dc36189081ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d0983b48c10d1509fd795c155f8b1e832e1369ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f16fe84879a5280f05ebbcea593a189ba0f3e79a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f8dca15a1b190787bbd03285304b569631160eda"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/netfilter/nf_conntrack_timeout.h","net/netfilter/nft_ct.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c458fc1c278a65ad5381083121d39a479973ebed","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"c581e5c8f2b59158f62efe61c1a3dc36189081ff","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"f16fe84879a5280f05ebbcea593a189ba0f3e79a","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"070abdf1b04325b21a20a2a0c39a2208af107275","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"b42aca3660dc2627a29a38131597ca610dc451f9","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"d0983b48c10d1509fd795c155f8b1e832e1369ff","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"},{"lessThan":"f8dca15a1b190787bbd03285304b569631160eda","status":"affected","version":"7e0b2b57f01d183e1c84114f1f2287737358d748","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/netfilter/nf_conntrack_timeout.h","net/netfilter/nft_ct.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DCA68506-DA89-4BB0-BB51-9DE08D03AA32","versionEndExcluding":"5.10.253","versionStartIncluding":"4.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.19:-:*:*:*:*:*:*","matchCriteriaId":"CFDAD450-8799-4C2D-80CE-2AA45DEC35CE","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: fix use-after-free in timeout object destroy\n\nnft_ct_timeout_obj_destroy() frees the timeout object with kfree()\nimmediately after nf_ct_untimeout(), without waiting for an RCU grace\nperiod. Concurrent packet processing on other CPUs may still hold\nRCU-protected references to the timeout object obtained via\nrcu_dereference() in nf_ct_timeout_data().\n\nAdd an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer\nfreeing until after an RCU grace period, matching the approach already\nused in nfnetlink_cttimeout.c.\n\nKASAN report:\n BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0\n Read of size 4 at addr ffff8881035fe19c by task exploit/80\n\n Call Trace:\n nf_conntrack_tcp_packet+0x1381/0x29d0\n nf_conntrack_in+0x612/0x8b0\n nf_hook_slow+0x70/0x100\n __ip_local_out+0x1b2/0x210\n tcp_sendmsg_locked+0x722/0x1580\n __sys_sendto+0x2d8/0x320\n\n Allocated by task 75:\n nft_ct_timeout_obj_init+0xf6/0x290\n nft_obj_init+0x107/0x1b0\n nf_tables_newobj+0x680/0x9c0\n nfnetlink_rcv_batch+0xc29/0xe00\n\n Freed by task 26:\n nft_obj_destroy+0x3f/0xa0\n nf_tables_trans_destroy_work+0x51c/0x5c0\n process_one_work+0x2c4/0x5a0"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: nft_ct: corrección de uso después de liberación en la destrucción del objeto de tiempo de espera\n\nnft_ct_timeout_obj_destroy() libera el objeto de tiempo de espera con kfree() inmediatamente después de nf_ct_untimeout(), sin esperar un período de gracia RCU. El procesamiento concurrente de paquetes en otras CPU aún puede mantener referencias protegidas por RCU al objeto de tiempo de espera obtenidas a través de rcu_dereference() en nf_ct_timeout_data().\n\nAñadir un rcu_head a la estructura nf_ct_timeout y usar kfree_rcu() para aplazar la liberación hasta después de un período de gracia RCU, coincidiendo con el enfoque ya utilizado en nfnetlink_cttimeout.c.\n\nInforme KASAN:\nERROR: KASAN: uso después de liberación de slab en nf_conntrack_tcp_packet+0x 1381/0x 29d0\nLectura de tamaño 4 en la dirección ffff8881035fe19c por la tarea exploit/80\n\nTraza de Llamadas:\nnf_conntrack_tcp_packet+0x 1381/0x 29d0\nnf_conntrack_in+0x612/0x8b0\nnf_hook_slow+0x70/0x100\n__ip_local_out+0x1b2/0x210\ntcp_sendmsg_locked+0x722/0x 1580\n__sys_sendto+0x2d8/0x320\n\nAsignado por la tarea 75:\nnft_ct_timeout_obj_init+0xf6/0x290\nnft_obj_init+0x107/0x1b0\nnf_tables_newobj+0x680/0x9c0\nnfnetlink_rcv_batch+0xc29/0xe00\n\nLiberado por la tarea 26:\nnft_obj_destroy+0x3f/0xa0\nnf_tables_trans_destroy_work+0x51c/0x5c0\nprocess_one_work+0x2c4/0x5a0"}],"id":"CVE-2026-31665","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31665","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:49.929083Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.157","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/070abdf1b04325b21a20a2a0c39a2208af107275"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b42aca3660dc2627a29a38131597ca610dc451f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c458fc1c278a65ad5381083121d39a479973ebed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c581e5c8f2b59158f62efe61c1a3dc36189081ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d0983b48c10d1509fd795c155f8b1e832e1369ff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f16fe84879a5280f05ebbcea593a189ba0f3e79a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f8dca15a1b190787bbd03285304b569631160eda"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31666.json b/data/2026/CVE-2026-31666.json index 022c16c8c5..a3dd2ed07a 100644 --- a/data/2026/CVE-2026-31666.json +++ b/data/2026/CVE-2026-31666.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/extent-tree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4125a194db4a6cf91f619f38788272651cb97dce","status":"affected","version":"1618aa3c2e0163f5ac34d514ae89474521910536","versionType":"git"},{"lessThan":"450e6a685d0cad95b15f8af152057bd0bf79f50b","status":"affected","version":"1618aa3c2e0163f5ac34d514ae89474521910536","versionType":"git"},{"lessThan":"ab1e022379c3c811aa72da8eb0c7507859a1d0f5","status":"affected","version":"1618aa3c2e0163f5ac34d514ae89474521910536","versionType":"git"},{"lessThan":"316fb1b3169efb081d2db910cbbfef445afa03b9","status":"affected","version":"1618aa3c2e0163f5ac34d514ae89474521910536","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/extent-tree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BBC7140F-5869-4604-97EE-EFD35C33303F","versionEndExcluding":"6.12.82","versionStartIncluding":"6.10.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.10:-:*:*:*:*:*:*","matchCriteriaId":"9EA80796-744E-45F5-8632-2AB4F7889FCD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()\n\nAfter commit 1618aa3c2e01 (\"btrfs: simplify return variables in\nlookup_extent_data_ref()\"), the err and ret variables were merged into\na single ret variable. However, when btrfs_next_leaf() returns 0\n(success), ret is overwritten from -ENOENT to 0. If the first key in\nthe next leaf does not match (different objectid or type), the function\nreturns 0 instead of -ENOENT, making the caller believe the lookup\nsucceeded when it did not. This can lead to operations on the wrong\nextent tree item, potentially causing extent tree corruption.\n\nFix this by returning -ENOENT directly when the key does not match,\ninstead of relying on the ret variable."}],"id":"CVE-2026-31666","lastModified":"2026-10-19T19:18:04.417","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31666","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:52.641665Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.290","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/316fb1b3169efb081d2db910cbbfef445afa03b9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4125a194db4a6cf91f619f38788272651cb97dce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/450e6a685d0cad95b15f8af152057bd0bf79f50b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ab1e022379c3c811aa72da8eb0c7507859a1d0f5"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-754"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/btrfs/extent-tree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4125a194db4a6cf91f619f38788272651cb97dce","status":"affected","version":"1618aa3c2e0163f5ac34d514ae89474521910536","versionType":"git"},{"lessThan":"450e6a685d0cad95b15f8af152057bd0bf79f50b","status":"affected","version":"1618aa3c2e0163f5ac34d514ae89474521910536","versionType":"git"},{"lessThan":"ab1e022379c3c811aa72da8eb0c7507859a1d0f5","status":"affected","version":"1618aa3c2e0163f5ac34d514ae89474521910536","versionType":"git"},{"lessThan":"316fb1b3169efb081d2db910cbbfef445afa03b9","status":"affected","version":"1618aa3c2e0163f5ac34d514ae89474521910536","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/btrfs/extent-tree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BBC7140F-5869-4604-97EE-EFD35C33303F","versionEndExcluding":"6.12.82","versionStartIncluding":"6.10.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.10:-:*:*:*:*:*:*","matchCriteriaId":"9EA80796-744E-45F5-8632-2AB4F7889FCD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref()\n\nAfter commit 1618aa3c2e01 (\"btrfs: simplify return variables in\nlookup_extent_data_ref()\"), the err and ret variables were merged into\na single ret variable. However, when btrfs_next_leaf() returns 0\n(success), ret is overwritten from -ENOENT to 0. If the first key in\nthe next leaf does not match (different objectid or type), the function\nreturns 0 instead of -ENOENT, making the caller believe the lookup\nsucceeded when it did not. This can lead to operations on the wrong\nextent tree item, potentially causing extent tree corruption.\n\nFix this by returning -ENOENT directly when the key does not match,\ninstead of relying on the ret variable."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbtrfs: corrige el valor de retorno incorrecto después de cambiar la hoja en lookup_extent_data_ref()\n\nDespués del commit 1618aa3c2e01 (’btrfs: simplifica las variables de retorno en lookup_extent_data_ref()’), las variables err y ret se fusionaron en una única variable ret. Sin embargo, cuando btrfs_next_leaf() devuelve 0 (éxito), ret se sobrescribe de -ENOENT a 0. Si la primera clave en la siguiente hoja no coincide (diferente objectid o tipo), la función devuelve 0 en lugar de -ENOENT, haciendo que el llamador crea que la búsqueda tuvo éxito cuando no fue así. Esto puede llevar a operaciones en el elemento incorrecto del árbol de extensiones, potencialmente causando corrupción del árbol de extensiones.\n\nCorrige esto devolviendo -ENOENT directamente cuando la clave no coincide, en lugar de depender de la variable ret."}],"id":"CVE-2026-31666","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31666","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:52.641665Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.290","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/316fb1b3169efb081d2db910cbbfef445afa03b9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4125a194db4a6cf91f619f38788272651cb97dce"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/450e6a685d0cad95b15f8af152057bd0bf79f50b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ab1e022379c3c811aa72da8eb0c7507859a1d0f5"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-754"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31667.json b/data/2026/CVE-2026-31667.json index e721627a65..2aeaeb8514 100644 --- a/data/2026/CVE-2026-31667.json +++ b/data/2026/CVE-2026-31667.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/input/misc/uinput.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"71a9729f412e2c692a35c542e14b706fb342927f","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"271ee71a1917b89f6d73ec82dd091c33d92ee617","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"974f7b138c3a96dd5cd53d1b33409cd7b2229dc6","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"546c18a14924eb521fe168d916d7ce28f1e13c1d","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"a3d6c9c053c9c605651508569230ead633b13f76","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"1e09dfbb4f5d20ee111f92325a00f85778a5f328","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"1534661043c434b81cfde26b97a2fb2460329cf0","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"4cda78d6f8bf2b700529f2fbccb994c3e826d7c2","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/input/misc/uinput.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.19"},{"lessThan":"2.6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"59C4CD77-5444-4760-B0D8-F238740397B4","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:-:*:*:*:*:*:*","matchCriteriaId":"9E2DBD4C-9DD9-4DD3-87CB-A0070A789CEA","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: uinput - fix circular locking dependency with ff-core\n\nA lockdep circular locking dependency warning can be triggered\nreproducibly when using a force-feedback gamepad with uinput (for\nexample, playing ELDEN RING under Wine with a Flydigi Vader 5\ncontroller):\n\n ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex\n\nThe cycle is caused by four lock acquisition paths:\n\n1. ff upload: input_ff_upload() holds ff->mutex and calls\n uinput_dev_upload_effect() -> uinput_request_submit() ->\n uinput_request_send(), which acquires udev->mutex.\n\n2. device create: uinput_ioctl_handler() holds udev->mutex and calls\n uinput_create_device() -> input_register_device(), which acquires\n input_mutex.\n\n3. device register: input_register_device() holds input_mutex and\n calls kbd_connect() -> input_register_handle(), which acquires\n dev->mutex.\n\n4. evdev release: evdev_release() calls input_flush_device() under\n dev->mutex, which calls input_ff_flush() acquiring ff->mutex.\n\nFix this by introducing a new state_lock spinlock to protect\nudev->state and udev->dev access in uinput_request_send() instead of\nacquiring udev->mutex. The function only needs to atomically check\ndevice state and queue an input event into the ring buffer via\nuinput_dev_event() -- both operations are safe under a spinlock\n(ktime_get_ts64() and wake_up_interruptible() do not sleep). This\nbreaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in\nthe lock ordering and cannot form cycles with mutexes.\n\nTo keep state transitions visible to uinput_request_send(), protect\nwrites to udev->state in uinput_create_device() and\nuinput_destroy_device() with the same state_lock spinlock.\n\nAdditionally, move init_completion(&request->done) from\nuinput_request_send() to uinput_request_submit() before\nuinput_request_reserve_slot(). Once the slot is allocated,\nuinput_flush_requests() may call complete() on it at any time from\nthe destroy path, so the completion must be initialised before the\nrequest becomes visible.\n\nLock ordering after the fix:\n\n ff->mutex -> state_lock (spinlock, leaf)\n udev->mutex -> state_lock (spinlock, leaf)\n udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)"}],"id":"CVE-2026-31667","lastModified":"2026-10-19T19:18:04.560","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31667","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:55.311439Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.390","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1534661043c434b81cfde26b97a2fb2460329cf0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1e09dfbb4f5d20ee111f92325a00f85778a5f328"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/271ee71a1917b89f6d73ec82dd091c33d92ee617"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cda78d6f8bf2b700529f2fbccb994c3e826d7c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/546c18a14924eb521fe168d916d7ce28f1e13c1d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/71a9729f412e2c692a35c542e14b706fb342927f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/974f7b138c3a96dd5cd53d1b33409cd7b2229dc6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a3d6c9c053c9c605651508569230ead633b13f76"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/input/misc/uinput.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"71a9729f412e2c692a35c542e14b706fb342927f","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"271ee71a1917b89f6d73ec82dd091c33d92ee617","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"974f7b138c3a96dd5cd53d1b33409cd7b2229dc6","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"546c18a14924eb521fe168d916d7ce28f1e13c1d","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"a3d6c9c053c9c605651508569230ead633b13f76","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"1e09dfbb4f5d20ee111f92325a00f85778a5f328","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"1534661043c434b81cfde26b97a2fb2460329cf0","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"},{"lessThan":"4cda78d6f8bf2b700529f2fbccb994c3e826d7c2","status":"affected","version":"ff462551235d8d7d843a005950bc90924fcedede","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/input/misc/uinput.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.19"},{"lessThan":"2.6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"59C4CD77-5444-4760-B0D8-F238740397B4","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:-:*:*:*:*:*:*","matchCriteriaId":"9E2DBD4C-9DD9-4DD3-87CB-A0070A789CEA","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nInput: uinput - fix circular locking dependency with ff-core\n\nA lockdep circular locking dependency warning can be triggered\nreproducibly when using a force-feedback gamepad with uinput (for\nexample, playing ELDEN RING under Wine with a Flydigi Vader 5\ncontroller):\n\n ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex\n\nThe cycle is caused by four lock acquisition paths:\n\n1. ff upload: input_ff_upload() holds ff->mutex and calls\n uinput_dev_upload_effect() -> uinput_request_submit() ->\n uinput_request_send(), which acquires udev->mutex.\n\n2. device create: uinput_ioctl_handler() holds udev->mutex and calls\n uinput_create_device() -> input_register_device(), which acquires\n input_mutex.\n\n3. device register: input_register_device() holds input_mutex and\n calls kbd_connect() -> input_register_handle(), which acquires\n dev->mutex.\n\n4. evdev release: evdev_release() calls input_flush_device() under\n dev->mutex, which calls input_ff_flush() acquiring ff->mutex.\n\nFix this by introducing a new state_lock spinlock to protect\nudev->state and udev->dev access in uinput_request_send() instead of\nacquiring udev->mutex. The function only needs to atomically check\ndevice state and queue an input event into the ring buffer via\nuinput_dev_event() -- both operations are safe under a spinlock\n(ktime_get_ts64() and wake_up_interruptible() do not sleep). This\nbreaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in\nthe lock ordering and cannot form cycles with mutexes.\n\nTo keep state transitions visible to uinput_request_send(), protect\nwrites to udev->state in uinput_create_device() and\nuinput_destroy_device() with the same state_lock spinlock.\n\nAdditionally, move init_completion(&request->done) from\nuinput_request_send() to uinput_request_submit() before\nuinput_request_reserve_slot(). Once the slot is allocated,\nuinput_flush_requests() may call complete() on it at any time from\nthe destroy path, so the completion must be initialised before the\nrequest becomes visible.\n\nLock ordering after the fix:\n\n ff->mutex -> state_lock (spinlock, leaf)\n udev->mutex -> state_lock (spinlock, leaf)\n udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nEntrada: uinput - corrige la dependencia de bloqueo circular con ff-core\n\nUna advertencia de dependencia de bloqueo circular de lockdep puede ser activada de forma reproducible al usar un gamepad con retroalimentación de fuerza con uinput (por ejemplo, jugando ELDEN RING bajo Wine con un controlador Flydigi Vader 5):\n\nff -> mutex -> udev -> mutex -> input_mutex -> dev -> mutex -> ff -> mutex\n\nEl ciclo es causado por cuatro rutas de adquisición de bloqueo:\n\n1. Carga de ff: input_ff_upload() mantiene ff -> mutex y llama a uinput_dev_upload_effect() -> uinput_request_submit() -> uinput_request_send(), que adquiere udev -> mutex.\n\n2. Creación de dispositivo: uinput_ioctl_handler() mantiene udev -> mutex y llama a uinput_create_device() -> input_register_device(), que adquiere input_mutex.\n\n3. Registro de dispositivo: input_register_device() mantiene input_mutex y llama a kbd_connect() -> input_register_handle(), que adquiere dev -> mutex.\n\n4. Liberación de evdev: evdev_release() llama a input_flush_device() bajo dev -> mutex, que llama a input_ff_flush() adquiriendo ff -> mutex.\n\nSoluciona esto introduciendo un nuevo spinlock state_lock para proteger el acceso a udev -> state y udev -> dev en uinput_request_send() en lugar de adquirir udev -> mutex. La función solo necesita verificar atómicamente el estado del dispositivo y encolar un evento de entrada en el búfer circular a través de uinput_dev_event() - - ambas operaciones son seguras bajo un spinlock (ktime_get_ts64() y wake_up_interruptible() no se suspenden). Esto rompe el enlace ff -> mutex -> udev -> mutex ya que un spinlock es una hoja en el orden de bloqueo y no puede formar ciclos con mutexes.\n\nPara mantener las transiciones de estado visibles para uinput_request_send(), protege las escrituras en udev -> state en uinput_create_device() y uinput_destroy_device() con el mismo spinlock state_lock.\n\nAdemás, mueve init_completion(ref:request -> done) de uinput_request_send() a uinput_request_submit() antes de uinput_request_reserve_slot(). Una vez que la ranura es asignada, uinput_flush_requests() puede llamar a complete() sobre ella en cualquier momento desde la ruta de destrucción, por lo que la finalización debe ser inicializada antes de que la solicitud se haga visible.\n\nOrden de bloqueo después de la corrección:\n\nff -> mutex -> state_lock (spinlock, hoja)\nudev -> mutex -> state_lock (spinlock, hoja)\nudev -> mutex -> input_mutex -> dev -> mutex -> ff -> mutex (sin arista de retorno)"}],"id":"CVE-2026-31667","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31667","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:55.311439Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.390","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1534661043c434b81cfde26b97a2fb2460329cf0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1e09dfbb4f5d20ee111f92325a00f85778a5f328"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/271ee71a1917b89f6d73ec82dd091c33d92ee617"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cda78d6f8bf2b700529f2fbccb994c3e826d7c2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/546c18a14924eb521fe168d916d7ce28f1e13c1d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/71a9729f412e2c692a35c542e14b706fb342927f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/974f7b138c3a96dd5cd53d1b33409cd7b2229dc6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a3d6c9c053c9c605651508569230ead633b13f76"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31668.json b/data/2026/CVE-2026-31668.json index cdbe2e3a6a..963f759915 100644 --- a/data/2026/CVE-2026-31668.json +++ b/data/2026/CVE-2026-31668.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/seg6_iptunnel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1dec91d3b1cefb82635761b7812154af3ef46449","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"750569d6987a0ff46317a4b86eb3907e296287bf","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"57d0374d14fa667dec6952173b93e7e84486d5c9","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"84d458018b147176b259347103fccb7e93abd2b1","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"6305ad032b03d2ea4181b953a66e19a9a6ed053c","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"fb56de5d99218de49d5d43ef3a99e062ecd0f9a1","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"c3812651b522fe8437ebb7063b75ddb95b571643","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/seg6_iptunnel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C0D3F33A-9B37-46EB-A8C3-97B2F00C65EB","versionEndExcluding":"5.10.253","versionStartIncluding":"4.10.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.10:-:*:*:*:*:*:*","matchCriteriaId":"C201E405-86F2-4F96-984A-00A865219C86","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: separate dst_cache for input and output paths in seg6 lwtunnel\n\nThe seg6 lwtunnel uses a single dst_cache per encap route, shared\nbetween seg6_input_core() and seg6_output_core(). These two paths\ncan perform the post-encap SID lookup in different routing contexts\n(e.g., ip rules matching on the ingress interface, or VRF table\nseparation). Whichever path runs first populates the cache, and the\nother reuses it blindly, bypassing its own lookup.\n\nFix this by splitting the cache into cache_input and cache_output,\nso each path maintains its own cached dst independently."}],"id":"CVE-2026-31668","lastModified":"2026-10-19T19:18:04.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31668","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:58.632847Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.533","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-459"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/seg6_iptunnel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1dec91d3b1cefb82635761b7812154af3ef46449","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"750569d6987a0ff46317a4b86eb3907e296287bf","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"57d0374d14fa667dec6952173b93e7e84486d5c9","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"84d458018b147176b259347103fccb7e93abd2b1","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"6305ad032b03d2ea4181b953a66e19a9a6ed053c","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"fb56de5d99218de49d5d43ef3a99e062ecd0f9a1","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"},{"lessThan":"c3812651b522fe8437ebb7063b75ddb95b571643","status":"affected","version":"6c8702c60b88651072460f3f4026c7dfe2521d12","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/seg6_iptunnel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.10"},{"lessThan":"4.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C0D3F33A-9B37-46EB-A8C3-97B2F00C65EB","versionEndExcluding":"5.10.253","versionStartIncluding":"4.10.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.10:-:*:*:*:*:*:*","matchCriteriaId":"C201E405-86F2-4F96-984A-00A865219C86","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: separate dst_cache for input and output paths in seg6 lwtunnel\n\nThe seg6 lwtunnel uses a single dst_cache per encap route, shared\nbetween seg6_input_core() and seg6_output_core(). These two paths\ncan perform the post-encap SID lookup in different routing contexts\n(e.g., ip rules matching on the ingress interface, or VRF table\nseparation). Whichever path runs first populates the cache, and the\nother reuses it blindly, bypassing its own lookup.\n\nFix this by splitting the cache into cache_input and cache_output,\nso each path maintains its own cached dst independently."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nseg6: separar dst_cache para las rutas de entrada y salida en el lwtunnel seg6\n\nEl lwtunnel seg6 utiliza una única dst_cache por ruta de encapsulación, compartida entre seg6_input_core() y seg6_output_core(). Estas dos rutas pueden realizar la búsqueda de SID post-encapsulación en diferentes contextos de enrutamiento (por ejemplo, reglas IP que coinciden en la interfaz de entrada, o separación de tablas VRF). Cualquiera de las rutas que se ejecute primero rellena la caché, y la otra la reutiliza ciegamente, omitiendo su propia búsqueda.\n\nEsto se soluciona dividiendo la caché en cache_input y cache_output, para que cada ruta mantenga su propia dst en caché de forma independiente."}],"id":"CVE-2026-31668","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31668","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:11:58.632847Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.533","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-459"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31669.json b/data/2026/CVE-2026-31669.json index 6cc2a272ed..d33eecf7e8 100644 --- a/data/2026/CVE-2026-31669.json +++ b/data/2026/CVE-2026-31669.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/mptcp/protocol.c","net/mptcp/protocol.h","net/mptcp/subflow.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"},{"lessThan":"fb1f54b7d16f393b8b65d328410f78b4beea8fcc","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"},{"lessThan":"3fd6547f5b8ac99687be6d937a0321efda760597","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"},{"lessThan":"eb9c6aeb512f877cf397deb1e4526f646c70e4a7","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"},{"lessThan":"15fa9ead4d5e6b6b9c794e84144146c917f2cb62","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"},{"lessThan":"b313e9037d98c13938740e5ebda7852929366dff","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"},{"lessThan":"9b55b253907e7431210483519c5ad711a37dafa1","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/mptcp/protocol.c","net/mptcp/protocol.h","net/mptcp/subflow.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AA3D6441-4F2E-41AB-A26D-388B03A5932F","versionEndExcluding":"5.15.203","versionStartIncluding":"5.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:*","matchCriteriaId":"75EB504D-4A83-4C67-9C8D-FD9C6C8EB4CD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix slab-use-after-free in __inet_lookup_established\n\nThe ehash table lookups are lockless and rely on\nSLAB_TYPESAFE_BY_RCU to guarantee socket memory stability\nduring RCU read-side critical sections. Both tcp_prot and\ntcpv6_prot have their slab caches created with this flag\nvia proto_register().\n\nHowever, MPTCP's mptcp_subflow_init() copies tcpv6_prot into\ntcpv6_prot_override during inet_init() (fs_initcall, level 5),\nbefore inet6_init() (module_init/device_initcall, level 6) has\ncalled proto_register(&tcpv6_prot). At that point,\ntcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab\nremains NULL permanently.\n\nThis causes MPTCP v6 subflow child sockets to be allocated via\nkmalloc (falling into kmalloc-4k) instead of the TCPv6 slab\ncache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so\nwhen these sockets are freed without SOCK_RCU_FREE (which is\ncleared for child sockets by design), the memory can be\nimmediately reused. Concurrent ehash lookups under\nrcu_read_lock can then access freed memory, triggering a\nslab-use-after-free in __inet_lookup_established.\n\nFix this by splitting the IPv6-specific initialization out of\nmptcp_subflow_init() into a new mptcp_subflow_v6_init(), called\nfrom mptcp_proto_v6_init() before protocol registration. This\nensures tcpv6_prot_override.slab correctly inherits the\nSLAB_TYPESAFE_BY_RCU slab cache."}],"id":"CVE-2026-31669","lastModified":"2026-11-10T13:19:02.537","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31669","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:01.538596Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.663","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/15fa9ead4d5e6b6b9c794e84144146c917f2cb62"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3fd6547f5b8ac99687be6d937a0321efda760597"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b55b253907e7431210483519c5ad711a37dafa1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b313e9037d98c13938740e5ebda7852929366dff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb9c6aeb512f877cf397deb1e4526f646c70e4a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb1f54b7d16f393b8b65d328410f78b4beea8fcc"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/mptcp/protocol.c","net/mptcp/protocol.h","net/mptcp/subflow.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"},{"lessThan":"fb1f54b7d16f393b8b65d328410f78b4beea8fcc","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"},{"lessThan":"3fd6547f5b8ac99687be6d937a0321efda760597","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"},{"lessThan":"eb9c6aeb512f877cf397deb1e4526f646c70e4a7","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"},{"lessThan":"15fa9ead4d5e6b6b9c794e84144146c917f2cb62","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"},{"lessThan":"b313e9037d98c13938740e5ebda7852929366dff","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"},{"lessThan":"9b55b253907e7431210483519c5ad711a37dafa1","status":"affected","version":"b19bc2945b40b9fd38e835700907ffe8534ef0de","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/mptcp/protocol.c","net/mptcp/protocol.h","net/mptcp/subflow.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"AA3D6441-4F2E-41AB-A26D-388B03A5932F","versionEndExcluding":"5.15.203","versionStartIncluding":"5.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:5.12:-:*:*:*:*:*:*","matchCriteriaId":"75EB504D-4A83-4C67-9C8D-FD9C6C8EB4CD","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix slab-use-after-free in __inet_lookup_established\n\nThe ehash table lookups are lockless and rely on\nSLAB_TYPESAFE_BY_RCU to guarantee socket memory stability\nduring RCU read-side critical sections. Both tcp_prot and\ntcpv6_prot have their slab caches created with this flag\nvia proto_register().\n\nHowever, MPTCP's mptcp_subflow_init() copies tcpv6_prot into\ntcpv6_prot_override during inet_init() (fs_initcall, level 5),\nbefore inet6_init() (module_init/device_initcall, level 6) has\ncalled proto_register(&tcpv6_prot). At that point,\ntcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab\nremains NULL permanently.\n\nThis causes MPTCP v6 subflow child sockets to be allocated via\nkmalloc (falling into kmalloc-4k) instead of the TCPv6 slab\ncache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so\nwhen these sockets are freed without SOCK_RCU_FREE (which is\ncleared for child sockets by design), the memory can be\nimmediately reused. Concurrent ehash lookups under\nrcu_read_lock can then access freed memory, triggering a\nslab-use-after-free in __inet_lookup_established.\n\nFix this by splitting the IPv6-specific initialization out of\nmptcp_subflow_init() into a new mptcp_subflow_v6_init(), called\nfrom mptcp_proto_v6_init() before protocol registration. This\nensures tcpv6_prot_override.slab correctly inherits the\nSLAB_TYPESAFE_BY_RCU slab cache."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmptcp: corrige el uso después de liberación de slab en __inet_lookup_established\n\nLas búsquedas en la tabla ehash no tienen bloqueo y dependen de SLAB_TYPESAFE_BY_RCU para garantizar la estabilidad de la memoria del socket durante las secciones críticas del lado de lectura de RCU. Tanto tcp_prot como tcpv6_prot tienen sus cachés de slab creadas con esta bandera a través de proto_register().\n\nSin embargo, mptcp_subflow_init() de MPTCP copia tcpv6_prot en tcpv6_prot_override durante inet_init() (fs_initcall, nivel 5), antes de que inet6_init() (module_init/device_initcall, nivel 6) haya llamado a proto_register(ref:tcpv6_prot). En ese punto, tcpv6_prot.slab sigue siendo NULL, por lo que tcpv6_prot_override.slab permanece NULL permanentemente.\n\nEsto hace que los sockets hijos de subflujo MPTCP v6 se asignen a través de kmalloc (cayendo en kmalloc-4k) en lugar de la caché de slab de TCPv6. La caché kmalloc-4k carece de SLAB_TYPESAFE_BY_RCU, por lo que cuando estos sockets se liberan sin SOCK_RCU_FREE (que se borra para los sockets hijos por diseño), la memoria puede ser reutilizada inmediatamente. Las búsquedas concurrentes de ehash bajo rcu_read_lock pueden entonces acceder a memoria liberada, desencadenando un uso después de liberación de slab en __inet_lookup_established.\n\nEsto se corrige dividiendo la inicialización específica de IPv6 de mptcp_subflow_init() en una nueva mptcp_subflow_v6_init(), llamada desde mptcp_proto_v6_init() antes del registro del protocolo. Esto asegura que tcpv6_prot_override.slab herede correctamente la caché de slab SLAB_TYPESAFE_BY_RCU."}],"id":"CVE-2026-31669","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31669","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:01.538596Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.663","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/15fa9ead4d5e6b6b9c794e84144146c917f2cb62"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3fd6547f5b8ac99687be6d937a0321efda760597"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9b55b253907e7431210483519c5ad711a37dafa1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b313e9037d98c13938740e5ebda7852929366dff"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb9c6aeb512f877cf397deb1e4526f646c70e4a7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fb1f54b7d16f393b8b65d328410f78b4beea8fcc"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-416"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31670.json b/data/2026/CVE-2026-31670.json index 78fca60723..feadefffde 100644 --- a/data/2026/CVE-2026-31670.json +++ b/data/2026/CVE-2026-31670.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rfkill/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4bcd1615a4e2a185ae9edd27b4143d7dfa7134f4","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"b1e0c8d3ab58a0161db487bf5fc47adfcaf5d5ca","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"e3842779547c83150569071d9980517cc9029fc0","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"673d2a3eef6e0ee9736501a150c9e4024a4e60a6","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"82843afc19012a29ba863961ef494165aa1a88f4","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"a8c26800e0220e1550af012f5a20e50f5c78864d","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"80ce4cb026f0a4c4532b6cad827b44debda6256a","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"ea245d78dec594372e27d8c79616baf49e98a4a1","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rfkill/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"57E89197-6305-4D47-AE24-4D5D20CC8429","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.31.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.31:-:*:*:*:*:*:*","matchCriteriaId":"2887290A-1B43-4DB9-A9D0-B0B56CD78E48","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rfkill: prevent unlimited numbers of rfkill events from being created\n\nUserspace can create an unlimited number of rfkill events if the system\nis so configured, while not consuming them from the rfkill file\ndescriptor, causing a potential out of memory situation. Prevent this\nfrom bounding the number of pending rfkill events at a \"large\" number\n(i.e. 1000) to prevent abuses like this."}],"id":"CVE-2026-31670","lastModified":"2026-11-10T13:19:02.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31670","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:51.691768Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.790","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4bcd1615a4e2a185ae9edd27b4143d7dfa7134f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/673d2a3eef6e0ee9736501a150c9e4024a4e60a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/80ce4cb026f0a4c4532b6cad827b44debda6256a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/82843afc19012a29ba863961ef494165aa1a88f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a8c26800e0220e1550af012f5a20e50f5c78864d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b1e0c8d3ab58a0161db487bf5fc47adfcaf5d5ca"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e3842779547c83150569071d9980517cc9029fc0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea245d78dec594372e27d8c79616baf49e98a4a1"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rfkill/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4bcd1615a4e2a185ae9edd27b4143d7dfa7134f4","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"b1e0c8d3ab58a0161db487bf5fc47adfcaf5d5ca","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"e3842779547c83150569071d9980517cc9029fc0","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"673d2a3eef6e0ee9736501a150c9e4024a4e60a6","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"82843afc19012a29ba863961ef494165aa1a88f4","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"a8c26800e0220e1550af012f5a20e50f5c78864d","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"80ce4cb026f0a4c4532b6cad827b44debda6256a","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"},{"lessThan":"ea245d78dec594372e27d8c79616baf49e98a4a1","status":"affected","version":"c64fb01627e24725d1f9d535e4426475a4415753","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rfkill/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.31"},{"lessThan":"2.6.31","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"57E89197-6305-4D47-AE24-4D5D20CC8429","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.31.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.31:-:*:*:*:*:*:*","matchCriteriaId":"2887290A-1B43-4DB9-A9D0-B0B56CD78E48","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rfkill: prevent unlimited numbers of rfkill events from being created\n\nUserspace can create an unlimited number of rfkill events if the system\nis so configured, while not consuming them from the rfkill file\ndescriptor, causing a potential out of memory situation. Prevent this\nfrom bounding the number of pending rfkill events at a \"large\" number\n(i.e. 1000) to prevent abuses like this."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: rfkill: evitar que se creen números ilimitados de eventos rfkill\n\nEl espacio de usuario puede crear un número ilimitado de eventos rfkill si el sistema está configurado de esa manera, sin consumirlos del descriptor de archivo rfkill, lo que causa una potencial situación de falta de memoria. Esto se previene al limitar el número de eventos rfkill pendientes a un número ’grande’ (es decir, 1000) para evitar abusos como este."}],"id":"CVE-2026-31670","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31670","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:51.691768Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.790","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4bcd1615a4e2a185ae9edd27b4143d7dfa7134f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/673d2a3eef6e0ee9736501a150c9e4024a4e60a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/80ce4cb026f0a4c4532b6cad827b44debda6256a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/82843afc19012a29ba863961ef494165aa1a88f4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a8c26800e0220e1550af012f5a20e50f5c78864d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b1e0c8d3ab58a0161db487bf5fc47adfcaf5d5ca"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e3842779547c83150569071d9980517cc9029fc0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ea245d78dec594372e27d8c79616baf49e98a4a1"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31671.json b/data/2026/CVE-2026-31671.json index b18a7e6ac1..bb39c22443 100644 --- a/data/2026/CVE-2026-31671.json +++ b/data/2026/CVE-2026-31671.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d27c02eec529f78055a46a5c9e6c62684382b2d8","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"716c546e88cfe49d841658240e10cb57bc50a2cc","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"0616314b3b34f24cbb91da8c6bd8bcdc4c8592f9","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"e0c8542c3d097ed4205ded51868195d5d6ddac62","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"ff5ee507302303b15859753c3e0d67d38fd12c88","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"6c55714c931051cd7f4839c19ce0867179fd22fe","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"0a30dceb0e1f0c480d2482e6d7cebf8aebb6eb72","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"d10119968d0e1f2b669604baf2a8b5fdb72fa6b4","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.19"},{"lessThan":"2.6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"59C4CD77-5444-4760-B0D8-F238740397B4","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:-:*:*:*:*:*:*","matchCriteriaId":"9E2DBD4C-9DD9-4DD3-87CB-A0070A789CEA","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm_user: fix info leak in build_report()\n\nstruct xfrm_user_report is a __u8 proto field followed by a struct\nxfrm_selector which means there is three \"empty\" bytes of padding, but\nthe padding is never zeroed before copying to userspace. Fix that up by\nzeroing the structure before setting individual member variables."}],"id":"CVE-2026-31671","lastModified":"2026-11-10T13:19:02.963","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31671","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:57.236278Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.903","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0616314b3b34f24cbb91da8c6bd8bcdc4c8592f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a30dceb0e1f0c480d2482e6d7cebf8aebb6eb72"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6c55714c931051cd7f4839c19ce0867179fd22fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/716c546e88cfe49d841658240e10cb57bc50a2cc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d10119968d0e1f2b669604baf2a8b5fdb72fa6b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d27c02eec529f78055a46a5c9e6c62684382b2d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0c8542c3d097ed4205ded51868195d5d6ddac62"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ff5ee507302303b15859753c3e0d67d38fd12c88"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d27c02eec529f78055a46a5c9e6c62684382b2d8","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"716c546e88cfe49d841658240e10cb57bc50a2cc","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"0616314b3b34f24cbb91da8c6bd8bcdc4c8592f9","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"e0c8542c3d097ed4205ded51868195d5d6ddac62","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"ff5ee507302303b15859753c3e0d67d38fd12c88","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"6c55714c931051cd7f4839c19ce0867179fd22fe","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"0a30dceb0e1f0c480d2482e6d7cebf8aebb6eb72","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"},{"lessThan":"d10119968d0e1f2b669604baf2a8b5fdb72fa6b4","status":"affected","version":"97a64b4577ae2bc5599dbd008a3cd9e25de9b9f5","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.19"},{"lessThan":"2.6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"59C4CD77-5444-4760-B0D8-F238740397B4","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.19:-:*:*:*:*:*:*","matchCriteriaId":"9E2DBD4C-9DD9-4DD3-87CB-A0070A789CEA","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm_user: fix info leak in build_report()\n\nstruct xfrm_user_report is a __u8 proto field followed by a struct\nxfrm_selector which means there is three \"empty\" bytes of padding, but\nthe padding is never zeroed before copying to userspace. Fix that up by\nzeroing the structure before setting individual member variables."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nxfrm_user: corrige fuga de información en build_report()\n\nLa estructura xfrm_user_report es un campo __u8 proto seguido por una estructura xfrm_selector, lo que significa que hay tres bytes de relleno ’vacíos’, pero el relleno nunca se pone a cero antes de copiar al espacio de usuario. Se soluciona poniendo a cero la estructura antes de establecer las variables miembro individuales."}],"id":"CVE-2026-31671","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31671","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:23:57.236278Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:46.903","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0616314b3b34f24cbb91da8c6bd8bcdc4c8592f9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0a30dceb0e1f0c480d2482e6d7cebf8aebb6eb72"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6c55714c931051cd7f4839c19ce0867179fd22fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/716c546e88cfe49d841658240e10cb57bc50a2cc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d10119968d0e1f2b669604baf2a8b5fdb72fa6b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d27c02eec529f78055a46a5c9e6c62684382b2d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e0c8542c3d097ed4205ded51868195d5d6ddac62"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ff5ee507302303b15859753c3e0d67d38fd12c88"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31672.json b/data/2026/CVE-2026-31672.json index 9bb97ee6bb..af1e112b81 100644 --- a/data/2026/CVE-2026-31672.json +++ b/data/2026/CVE-2026-31672.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/ralink/rt2x00/rt2x00usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"64a457f6afbf15f984d95201a9a1e71eed3f9dd1","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"65518a6965d527c53013947031f26754f6a4f6af","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"15b233e33b35b927bd8d0044c15325564ea1ba24","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"1de5c76bf40e9cdeebf54662f63011fb10fa452f","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"b245db719bc7e57abf48bd5701662b270c3880f7","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"e360d15fcb1e819eef49e3d4434d8050542eed16","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"c99f198841b41735796e2ddfcd573783fb552eb9","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"25369b22223d1c56e42a0cd4ac9137349d5a898e","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/ralink/rt2x00/rt2x00usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.7"},{"lessThan":"4.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14F22FD3-1924-4551-8861-3022ADC6AACE","versionEndExcluding":"5.10.253","versionStartIncluding":"4.7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.7:-:*:*:*:*:*:*","matchCriteriaId":"2F890998-2B89-4DE8-BA87-5B3D9A5E8E11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rt2x00usb: fix devres lifetime\n\nUSB drivers bind to USB interfaces and any device managed resources\nshould have their lifetime tied to the interface rather than parent USB\ndevice. This avoids issues like memory leaks when drivers are unbound\nwithout their devices being physically disconnected (e.g. on probe\ndeferral or configuration changes).\n\nFix the USB anchor lifetime so that it is released on driver unbind."}],"id":"CVE-2026-31672","lastModified":"2026-11-06T16:18:07.007","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31672","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:01.713898Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:47.017","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/15b233e33b35b927bd8d0044c15325564ea1ba24"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1de5c76bf40e9cdeebf54662f63011fb10fa452f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25369b22223d1c56e42a0cd4ac9137349d5a898e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/64a457f6afbf15f984d95201a9a1e71eed3f9dd1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65518a6965d527c53013947031f26754f6a4f6af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b245db719bc7e57abf48bd5701662b270c3880f7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c99f198841b41735796e2ddfcd573783fb552eb9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e360d15fcb1e819eef49e3d4434d8050542eed16"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/wireless/ralink/rt2x00/rt2x00usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"64a457f6afbf15f984d95201a9a1e71eed3f9dd1","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"65518a6965d527c53013947031f26754f6a4f6af","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"15b233e33b35b927bd8d0044c15325564ea1ba24","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"1de5c76bf40e9cdeebf54662f63011fb10fa452f","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"b245db719bc7e57abf48bd5701662b270c3880f7","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"e360d15fcb1e819eef49e3d4434d8050542eed16","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"c99f198841b41735796e2ddfcd573783fb552eb9","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"},{"lessThan":"25369b22223d1c56e42a0cd4ac9137349d5a898e","status":"affected","version":"8b4c0009313f3d42e2540e3e1f776097dd0db73d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/wireless/ralink/rt2x00/rt2x00usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.7"},{"lessThan":"4.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"14F22FD3-1924-4551-8861-3022ADC6AACE","versionEndExcluding":"5.10.253","versionStartIncluding":"4.7.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"DBEC0E5D-641C-4E98-A6D9-5799B10CE451","versionEndExcluding":"6.1.169","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:4.7:-:*:*:*:*:*:*","matchCriteriaId":"2F890998-2B89-4DE8-BA87-5B3D9A5E8E11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rt2x00usb: fix devres lifetime\n\nUSB drivers bind to USB interfaces and any device managed resources\nshould have their lifetime tied to the interface rather than parent USB\ndevice. This avoids issues like memory leaks when drivers are unbound\nwithout their devices being physically disconnected (e.g. on probe\ndeferral or configuration changes).\n\nFix the USB anchor lifetime so that it is released on driver unbind."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwifi: rt2x00usb: corregir la vida útil de devres\n\nLos controladores USB se enlazan a interfaces USB y cualquier recurso gestionado por el dispositivo debería tener su vida útil ligada a la interfaz en lugar de al dispositivo USB padre. Esto evita problemas como fugas de memoria cuando los controladores se desenlazan sin que sus dispositivos se desconecten físicamente (p. ej., en aplazamiento de sondeo o cambios de configuración).\n\nCorregir la vida útil del ancla USB para que se libere al desenlazarse el controlador."}],"id":"CVE-2026-31672","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31672","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:01.713898Z","version":"2.0.3"}}]},"published":"2026-04-24T15:16:47.017","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/15b233e33b35b927bd8d0044c15325564ea1ba24"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1de5c76bf40e9cdeebf54662f63011fb10fa452f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/25369b22223d1c56e42a0cd4ac9137349d5a898e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/64a457f6afbf15f984d95201a9a1e71eed3f9dd1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/65518a6965d527c53013947031f26754f6a4f6af"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b245db719bc7e57abf48bd5701662b270c3880f7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c99f198841b41735796e2ddfcd573783fb552eb9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/e360d15fcb1e819eef49e3d4434d8050542eed16"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-401"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31673.json b/data/2026/CVE-2026-31673.json index 5de1b1bc30..093b706858 100644 --- a/data/2026/CVE-2026-31673.json +++ b/data/2026/CVE-2026-31673.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/unix/diag.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e7339db13b9ddb63417b12da55fd6191e59f7442","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"c3ec44ab4526bbc4b6c9fc845af86488244f4c9b","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"b9232421a77a649c9376c99fdfc8cb7f79cad34c","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"0c739f3785f84af695952c2bac8be2f45082c9b8","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"900a4e0910e98b8caef117d5df00471fa438dcf9","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"bdf206e740bf2919d818f132c8c9cc7ed91d11c0","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"39897df386376912d561d4946499379effa1e7ef","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/unix/diag.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.3"},{"lessThan":"3.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FAB12062-558C-4570-A908-D71195858ADA","versionEndExcluding":"6.6.136","versionStartIncluding":"3.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: read UNIX_DIAG_VFS data under unix_state_lock\n\nExact UNIX diag lookups hold a reference to the socket, but not to\nu->path. Meanwhile, unix_release_sock() clears u->path under\nunix_state_lock() and drops the path reference after unlocking.\n\nRead the inode and device numbers for UNIX_DIAG_VFS while holding\nunix_state_lock(), then emit the netlink attribute after dropping the\nlock.\n\nThis keeps the VFS data stable while the reply is being built."}],"id":"CVE-2026-31673","lastModified":"2026-10-19T19:18:05.163","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31673","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:05.532062Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:00.423","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/unix/diag.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e7339db13b9ddb63417b12da55fd6191e59f7442","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"c3ec44ab4526bbc4b6c9fc845af86488244f4c9b","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"b9232421a77a649c9376c99fdfc8cb7f79cad34c","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"0c739f3785f84af695952c2bac8be2f45082c9b8","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"900a4e0910e98b8caef117d5df00471fa438dcf9","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"bdf206e740bf2919d818f132c8c9cc7ed91d11c0","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"},{"lessThan":"39897df386376912d561d4946499379effa1e7ef","status":"affected","version":"5f7b0569460b7d8d01ca776430a00505a68b7584","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/unix/diag.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.3"},{"lessThan":"3.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"FAB12062-558C-4570-A908-D71195858ADA","versionEndExcluding":"6.6.136","versionStartIncluding":"3.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: read UNIX_DIAG_VFS data under unix_state_lock\n\nExact UNIX diag lookups hold a reference to the socket, but not to\nu->path. Meanwhile, unix_release_sock() clears u->path under\nunix_state_lock() and drops the path reference after unlocking.\n\nRead the inode and device numbers for UNIX_DIAG_VFS while holding\nunix_state_lock(), then emit the netlink attribute after dropping the\nlock.\n\nThis keeps the VFS data stable while the reply is being built."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\naf_unix: leer datos de UNIX_DIAG_VFS bajo unix_state_lock\n\nLas búsquedas de diagnóstico UNIX exactas mantienen una referencia al socket, pero no a u -> path. Mientras tanto, unix_release_sock() borra u -> path bajo unix_state_lock() y libera la referencia de la ruta después de desbloquear.\n\nLeer los números de inodo y de dispositivo para UNIX_DIAG_VFS mientras se mantiene unix_state_lock(), luego emitir el atributo netlink después de liberar el bloqueo.\n\nEsto mantiene los datos VFS estables mientras se construye la respuesta."}],"id":"CVE-2026-31673","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31673","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:05.532062Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:00.423","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31674.json b/data/2026/CVE-2026-31674.json index d35a439863..034fc9db89 100644 --- a/data/2026/CVE-2026-31674.json +++ b/data/2026/CVE-2026-31674.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/netfilter/ip6t_rt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"13e3e30ed3b5b67cc1db2bd58a5d09b0f07debfa","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"af9b7e2b765966457f4ec23be5bd34a141f89574","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"29ea965a1353bc8303877422f79c8211e9ba9c55","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"c6a503a9f4debc654e3a6a7ca1f7fce6a9953c59","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ded71f5684df16fa645cca5bf4fe6b0cd8a46119","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"d8795fde1f78669a87c87ac29fceab2f104daa8c","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"a28ebf6f99de270d6338ccdc3b49f3e818f99b7b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"9d3f027327c2fa265f7f85ead41294792c3296ed","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/netfilter/ip6t_rt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5F0E43E1-33E5-4828-9B4A-F710AF2E7217","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()\n\nReject rt match rules whose addrnr exceeds IP6T_RT_HOPS.\n\nrt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[].\nValidate addrnr during rule installation so malformed rules are rejected\nbefore the match logic can use an out-of-range value."}],"id":"CVE-2026-31674","lastModified":"2026-11-10T13:19:03.173","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31674","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:07.905080Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:00.963","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/13e3e30ed3b5b67cc1db2bd58a5d09b0f07debfa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29ea965a1353bc8303877422f79c8211e9ba9c55"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d3f027327c2fa265f7f85ead41294792c3296ed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a28ebf6f99de270d6338ccdc3b49f3e818f99b7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/af9b7e2b765966457f4ec23be5bd34a141f89574"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c6a503a9f4debc654e3a6a7ca1f7fce6a9953c59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8795fde1f78669a87c87ac29fceab2f104daa8c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ded71f5684df16fa645cca5bf4fe6b0cd8a46119"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/netfilter/ip6t_rt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"13e3e30ed3b5b67cc1db2bd58a5d09b0f07debfa","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"af9b7e2b765966457f4ec23be5bd34a141f89574","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"29ea965a1353bc8303877422f79c8211e9ba9c55","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"c6a503a9f4debc654e3a6a7ca1f7fce6a9953c59","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"ded71f5684df16fa645cca5bf4fe6b0cd8a46119","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"d8795fde1f78669a87c87ac29fceab2f104daa8c","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"a28ebf6f99de270d6338ccdc3b49f3e818f99b7b","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"9d3f027327c2fa265f7f85ead41294792c3296ed","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/netfilter/ip6t_rt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"5F0E43E1-33E5-4828-9B4A-F710AF2E7217","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()\n\nReject rt match rules whose addrnr exceeds IP6T_RT_HOPS.\n\nrt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[].\nValidate addrnr during rule installation so malformed rules are rejected\nbefore the match logic can use an out-of-range value."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: ip6t_rt: rechazar addrnr sobredimensionado en rt_mt6_check()\n\nRechazar reglas de coincidencia rt cuyo addrnr excede IP6T_RT_HOPS.\n\nrt_mt6() espera que addrnr permanezca dentro de los límites de rtinfo -> addrs[]. Validar addrnr durante la instalación de la regla para que las reglas malformadas sean rechazadas antes de que la lógica de coincidencia pueda usar un valor fuera de rango."}],"id":"CVE-2026-31674","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31674","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:07.905080Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:00.963","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/13e3e30ed3b5b67cc1db2bd58a5d09b0f07debfa"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29ea965a1353bc8303877422f79c8211e9ba9c55"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d3f027327c2fa265f7f85ead41294792c3296ed"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a28ebf6f99de270d6338ccdc3b49f3e818f99b7b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/af9b7e2b765966457f4ec23be5bd34a141f89574"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c6a503a9f4debc654e3a6a7ca1f7fce6a9953c59"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d8795fde1f78669a87c87ac29fceab2f104daa8c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ded71f5684df16fa645cca5bf4fe6b0cd8a46119"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31675.json b/data/2026/CVE-2026-31675.json index c0dcc71ab2..3ce6825ec9 100644 --- a/data/2026/CVE-2026-31675.json +++ b/data/2026/CVE-2026-31675.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/sch_netem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8d3de49c22ec0ec8f7199cc7e2b0559de7306f87","status":"affected","version":"c865e5d99e25a171e8262fc0f7ba608568633c64","versionType":"git"},{"lessThan":"a14b56863348686dd0387eea8ce66b85cf455908","status":"affected","version":"c865e5d99e25a171e8262fc0f7ba608568633c64","versionType":"git"},{"lessThan":"13a66ca1e235d4bcd53d12d4c68490cad7f8e46f","status":"affected","version":"c865e5d99e25a171e8262fc0f7ba608568633c64","versionType":"git"},{"lessThan":"3a2999704ac36cfb4041fed3652d26a3373e8d12","status":"affected","version":"c865e5d99e25a171e8262fc0f7ba608568633c64","versionType":"git"},{"lessThan":"4fd258e281fa8bc15e9ce2c7691941537e9258ad","status":"affected","version":"c865e5d99e25a171e8262fc0f7ba608568633c64","versionType":"git"},{"lessThan":"d64cb81dcbd54927515a7f65e5e24affdc73c14b","status":"affected","version":"c865e5d99e25a171e8262fc0f7ba608568633c64","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/sch_netem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.16"},{"lessThan":"2.6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"90B108FC-25D0-4DB9-9459-197836D737B2","versionEndExcluding":"6.6.134","versionStartIncluding":"2.6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_netem: fix out-of-bounds access in packet corruption\n\nIn netem_enqueue(), the packet corruption logic uses\nget_random_u32_below(skb_headlen(skb)) to select an index for\nmodifying skb->data. When an AF_PACKET TX_RING sends fully non-linear\npackets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.\n\nPassing 0 to get_random_u32_below() takes the variable-ceil slow path\nwhich returns an unconstrained 32-bit random integer. Using this\nunconstrained value as an offset into skb->data results in an\nout-of-bounds memory access.\n\nFix this by verifying skb_headlen(skb) is non-zero before attempting\nto corrupt the linear data area. Fully non-linear packets will silently\nbypass the corruption logic."}],"id":"CVE-2026-31675","lastModified":"2026-10-30T13:18:42.110","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31675","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:12.570875Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.100","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/13a66ca1e235d4bcd53d12d4c68490cad7f8e46f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a2999704ac36cfb4041fed3652d26a3373e8d12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4fd258e281fa8bc15e9ce2c7691941537e9258ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8d3de49c22ec0ec8f7199cc7e2b0559de7306f87"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a14b56863348686dd0387eea8ce66b85cf455908"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d64cb81dcbd54927515a7f65e5e24affdc73c14b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/sch_netem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8d3de49c22ec0ec8f7199cc7e2b0559de7306f87","status":"affected","version":"c865e5d99e25a171e8262fc0f7ba608568633c64","versionType":"git"},{"lessThan":"a14b56863348686dd0387eea8ce66b85cf455908","status":"affected","version":"c865e5d99e25a171e8262fc0f7ba608568633c64","versionType":"git"},{"lessThan":"13a66ca1e235d4bcd53d12d4c68490cad7f8e46f","status":"affected","version":"c865e5d99e25a171e8262fc0f7ba608568633c64","versionType":"git"},{"lessThan":"3a2999704ac36cfb4041fed3652d26a3373e8d12","status":"affected","version":"c865e5d99e25a171e8262fc0f7ba608568633c64","versionType":"git"},{"lessThan":"4fd258e281fa8bc15e9ce2c7691941537e9258ad","status":"affected","version":"c865e5d99e25a171e8262fc0f7ba608568633c64","versionType":"git"},{"lessThan":"d64cb81dcbd54927515a7f65e5e24affdc73c14b","status":"affected","version":"c865e5d99e25a171e8262fc0f7ba608568633c64","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/sch_netem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.16"},{"lessThan":"2.6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"90B108FC-25D0-4DB9-9459-197836D737B2","versionEndExcluding":"6.6.134","versionStartIncluding":"2.6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_netem: fix out-of-bounds access in packet corruption\n\nIn netem_enqueue(), the packet corruption logic uses\nget_random_u32_below(skb_headlen(skb)) to select an index for\nmodifying skb->data. When an AF_PACKET TX_RING sends fully non-linear\npackets over an IPIP tunnel, skb_headlen(skb) evaluates to 0.\n\nPassing 0 to get_random_u32_below() takes the variable-ceil slow path\nwhich returns an unconstrained 32-bit random integer. Using this\nunconstrained value as an offset into skb->data results in an\nout-of-bounds memory access.\n\nFix this by verifying skb_headlen(skb) is non-zero before attempting\nto corrupt the linear data area. Fully non-linear packets will silently\nbypass the corruption logic."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/sched: sch_netem: corrección de acceso fuera de límites en la corrupción de paquetes\n\nEn netem_enqueue(), la lógica de corrupción de paquetes utiliza get_random_u32_below(skb_headlen(skb)) para seleccionar un índice para modificar skb -> data. Cuando un AF_PACKET TX_RING envía paquetes completamente no lineales a través de un túnel IPIP, skb_headlen(skb) se evalúa a 0.\n\nPasar 0 a get_random_u32_below() toma la ruta lenta de techo variable que devuelve un entero aleatorio de 32 bits sin restricciones. Usar este valor sin restricciones como un desplazamiento en skb -> data resulta en un acceso a memoria fuera de límites.\n\nCorregir esto al verificar que skb_headlen(skb) no sea cero antes de intentar corromper el área de datos lineal. Los paquetes completamente no lineales omitirán silenciosamente la lógica de corrupción."}],"id":"CVE-2026-31675","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31675","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:12.570875Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.100","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/13a66ca1e235d4bcd53d12d4c68490cad7f8e46f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a2999704ac36cfb4041fed3652d26a3373e8d12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4fd258e281fa8bc15e9ce2c7691941537e9258ad"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8d3de49c22ec0ec8f7199cc7e2b0559de7306f87"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a14b56863348686dd0387eea8ce66b85cf455908"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d64cb81dcbd54927515a7f65e5e24affdc73c14b"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31676.json b/data/2026/CVE-2026-31676.json index c5339f4f5a..025711e39e 100644 --- a/data/2026/CVE-2026-31676.json +++ b/data/2026/CVE-2026-31676.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/conn_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a1a8efde03a40b6c658d580e96644d9b9a2a0d3a","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"6c3a0fbdafef8316e34ae22333e317a341e737cd","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"0afdfd4941c1b60a1f5c361760daa970edca60cd","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"a6bcf8010af093fe04f7100562e9542ab7882585","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"29b44d904dceb832be880def08b8cb17a0aba91c","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"d0035e634dae83237ab7f5681eb52b2f65d0ceb8","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"03fd2ef73cb4ffd0af100a95b634af54f474414e","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"c43ffdcfdbb5567b1f143556df8a04b4eeea041c","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/conn_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D32EF540-B97D-4378-A852-A6F166CF1E4B","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.22","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: only handle RESPONSE during service challenge\n\nOnly process RESPONSE packets while the service connection is still in\nRXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before\nrunning response verification and security initialization, then use a local\nsecured flag to decide whether to queue the secured-connection work after\nthe state transition. This keeps duplicate or late RESPONSE packets from\nre-running the setup path and removes the unlocked post-transition state\ntest."}],"id":"CVE-2026-31676","lastModified":"2026-10-19T19:18:05.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31676","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:15.479986Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.210","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03fd2ef73cb4ffd0af100a95b634af54f474414e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0afdfd4941c1b60a1f5c361760daa970edca60cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29b44d904dceb832be880def08b8cb17a0aba91c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6c3a0fbdafef8316e34ae22333e317a341e737cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a1a8efde03a40b6c658d580e96644d9b9a2a0d3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6bcf8010af093fe04f7100562e9542ab7882585"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c43ffdcfdbb5567b1f143556df8a04b4eeea041c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d0035e634dae83237ab7f5681eb52b2f65d0ceb8"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/rxrpc/conn_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a1a8efde03a40b6c658d580e96644d9b9a2a0d3a","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"6c3a0fbdafef8316e34ae22333e317a341e737cd","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"0afdfd4941c1b60a1f5c361760daa970edca60cd","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"a6bcf8010af093fe04f7100562e9542ab7882585","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"29b44d904dceb832be880def08b8cb17a0aba91c","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"d0035e634dae83237ab7f5681eb52b2f65d0ceb8","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"03fd2ef73cb4ffd0af100a95b634af54f474414e","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"},{"lessThan":"c43ffdcfdbb5567b1f143556df8a04b4eeea041c","status":"affected","version":"17926a79320afa9b95df6b977b40cca6d8713cea","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/rxrpc/conn_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.84","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D32EF540-B97D-4378-A852-A6F166CF1E4B","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.22","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7","versionEndExcluding":"6.12.84","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: only handle RESPONSE during service challenge\n\nOnly process RESPONSE packets while the service connection is still in\nRXRPC_CONN_SERVICE_CHALLENGING. Check that state under state_lock before\nrunning response verification and security initialization, then use a local\nsecured flag to decide whether to queue the secured-connection work after\nthe state transition. This keeps duplicate or late RESPONSE packets from\nre-running the setup path and removes the unlocked post-transition state\ntest."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nrxrpc: solo manejar RESPUESTA durante el desafío de servicio\n\nSolo procesar paquetes de RESPUESTA mientras la conexión de servicio todavía está en RXRPC_CONN_SERVICE_CHALLENGING. Verificar ese estado bajo state_lock antes de ejecutar la verificación de respuesta y la inicialización de seguridad, luego usar un indicador seguro local para decidir si encolar el trabajo de conexión segura después de la transición de estado. Esto evita que los paquetes de RESPUESTA duplicados o tardíos vuelvan a ejecutar la ruta de configuración y elimina la prueba de estado posterior a la transición desbloqueada."}],"id":"CVE-2026-31676","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31676","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:15.479986Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.210","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03fd2ef73cb4ffd0af100a95b634af54f474414e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0afdfd4941c1b60a1f5c361760daa970edca60cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/29b44d904dceb832be880def08b8cb17a0aba91c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/6c3a0fbdafef8316e34ae22333e317a341e737cd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/a1a8efde03a40b6c658d580e96644d9b9a2a0d3a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a6bcf8010af093fe04f7100562e9542ab7882585"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c43ffdcfdbb5567b1f143556df8a04b4eeea041c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d0035e634dae83237ab7f5681eb52b2f65d0ceb8"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31677.json b/data/2026/CVE-2026-31677.json index cc88b46b33..52f787fd5d 100644 --- a/data/2026/CVE-2026-31677.json +++ b/data/2026/CVE-2026-31677.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/af_alg.c","crypto/algif_skcipher.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"960c56743988d8ce9ff9b5d770dbeb5f64823a23","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"7e345de2e69475430af85e09210795d8eb8e719c","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"9bf3e6ccfdcfe56ae3190d1ae987dacf1cfef4f9","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"07c6f6ffe29009426f0bd4d3cfbb6308b8ea8453","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"4a264b2614c73c96666e196bbabe0cead52bdba7","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"8eceab19eba9dcbfd2a0daec72e1bf48aa100170","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/af_alg.c","crypto/algif_skcipher.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"58CEE9D1-D59E-4E24-A222-20946659E048","versionEndExcluding":"6.12.83","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - limit RX SG extraction by receive buffer budget\n\nMake af_alg_get_rsgl() limit each RX scatterlist extraction to the\nremaining receive buffer budget.\n\naf_alg_get_rsgl() currently uses af_alg_readable() only as a gate\nbefore extracting data into the RX scatterlist. Limit each extraction\nto the remaining af_alg_rcvbuf(sk) budget so that receive-side\naccounting matches the amount of data attached to the request.\n\nIf skcipher cannot obtain enough RX space for at least one chunk while\nmore data remains to be processed, reject the recvmsg call instead of\nrounding the request length down to zero."}],"id":"CVE-2026-31677","lastModified":"2026-11-06T16:18:07.223","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31677","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:06.442960Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.330","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07c6f6ffe29009426f0bd4d3cfbb6308b8ea8453"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4a264b2614c73c96666e196bbabe0cead52bdba7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7e345de2e69475430af85e09210795d8eb8e719c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8eceab19eba9dcbfd2a0daec72e1bf48aa100170"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/960c56743988d8ce9ff9b5d770dbeb5f64823a23"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9bf3e6ccfdcfe56ae3190d1ae987dacf1cfef4f9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["crypto/af_alg.c","crypto/algif_skcipher.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"960c56743988d8ce9ff9b5d770dbeb5f64823a23","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"7e345de2e69475430af85e09210795d8eb8e719c","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"9bf3e6ccfdcfe56ae3190d1ae987dacf1cfef4f9","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"07c6f6ffe29009426f0bd4d3cfbb6308b8ea8453","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"4a264b2614c73c96666e196bbabe0cead52bdba7","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"},{"lessThan":"8eceab19eba9dcbfd2a0daec72e1bf48aa100170","status":"affected","version":"e870456d8e7c8d57c059ea479b5aadbb55ff4c3a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["crypto/af_alg.c","crypto/algif_skcipher.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.160","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"58CEE9D1-D59E-4E24-A222-20946659E048","versionEndExcluding":"6.12.83","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - limit RX SG extraction by receive buffer budget\n\nMake af_alg_get_rsgl() limit each RX scatterlist extraction to the\nremaining receive buffer budget.\n\naf_alg_get_rsgl() currently uses af_alg_readable() only as a gate\nbefore extracting data into the RX scatterlist. Limit each extraction\nto the remaining af_alg_rcvbuf(sk) budget so that receive-side\naccounting matches the amount of data attached to the request.\n\nIf skcipher cannot obtain enough RX space for at least one chunk while\nmore data remains to be processed, reject the recvmsg call instead of\nrounding the request length down to zero."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncrypto: af_alg - limitar la extracción de SG de RX por el presupuesto del búfer de recepción\n\nHacer que af_alg_get_rsgl() limite cada extracción de scatterlist de RX al presupuesto restante del búfer de recepción.\n\naf_alg_get_rsgl() actualmente usa af_alg_readable() solo como una puerta antes de extraer datos en el scatterlist de RX. Limitar cada extracción al presupuesto restante de af_alg_rcvbuf(sk) para que la contabilidad del lado de recepción coincida con la cantidad de datos adjuntos a la solicitud.\n\nSi skcipher no puede obtener suficiente espacio de RX para al menos un fragmento mientras queden más datos por procesar, rechazar la llamada a recvmsg en lugar de redondear la longitud de la solicitud a cero."}],"id":"CVE-2026-31677","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31677","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:06.442960Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.330","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/07c6f6ffe29009426f0bd4d3cfbb6308b8ea8453"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4a264b2614c73c96666e196bbabe0cead52bdba7"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7e345de2e69475430af85e09210795d8eb8e719c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8eceab19eba9dcbfd2a0daec72e1bf48aa100170"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/960c56743988d8ce9ff9b5d770dbeb5f64823a23"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9bf3e6ccfdcfe56ae3190d1ae987dacf1cfef4f9"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31678.json b/data/2026/CVE-2026-31678.json index 41f05d2e36..6bc53a17b8 100644 --- a/data/2026/CVE-2026-31678.json +++ b/data/2026/CVE-2026-31678.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/openvswitch/vport-netdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f0ec49d3a39c1f5a4f3270ea27ca0854fad2a2a2","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"},{"lessThan":"9d56aced21fb9c104e8a3f3be9b21fbafe448ffc","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"},{"lessThan":"42f0d3d81209654c08ffdde5a34b9b92d2645896","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"},{"lessThan":"bbe7bd722bfaea36aab3da6cc60fb4a05c644643","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"},{"lessThan":"98b726ab5e2a4811e27c28e4d041f75bba147eab","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"},{"lessThan":"b8c56a3fc5d879c0928f207a756b0f067f06c6a8","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"},{"lessThan":"6931d21f87bc6d657f145798fad0bf077b82486c","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/openvswitch/vport-netdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.3"},{"lessThan":"4.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.224","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4EB455B5-6DF4-474E-9AFE-9C1854DD0CDC","versionEndExcluding":"6.1.168","versionStartIncluding":"4.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: defer tunnel netdev_put to RCU release\n\novs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already\ndetached the device. Dropping the netdev reference in destroy can race\nwith concurrent readers that still observe vport->dev.\n\nDo not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let\nvport_netdev_free() drop the reference from the RCU callback, matching\nthe non-tunnel destroy path and avoiding additional synchronization\nunder RTNL."}],"id":"CVE-2026-31678","lastModified":"2026-10-30T13:18:42.440","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31678","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:17.787623Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.437","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/42f0d3d81209654c08ffdde5a34b9b92d2645896"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6931d21f87bc6d657f145798fad0bf077b82486c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98b726ab5e2a4811e27c28e4d041f75bba147eab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d56aced21fb9c104e8a3f3be9b21fbafe448ffc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b8c56a3fc5d879c0928f207a756b0f067f06c6a8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bbe7bd722bfaea36aab3da6cc60fb4a05c644643"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f0ec49d3a39c1f5a4f3270ea27ca0854fad2a2a2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/openvswitch/vport-netdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f0ec49d3a39c1f5a4f3270ea27ca0854fad2a2a2","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"},{"lessThan":"9d56aced21fb9c104e8a3f3be9b21fbafe448ffc","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"},{"lessThan":"42f0d3d81209654c08ffdde5a34b9b92d2645896","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"},{"lessThan":"bbe7bd722bfaea36aab3da6cc60fb4a05c644643","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"},{"lessThan":"98b726ab5e2a4811e27c28e4d041f75bba147eab","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"},{"lessThan":"b8c56a3fc5d879c0928f207a756b0f067f06c6a8","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"},{"lessThan":"6931d21f87bc6d657f145798fad0bf077b82486c","status":"affected","version":"a9020fde67a6eb77f8130feff633189f99264db1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/openvswitch/vport-netdev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.3"},{"lessThan":"4.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.224","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4EB455B5-6DF4-474E-9AFE-9C1854DD0CDC","versionEndExcluding":"6.1.168","versionStartIncluding":"4.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: defer tunnel netdev_put to RCU release\n\novs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already\ndetached the device. Dropping the netdev reference in destroy can race\nwith concurrent readers that still observe vport->dev.\n\nDo not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let\nvport_netdev_free() drop the reference from the RCU callback, matching\nthe non-tunnel destroy path and avoiding additional synchronization\nunder RTNL."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nopenvswitch: aplazar netdev_put del túnel a la liberación RCU\n\novs_netdev_tunnel_destroy() puede ejecutarse después de que NETDEV_UNREGISTER ya haya desvinculado el dispositivo. Liberar la referencia de netdev en destroy puede competir con lectores concurrentes que aún observan vport -> dev.\n\nNo liberar vport -> dev en ovs_netdev_tunnel_destroy(). En su lugar, permitir que vport_netdev_free() libere la referencia desde la llamada de retorno RCU, coincidiendo con la ruta de destrucción sin túnel y evitando sincronización adicional bajo RTNL."}],"id":"CVE-2026-31678","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31678","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:17.787623Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.437","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/42f0d3d81209654c08ffdde5a34b9b92d2645896"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6931d21f87bc6d657f145798fad0bf077b82486c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98b726ab5e2a4811e27c28e4d041f75bba147eab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9d56aced21fb9c104e8a3f3be9b21fbafe448ffc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b8c56a3fc5d879c0928f207a756b0f067f06c6a8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bbe7bd722bfaea36aab3da6cc60fb4a05c644643"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/f0ec49d3a39c1f5a4f3270ea27ca0854fad2a2a2"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-362"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31679.json b/data/2026/CVE-2026-31679.json index 3ccedb5bfd..2899d3e19b 100644 --- a/data/2026/CVE-2026-31679.json +++ b/data/2026/CVE-2026-31679.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/openvswitch/flow_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"68f32ef0683c8d1c05cd2e4f16818fa63ff59c6f","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"4cae986225f8b8679ad86b924918e7d75a96aa61","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"8ed7b9930cbc3bc71f868fa79a68700ac88d586a","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"c1f97152df8dfb17e855ddf0fc409b7bd13e9700","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"98de18d327ef8cbbb704980e359e4872d8c28997","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"bd50c7484c3bb34097571c1334174fb8b7408036","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"2ca33b88a79ca42f017ae0f7011280325655438e","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"546b68ac893595877ffbd7751e5c55fd1c43ede6","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/openvswitch/flow_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D9EE2E5A-7EDD-4F5B-B848-A34F7E787521","versionEndExcluding":"5.10.253","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: validate MPLS set/set_masked payload length\n\nvalidate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for\nSET/SET_MASKED actions. In action handling, OVS expects fixed-size\nMPLS key data (struct ovs_key_mpls).\n\nUse the already normalized key_len (masked case included) and reject\nnon-matching MPLS action key sizes.\n\nReject invalid MPLS action payload lengths early."}],"id":"CVE-2026-31679","lastModified":"2026-10-19T19:18:06.057","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31679","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:20.188389Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.550","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ca33b88a79ca42f017ae0f7011280325655438e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cae986225f8b8679ad86b924918e7d75a96aa61"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/546b68ac893595877ffbd7751e5c55fd1c43ede6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/68f32ef0683c8d1c05cd2e4f16818fa63ff59c6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ed7b9930cbc3bc71f868fa79a68700ac88d586a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98de18d327ef8cbbb704980e359e4872d8c28997"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd50c7484c3bb34097571c1334174fb8b7408036"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c1f97152df8dfb17e855ddf0fc409b7bd13e9700"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/openvswitch/flow_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"68f32ef0683c8d1c05cd2e4f16818fa63ff59c6f","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"4cae986225f8b8679ad86b924918e7d75a96aa61","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"8ed7b9930cbc3bc71f868fa79a68700ac88d586a","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"c1f97152df8dfb17e855ddf0fc409b7bd13e9700","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"98de18d327ef8cbbb704980e359e4872d8c28997","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"bd50c7484c3bb34097571c1334174fb8b7408036","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"2ca33b88a79ca42f017ae0f7011280325655438e","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"},{"lessThan":"546b68ac893595877ffbd7751e5c55fd1c43ede6","status":"affected","version":"fbdcdd78da7c95f1b970d371e1b23cbd3aa990f3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/openvswitch/flow_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.131","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.80","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.21","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D9EE2E5A-7EDD-4F5B-B848-A34F7E787521","versionEndExcluding":"5.10.253","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"CE6ED4D4-0046-4573-BFA9-D64143B6A89F","versionEndExcluding":"6.6.131","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6","versionEndExcluding":"6.12.80","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE","versionEndExcluding":"6.18.21","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"4CA2E747-A9EC-4518-9AA2-B4247FC748B7","versionEndExcluding":"6.19.11","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: validate MPLS set/set_masked payload length\n\nvalidate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for\nSET/SET_MASKED actions. In action handling, OVS expects fixed-size\nMPLS key data (struct ovs_key_mpls).\n\nUse the already normalized key_len (masked case included) and reject\nnon-matching MPLS action key sizes.\n\nReject invalid MPLS action payload lengths early."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nopenvswitch: validar la longitud de la carga útil MPLS set/set_masked\n\nvalidate_set() aceptaba OVS_KEY_ATTR_MPLS como carga útil de tamaño variable para las acciones SET/SET_MASKED. En el manejo de acciones, OVS espera datos de clave MPLS de tamaño fijo (estructura ovs_key_mpls).\n\nUsar la key_len ya normalizada (caso enmascarado incluido) y rechazar los tamaños de clave de acción MPLS que no coincidan.\n\nRechazar las longitudes de carga útil de acción MPLS no válidas temprano."}],"id":"CVE-2026-31679","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31679","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:20.188389Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.550","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ca33b88a79ca42f017ae0f7011280325655438e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4cae986225f8b8679ad86b924918e7d75a96aa61"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/546b68ac893595877ffbd7751e5c55fd1c43ede6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/68f32ef0683c8d1c05cd2e4f16818fa63ff59c6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8ed7b9930cbc3bc71f868fa79a68700ac88d586a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/98de18d327ef8cbbb704980e359e4872d8c28997"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd50c7484c3bb34097571c1334174fb8b7408036"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c1f97152df8dfb17e855ddf0fc409b7bd13e9700"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31680.json b/data/2026/CVE-2026-31680.json index 352d64335c..1aa84a368f 100644 --- a/data/2026/CVE-2026-31680.json +++ b/data/2026/CVE-2026-31680.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/ip6_flowlabel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4b6798024f7b2d535f3db1002c760143cdbd1bd3","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"3c54b66c83fb8fcbde8e6a7bf90b65856e39f827","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"5a6b15f861b7c1304949e3350d23490a5fe429fd","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"6c7fbdb8ffde6413640de7cfbd7c976c353e89f8","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"8027964931785cb73d520ac70a342a3dc16c249b","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"414726b69921fe6355ae453f5b35e68dd078342a","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"572ce62778519a7d4d1c15f55dd2e45a474133c4","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"9ca562bb8e66978b53028fa32b1a190708e6a091","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/ip6_flowlabel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.9"},{"lessThan":"3.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A73B6C7F-59A9-4C13-93DA-043EF7196D2E","versionEndExcluding":"5.10.253","versionStartIncluding":"3.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: flowlabel: defer exclusive option free until RCU teardown\n\n`ip6fl_seq_show()` walks the global flowlabel hash under the seq-file\nRCU read-side lock and prints `fl->opt->opt_nflen` when an option block\nis present.\n\nExclusive flowlabels currently free `fl->opt` as soon as `fl->users`\ndrops to zero in `fl_release()`. However, the surrounding\n`struct ip6_flowlabel` remains visible in the global hash table until\nlater garbage collection removes it and `fl_free_rcu()` finally tears it\ndown.\n\nA concurrent `/proc/net/ip6_flowlabel` reader can therefore race that\nearly `kfree()` and dereference freed option state, triggering a crash\nin `ip6fl_seq_show()`.\n\nFix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches\nthe lifetime already required for the enclosing flowlabel while readers\ncan still reach it under RCU."}],"id":"CVE-2026-31680","lastModified":"2026-11-10T13:19:03.403","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:23.036935Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.673","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c54b66c83fb8fcbde8e6a7bf90b65856e39f827"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/414726b69921fe6355ae453f5b35e68dd078342a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b6798024f7b2d535f3db1002c760143cdbd1bd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/572ce62778519a7d4d1c15f55dd2e45a474133c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a6b15f861b7c1304949e3350d23490a5fe429fd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6c7fbdb8ffde6413640de7cfbd7c976c353e89f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8027964931785cb73d520ac70a342a3dc16c249b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ca562bb8e66978b53028fa32b1a190708e6a091"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/ip6_flowlabel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4b6798024f7b2d535f3db1002c760143cdbd1bd3","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"3c54b66c83fb8fcbde8e6a7bf90b65856e39f827","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"5a6b15f861b7c1304949e3350d23490a5fe429fd","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"6c7fbdb8ffde6413640de7cfbd7c976c353e89f8","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"8027964931785cb73d520ac70a342a3dc16c249b","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"414726b69921fe6355ae453f5b35e68dd078342a","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"572ce62778519a7d4d1c15f55dd2e45a474133c4","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"},{"lessThan":"9ca562bb8e66978b53028fa32b1a190708e6a091","status":"affected","version":"d3aedd5ebd4b0b925b0bcda548066803e1318499","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/ip6_flowlabel.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.9"},{"lessThan":"3.9","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A73B6C7F-59A9-4C13-93DA-043EF7196D2E","versionEndExcluding":"5.10.253","versionStartIncluding":"3.9","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: flowlabel: defer exclusive option free until RCU teardown\n\n`ip6fl_seq_show()` walks the global flowlabel hash under the seq-file\nRCU read-side lock and prints `fl->opt->opt_nflen` when an option block\nis present.\n\nExclusive flowlabels currently free `fl->opt` as soon as `fl->users`\ndrops to zero in `fl_release()`. However, the surrounding\n`struct ip6_flowlabel` remains visible in the global hash table until\nlater garbage collection removes it and `fl_free_rcu()` finally tears it\ndown.\n\nA concurrent `/proc/net/ip6_flowlabel` reader can therefore race that\nearly `kfree()` and dereference freed option state, triggering a crash\nin `ip6fl_seq_show()`.\n\nFix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches\nthe lifetime already required for the enclosing flowlabel while readers\ncan still reach it under RCU."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: ipv6: flowlabel: aplazar la liberación de la opción exclusiva hasta el desmontaje de RCU\n\n’ip6fl_seq_show()’ recorre el hash global de flowlabel bajo el bloqueo de lectura de RCU del archivo seq e imprime ’fl -> opt -> opt_nflen’ cuando un bloque de opción está presente.\n\nLos flowlabels exclusivos actualmente liberan ’fl -> opt’ tan pronto como ’fl -> users’ cae a cero en ’fl_release()’. Sin embargo, la ’struct ip6_flowlabel’ circundante permanece visible en la tabla hash global hasta que una recolección de basura posterior la elimine y ’fl_free_rcu()’ finalmente la desmonte.\n\nUn lector concurrente de ’/proc/ net/ip6_flowlabel’ puede, por lo tanto, competir con esa ’kfree()’ temprana y desreferenciar el estado de opción liberado, lo que provoca un fallo en ’ip6fl_seq_show()’.\n\nSoluciona esto manteniendo ’fl -> opt’ vivo hasta ’fl_free_rcu()’. Eso coincide con la vida útil ya requerida para el flowlabel que lo contiene mientras los lectores aún pueden acceder a él bajo RCU."}],"id":"CVE-2026-31680","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:23.036935Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.673","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3c54b66c83fb8fcbde8e6a7bf90b65856e39f827"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/414726b69921fe6355ae453f5b35e68dd078342a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4b6798024f7b2d535f3db1002c760143cdbd1bd3"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/572ce62778519a7d4d1c15f55dd2e45a474133c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5a6b15f861b7c1304949e3350d23490a5fe429fd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6c7fbdb8ffde6413640de7cfbd7c976c353e89f8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8027964931785cb73d520ac70a342a3dc16c249b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9ca562bb8e66978b53028fa32b1a190708e6a091"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-416"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31681.json b/data/2026/CVE-2026-31681.json index bf5971fa74..72b279b874 100644 --- a/data/2026/CVE-2026-31681.json +++ b/data/2026/CVE-2026-31681.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/xt_multiport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8c5bf8f5b478f569191c4a7982de7cd5f5f73c1a","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"c9749f6232c845e31c21d4cc72200211df15d8a2","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"b67d638cbee9975c765feb45c126e96ed11ec802","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"36bf0d98e180a7c384c8d8a59b0d2d4b80e5eb16","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"aec14808271f2bf2b656de6ff12dfe73c5fd3b67","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"8368ce8eb01f0b91111d814703696e780d0ef12f","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"1e4baa853f1cc4227e04f52d6860524707cfb294","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"ff64c5bfef12461df8450e0f50bb693b5269c720","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/xt_multiport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.17"},{"lessThan":"2.6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A7B9FFD8-E991-452F-9730-FADDA1A54E82","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_multiport: validate range encoding in checkentry\n\nports_match_v1() treats any non-zero pflags entry as the start of a\nport range and unconditionally consumes the next ports[] element as\nthe range end.\n\nThe checkentry path currently validates protocol, flags and count, but\nit does not validate the range encoding itself. As a result, malformed\nrules can mark the last slot as a range start or place two range starts\nback to back, leaving ports_match_v1() to step past the last valid\nports[] element while interpreting the rule.\n\nReject malformed multiport v1 rules in checkentry by validating that\neach range start has a following element and that the following element\nis not itself marked as another range start."}],"id":"CVE-2026-31681","lastModified":"2026-11-10T13:19:03.633","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31681","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:10.438722Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.800","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1e4baa853f1cc4227e04f52d6860524707cfb294"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36bf0d98e180a7c384c8d8a59b0d2d4b80e5eb16"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8368ce8eb01f0b91111d814703696e780d0ef12f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8c5bf8f5b478f569191c4a7982de7cd5f5f73c1a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aec14808271f2bf2b656de6ff12dfe73c5fd3b67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b67d638cbee9975c765feb45c126e96ed11ec802"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c9749f6232c845e31c21d4cc72200211df15d8a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ff64c5bfef12461df8450e0f50bb693b5269c720"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/xt_multiport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8c5bf8f5b478f569191c4a7982de7cd5f5f73c1a","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"c9749f6232c845e31c21d4cc72200211df15d8a2","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"b67d638cbee9975c765feb45c126e96ed11ec802","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"36bf0d98e180a7c384c8d8a59b0d2d4b80e5eb16","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"aec14808271f2bf2b656de6ff12dfe73c5fd3b67","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"8368ce8eb01f0b91111d814703696e780d0ef12f","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"1e4baa853f1cc4227e04f52d6860524707cfb294","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"},{"lessThan":"ff64c5bfef12461df8450e0f50bb693b5269c720","status":"affected","version":"a89ecb6a2ef732d04058d87801e2b6bd7e5c7089","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/xt_multiport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.17"},{"lessThan":"2.6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"A7B9FFD8-E991-452F-9730-FADDA1A54E82","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_multiport: validate range encoding in checkentry\n\nports_match_v1() treats any non-zero pflags entry as the start of a\nport range and unconditionally consumes the next ports[] element as\nthe range end.\n\nThe checkentry path currently validates protocol, flags and count, but\nit does not validate the range encoding itself. As a result, malformed\nrules can mark the last slot as a range start or place two range starts\nback to back, leaving ports_match_v1() to step past the last valid\nports[] element while interpreting the rule.\n\nReject malformed multiport v1 rules in checkentry by validating that\neach range start has a following element and that the following element\nis not itself marked as another range start."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: xt_multiport: validar la codificación de rango en checkentry\n\nports_match_v1() trata cualquier entrada pflags distinta de cero como el inicio de un rango de puertos y consume incondicionalmente el siguiente elemento ports[] como el final del rango.\n\nLa ruta checkentry actualmente valida el protocolo, los flags y el conteo, pero no valida la codificación de rango en sí misma. Como resultado, las reglas malformadas pueden marcar la última ranura como un inicio de rango o colocar dos inicios de rango consecutivos, lo que hace que ports_match_v1() pase por alto el último elemento ports[] válido mientras interpreta la regla.\n\nRechazar reglas multiport v1 malformadas en checkentry validando que cada inicio de rango tiene un elemento siguiente y que el elemento siguiente no está marcado a su vez como otro inicio de rango."}],"id":"CVE-2026-31681","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31681","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:10.438722Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.800","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1e4baa853f1cc4227e04f52d6860524707cfb294"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/36bf0d98e180a7c384c8d8a59b0d2d4b80e5eb16"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/8368ce8eb01f0b91111d814703696e780d0ef12f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/8c5bf8f5b478f569191c4a7982de7cd5f5f73c1a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aec14808271f2bf2b656de6ff12dfe73c5fd3b67"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/b67d638cbee9975c765feb45c126e96ed11ec802"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/c9749f6232c845e31c21d4cc72200211df15d8a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ff64c5bfef12461df8450e0f50bb693b5269c720"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31682.json b/data/2026/CVE-2026-31682.json index 9833c07874..791e3672c9 100644 --- a/data/2026/CVE-2026-31682.json +++ b/data/2026/CVE-2026-31682.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bridge/br_arp_nd_proxy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c68433fd291c9e88c00292095172c62d1997d662","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"4f397b950c916e9a1f8a4fce04ea0110206cad47","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"bd91ec85aa4c77d645bd2739fc56784157a88ca2","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"658261898130da620fc3d0fbb0523efb3366cb55","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"2ba4caba423ed94d63006eb1d2227b0332ab7fcd","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"9c55e41c73af5c4511070933b1bd25248521270c","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"3a30f6469b058574f49efde61cd6f5d79e576053","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"a01aee7cafc575bb82f5529e8734e7052f9b16ea","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bridge/br_arp_nd_proxy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"202FFB00-4CA7-44CB-ACA1-E88A2BF2264B","versionEndExcluding":"5.10.253","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: br_nd_send: linearize skb before parsing ND options\n\nbr_nd_send() parses neighbour discovery options from ns->opt[] and\nassumes that these options are in the linear part of request.\n\nIts callers only guarantee that the ICMPv6 header and target address\nare available, so the option area can still be non-linear. Parsing\nns->opt[] in that case can access data past the linear buffer.\n\nLinearize request before option parsing and derive ns from the linear\nnetwork header."}],"id":"CVE-2026-31682","lastModified":"2026-11-10T13:19:03.847","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31682","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:26.021303Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.913","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ba4caba423ed94d63006eb1d2227b0332ab7fcd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a30f6469b058574f49efde61cd6f5d79e576053"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f397b950c916e9a1f8a4fce04ea0110206cad47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/658261898130da620fc3d0fbb0523efb3366cb55"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9c55e41c73af5c4511070933b1bd25248521270c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a01aee7cafc575bb82f5529e8734e7052f9b16ea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd91ec85aa4c77d645bd2739fc56784157a88ca2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c68433fd291c9e88c00292095172c62d1997d662"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/bridge/br_arp_nd_proxy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c68433fd291c9e88c00292095172c62d1997d662","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"4f397b950c916e9a1f8a4fce04ea0110206cad47","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"bd91ec85aa4c77d645bd2739fc56784157a88ca2","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"658261898130da620fc3d0fbb0523efb3366cb55","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"2ba4caba423ed94d63006eb1d2227b0332ab7fcd","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"9c55e41c73af5c4511070933b1bd25248521270c","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"3a30f6469b058574f49efde61cd6f5d79e576053","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"},{"lessThan":"a01aee7cafc575bb82f5529e8734e7052f9b16ea","status":"affected","version":"ed842faeb2bd49256f00485402f3113205f91d30","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/bridge/br_arp_nd_proxy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.15"},{"lessThan":"4.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.168","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.134","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.81","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"202FFB00-4CA7-44CB-ACA1-E88A2BF2264B","versionEndExcluding":"5.10.253","versionStartIncluding":"4.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2DDDCA1-6DAB-4018-B920-8F045DDD8D3B","versionEndExcluding":"6.1.168","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F56F925B-BAF8-4F4B-B62F-1496AF19A307","versionEndExcluding":"6.6.134","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC","versionEndExcluding":"6.12.81","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C9DF8BCE-36D3-475D-9D21-19E4F02F9029","versionEndExcluding":"6.18.22","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: br_nd_send: linearize skb before parsing ND options\n\nbr_nd_send() parses neighbour discovery options from ns->opt[] and\nassumes that these options are in the linear part of request.\n\nIts callers only guarantee that the ICMPv6 header and target address\nare available, so the option area can still be non-linear. Parsing\nns->opt[] in that case can access data past the linear buffer.\n\nLinearize request before option parsing and derive ns from the linear\nnetwork header."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nbridge: br_nd_send: linealizar skb antes de analizar las opciones ND\n\nbr_nd_send() analiza las opciones de descubrimiento de vecinos de ns -> opt[] y asume que estas opciones están en la parte lineal de la solicitud.\n\nSus llamadores solo garantizan que el encabezado ICMPv6 y la dirección de destino están disponibles, por lo que el área de opciones aún puede ser no lineal. El análisis de ns -> opt[] en ese caso puede acceder a datos más allá del búfer lineal.\n\nLinealizar la solicitud antes del análisis de opciones y derivar ns del encabezado de red lineal."}],"id":"CVE-2026-31682","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31682","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:26.021303Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:01.913","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2ba4caba423ed94d63006eb1d2227b0332ab7fcd"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3a30f6469b058574f49efde61cd6f5d79e576053"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4f397b950c916e9a1f8a4fce04ea0110206cad47"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/658261898130da620fc3d0fbb0523efb3366cb55"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9c55e41c73af5c4511070933b1bd25248521270c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a01aee7cafc575bb82f5529e8734e7052f9b16ea"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd91ec85aa4c77d645bd2739fc56784157a88ca2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c68433fd291c9e88c00292095172c62d1997d662"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31683.json b/data/2026/CVE-2026-31683.json index e8bc3a1080..5e2b2b5ffc 100644 --- a/data/2026/CVE-2026-31683.json +++ b/data/2026/CVE-2026-31683.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/batman-adv/bat_iv_ogm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"67176c96f325837b0bb3e9538ca2eba414f447d8","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"0b10a8b355c3f71012ce89289ec2c2f5e3bfd6c1","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"6755347c5f9bdd44dee80f692208b056fcd40a52","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"1ada20331f2df2a942d6b83ae1f04a304b642e2a","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"6e40ebb999c2c3d2fbb3cacb61f0384ee6e69075","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"0e35db29fc5a97a8553f7c2d3a2ba730e46b1ee8","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"eda89a1bae0602aec8314ced299bb243b9f9aeef","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"0d4aef630be9d5f9c1227d07669c26c4383b5ad0","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/batman-adv/bat_iv_ogm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.38"},{"lessThan":"2.6.38","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"23469A4A-A411-46B7-BCC8-630D832E78C2","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: avoid OGM aggregation when skb tailroom is insufficient\n\nWhen OGM aggregation state is toggled at runtime, an existing forwarded\npacket may have been allocated with only packet_len bytes, while a later\npacket can still be selected for aggregation. Appending in this case can\nhit skb_put overflow conditions.\n\nReject aggregation when the target skb tailroom cannot accommodate the new\npacket. The caller then falls back to creating a new forward packet\ninstead of appending."}],"id":"CVE-2026-31683","lastModified":"2026-06-17T10:34:13.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-25T09:16:02.037","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b10a8b355c3f71012ce89289ec2c2f5e3bfd6c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d4aef630be9d5f9c1227d07669c26c4383b5ad0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e35db29fc5a97a8553f7c2d3a2ba730e46b1ee8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1ada20331f2df2a942d6b83ae1f04a304b642e2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67176c96f325837b0bb3e9538ca2eba414f447d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6755347c5f9bdd44dee80f692208b056fcd40a52"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e40ebb999c2c3d2fbb3cacb61f0384ee6e69075"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eda89a1bae0602aec8314ced299bb243b9f9aeef"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/batman-adv/bat_iv_ogm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"67176c96f325837b0bb3e9538ca2eba414f447d8","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"0b10a8b355c3f71012ce89289ec2c2f5e3bfd6c1","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"6755347c5f9bdd44dee80f692208b056fcd40a52","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"1ada20331f2df2a942d6b83ae1f04a304b642e2a","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"6e40ebb999c2c3d2fbb3cacb61f0384ee6e69075","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"0e35db29fc5a97a8553f7c2d3a2ba730e46b1ee8","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"eda89a1bae0602aec8314ced299bb243b9f9aeef","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"},{"lessThan":"0d4aef630be9d5f9c1227d07669c26c4383b5ad0","status":"affected","version":"c6c8fea29769d998d94fcec9b9f14d4b52b349d3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/batman-adv/bat_iv_ogm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.38"},{"lessThan":"2.6.38","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.253","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.203","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.78","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.20","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.10","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"23469A4A-A411-46B7-BCC8-630D832E78C2","versionEndExcluding":"5.10.253","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"20DDB3E9-AABF-4107-ADB0-5362AA067045","versionEndExcluding":"5.15.203","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43","versionEndExcluding":"6.1.167","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C57BB918-DF28-46B3-94F7-144176841267","versionEndExcluding":"6.6.130","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"28D591F5-B196-4CC9-905C-DC80F116E7A8","versionEndExcluding":"6.12.78","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E5571059-6552-48E7-9BEF-3E358C387171","versionEndExcluding":"6.18.20","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"96D34333-38BE-4414-9E79-6EB764329581","versionEndExcluding":"6.19.10","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: avoid OGM aggregation when skb tailroom is insufficient\n\nWhen OGM aggregation state is toggled at runtime, an existing forwarded\npacket may have been allocated with only packet_len bytes, while a later\npacket can still be selected for aggregation. Appending in this case can\nhit skb_put overflow conditions.\n\nReject aggregation when the target skb tailroom cannot accommodate the new\npacket. The caller then falls back to creating a new forward packet\ninstead of appending."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbatman-adv: evitar la agregación de OGM cuando el espacio de cola (tailroom) del skb es insuficiente\n\nCuando el estado de agregación de OGM se conmuta en tiempo de ejecución, un paquete reenviado existente puede haber sido asignado con solo packet_len bytes, mientras que un paquete posterior aún puede ser seleccionado para agregación. Añadir en este caso puede provocar condiciones de desbordamiento de skb_put.\n\nRechazar la agregación cuando el espacio de cola (tailroom) del skb objetivo no puede acomodar el nuevo paquete. El llamador entonces recurre a la creación de un nuevo paquete de reenvío en lugar de añadir."}],"id":"CVE-2026-31683","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}]},"published":"2026-04-25T09:16:02.037","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0b10a8b355c3f71012ce89289ec2c2f5e3bfd6c1"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0d4aef630be9d5f9c1227d07669c26c4383b5ad0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/0e35db29fc5a97a8553f7c2d3a2ba730e46b1ee8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1ada20331f2df2a942d6b83ae1f04a304b642e2a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/67176c96f325837b0bb3e9538ca2eba414f447d8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6755347c5f9bdd44dee80f692208b056fcd40a52"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6e40ebb999c2c3d2fbb3cacb61f0384ee6e69075"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eda89a1bae0602aec8314ced299bb243b9f9aeef"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31684.json b/data/2026/CVE-2026-31684.json index a12ad53ca6..ac49aadd88 100644 --- a/data/2026/CVE-2026-31684.json +++ b/data/2026/CVE-2026-31684.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/act_csum.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0410c619e86551677fb79887a38eccad3f5a0725","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"886469b6455611a511aa6013e957e15e50577513","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"a69738efea0996d05a3c7d2178551b891744df1b","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"ec4930979b3f7bbeb7af5744599fc6603a4dba62","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"3d165d975305cf76ff0b10a3c798fb31e5f5f9a5","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"c842743d073bdd683606cb414eb0ca84465dd834","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"status":"affected","version":"3764bfae5056e95617b6ee074129297e11710886","versionType":"git"},{"lessThan":"4.20","status":"affected","version":"4.19.99","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/act_csum.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.1"},{"lessThan":"5.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97340910-B0B6-42CC-B4FA-E277DFB61C71","versionEndExcluding":"4.20","versionStartIncluding":"4.19.99","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B28CAC2A-4B06-4D07-8736-82E515099010","versionEndExcluding":"6.6.136","versionStartIncluding":"5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: act_csum: validate nested VLAN headers\n\ntcf_csum_act() walks nested VLAN headers directly from skb->data when an\nskb still carries in-payload VLAN tags. The current code reads\nvlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without\nfirst ensuring that the full VLAN header is present in the linear area.\n\nIf only part of an inner VLAN header is linearized, accessing\nh_vlan_encapsulated_proto reads past the linear area, and the following\nskb_pull(VLAN_HLEN) may violate skb invariants.\n\nFix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and\npulling each nested VLAN header. If the header still is not fully\navailable, drop the packet through the existing error path."}],"id":"CVE-2026-31684","lastModified":"2026-11-06T16:18:07.650","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31684","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:14.457468Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:02.163","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0410c619e86551677fb79887a38eccad3f5a0725"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d165d975305cf76ff0b10a3c798fb31e5f5f9a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/886469b6455611a511aa6013e957e15e50577513"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a69738efea0996d05a3c7d2178551b891744df1b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c842743d073bdd683606cb414eb0ca84465dd834"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ec4930979b3f7bbeb7af5744599fc6603a4dba62"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/act_csum.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"0410c619e86551677fb79887a38eccad3f5a0725","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"886469b6455611a511aa6013e957e15e50577513","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"a69738efea0996d05a3c7d2178551b891744df1b","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"ec4930979b3f7bbeb7af5744599fc6603a4dba62","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"3d165d975305cf76ff0b10a3c798fb31e5f5f9a5","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"lessThan":"c842743d073bdd683606cb414eb0ca84465dd834","status":"affected","version":"2ecba2d1e45b24620a7c3df9531895cf68d5dec6","versionType":"git"},{"status":"affected","version":"3764bfae5056e95617b6ee074129297e11710886","versionType":"git"},{"lessThan":"4.20","status":"affected","version":"4.19.99","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/act_csum.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.1"},{"lessThan":"5.1","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"97340910-B0B6-42CC-B4FA-E277DFB61C71","versionEndExcluding":"4.20","versionStartIncluding":"4.19.99","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"B28CAC2A-4B06-4D07-8736-82E515099010","versionEndExcluding":"6.6.136","versionStartIncluding":"5.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: act_csum: validate nested VLAN headers\n\ntcf_csum_act() walks nested VLAN headers directly from skb->data when an\nskb still carries in-payload VLAN tags. The current code reads\nvlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without\nfirst ensuring that the full VLAN header is present in the linear area.\n\nIf only part of an inner VLAN header is linearized, accessing\nh_vlan_encapsulated_proto reads past the linear area, and the following\nskb_pull(VLAN_HLEN) may violate skb invariants.\n\nFix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and\npulling each nested VLAN header. If the header still is not fully\navailable, drop the packet through the existing error path."},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nnet: sched: act_csum: validar cabeceras VLAN anidadas\n\ntcf_csum_act() recorre las cabeceras VLAN anidadas directamente desde skb -> data cuando un skb aún lleva etiquetas VLAN en la carga útil. El código actual lee vlan -> h_vlan_encapsulated_proto y luego extrae VLAN_HLEN bytes sin asegurar primero que la cabecera VLAN completa esté presente en el área lineal.\n\nSi solo parte de una cabecera VLAN interna se linealiza, acceder a h_vlan_encapsulated_proto lee más allá del área lineal, y la siguiente llamada a skb_pull(VLAN_HLEN) puede violar las invariantes de skb.\n\nSolucione esto requiriendo pskb_may_pull(skb, VLAN_HLEN) antes de acceder y extraer cada cabecera VLAN anidada. Si la cabecera aún no está completamente disponible, descarte el paquete a través de la ruta de error existente."}],"id":"CVE-2026-31684","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31684","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:14.457468Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:02.163","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/0410c619e86551677fb79887a38eccad3f5a0725"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/3d165d975305cf76ff0b10a3c798fb31e5f5f9a5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/46c07ad50fa2f4ba7663ee1b72b75ad7ad45cf09"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/886469b6455611a511aa6013e957e15e50577513"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a69738efea0996d05a3c7d2178551b891744df1b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/c842743d073bdd683606cb414eb0ca84465dd834"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/eb3765b90eb8f2a3d6310a80c14a9e57ec4267a2"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ec4930979b3f7bbeb7af5744599fc6603a4dba62"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31685.json b/data/2026/CVE-2026-31685.json index 76180bb448..5fe72662a4 100644 --- a/data/2026/CVE-2026-31685.json +++ b/data/2026/CVE-2026-31685.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/netfilter/ip6t_eui64.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4d75bc2cd093bf5803edf512c099bfb220fd6459","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"7d6a57411caf54df025860c9b1a82cd42d57a562","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"d5603591373441fecf9951833d6d873e09320f08","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"288138418bef956f8b295751a4536c60f0e89f4a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"9eda5478746ef7dc0e4e537b5a5e4b0ca1027091","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"807d6ee15804df6f01a35c910f09612e858739a6","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"309ae3e9a51a69699ca94eac5fac5688fa562d55","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"fdce0b3590f724540795b874b4c8850c90e6b0a8","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/netfilter/ip6t_eui64.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2D9D9DF-0F25-43D5-9C6A-4C891E3A29FC","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_eui64: reject invalid MAC header for all packets\n\n`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address\nand compares it with the low 64 bits of the IPv6 source address.\n\nThe existing guard only rejects an invalid MAC header when\n`par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()`\ncan still reach `eth_hdr(skb)` even when the MAC header is not valid.\n\nFix this by removing the `par->fragoff != 0` condition so that packets\nwith an invalid MAC header are rejected before accessing `eth_hdr(skb)`."}],"id":"CVE-2026-31685","lastModified":"2026-10-19T19:18:06.657","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31685","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:28.261772Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:02.273","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/288138418bef956f8b295751a4536c60f0e89f4a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/309ae3e9a51a69699ca94eac5fac5688fa562d55"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4d75bc2cd093bf5803edf512c099bfb220fd6459"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7d6a57411caf54df025860c9b1a82cd42d57a562"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/807d6ee15804df6f01a35c910f09612e858739a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9eda5478746ef7dc0e4e537b5a5e4b0ca1027091"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d5603591373441fecf9951833d6d873e09320f08"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fdce0b3590f724540795b874b4c8850c90e6b0a8"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv6/netfilter/ip6t_eui64.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4d75bc2cd093bf5803edf512c099bfb220fd6459","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"7d6a57411caf54df025860c9b1a82cd42d57a562","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"d5603591373441fecf9951833d6d873e09320f08","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"288138418bef956f8b295751a4536c60f0e89f4a","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"9eda5478746ef7dc0e4e537b5a5e4b0ca1027091","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"807d6ee15804df6f01a35c910f09612e858739a6","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"309ae3e9a51a69699ca94eac5fac5688fa562d55","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"},{"lessThan":"fdce0b3590f724540795b874b4c8850c90e6b0a8","status":"affected","version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv6/netfilter/ip6t_eui64.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"affectedData":[{"defaultStatus":"unknown","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"0","versionType":"custom"}]}],"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E2D9D9DF-0F25-43D5-9C6A-4C891E3A29FC","versionEndExcluding":"6.6.136","versionStartIncluding":"2.6.12.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*","matchCriteriaId":"6F62EECE-8FB1-4D57-85D8-CB9E23CF313C","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*","matchCriteriaId":"4F76C298-81DC-43E4-8FC9-DC005A2116EF","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*","matchCriteriaId":"0AB349B2-3F78-4197-882B-90ADB3BF645A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*","matchCriteriaId":"6AC88830-A9BC-4607-B572-A4B502FC9FD0","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*","matchCriteriaId":"476CB3A5-D022-4F13-AAEF-CB6A5785516A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_eui64: reject invalid MAC header for all packets\n\n`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address\nand compares it with the low 64 bits of the IPv6 source address.\n\nThe existing guard only rejects an invalid MAC header when\n`par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()`\ncan still reach `eth_hdr(skb)` even when the MAC header is not valid.\n\nFix this by removing the `par->fragoff != 0` condition so that packets\nwith an invalid MAC header are rejected before accessing `eth_hdr(skb)`."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: ip6t_eui64: rechazar encabezado MAC inválido para todos los paquetes\n\n“eui64_mt6()” deriva un EUI-64 modificado de la dirección de origen Ethernet y lo compara con los 64 bits bajos de la dirección de origen IPv6.\n\nLa protección existente solo rechaza un encabezado MAC inválido cuando “par -> fragoff != 0”. Para paquetes con “par -> fragoff == 0”, “eui64_mt6()” aún puede alcanzar “eth_hdr(skb)” incluso cuando el encabezado MAC no es válido.\n\nSoluciona esto eliminando la condición “par -> fragoff != 0” para que los paquetes con un encabezado MAC inválido sean rechazados antes de acceder a “eth_hdr(skb)”."}],"id":"CVE-2026-31685","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.4,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.5,"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31685","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-16T15:12:28.261772Z","version":"2.0.3"}}]},"published":"2026-04-25T09:16:02.273","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/288138418bef956f8b295751a4536c60f0e89f4a"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/309ae3e9a51a69699ca94eac5fac5688fa562d55"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/4d75bc2cd093bf5803edf512c099bfb220fd6459"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7d6a57411caf54df025860c9b1a82cd42d57a562"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/807d6ee15804df6f01a35c910f09612e858739a6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9eda5478746ef7dc0e4e537b5a5e4b0ca1027091"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/d5603591373441fecf9951833d6d873e09320f08"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fdce0b3590f724540795b874b4c8850c90e6b0a8"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"},{"description":[{"lang":"en","value":"CWE-125"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-31686.json b/data/2026/CVE-2026-31686.json index 9757bedd52..79f325baa5 100644 --- a/data/2026/CVE-2026-31686.json +++ b/data/2026/CVE-2026-31686.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/kasan/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7d7b2d5c107a1f6302cf0006d859985e7c3ddd1c","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"3298bdf5a878ded06351eb293856fa84e050029e","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"2277246ea265cdca64ce6fdea4b26cd6ff0ec4db","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"cec74b2ab7dff866b1d77eaa545b9e8fd14a1f87","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"a05f77cb227c39c5069aea6f12762a29d1e6c103","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"f6204f7ff6aff62ce6242a76982c5ba3a9ded707","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"85d98614e089a67dc6faa8ca766fe10a639f82b4","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"b38237a2ea9c6c19836eee2c57037e1f9f103576","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"51d8c78be0c27ddb91bc2c0263941d8b30a47d3b","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/kasan/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C65C5FE4-6002-4BBA-98A9-87D1F99A643F","versionEndExcluding":"6.6.136","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/kasan: fix double free for kasan pXds\n\nkasan_free_pxd() assumes the page table is always struct page aligned. \nBut that's not always the case for all architectures. E.g. In case of\npowerpc with 64K pagesize, PUD table (of size 4096) comes from slab cache\nnamed pgtable-2^9. Hence instead of page_to_virt(pxd_page()) let's just\ndirectly pass the start of the pxd table which is passed as the 1st\nargument.\n\nThis fixes the below double free kasan issue seen with PMEM:\n\nradix-mmu: Mapped 0x0000047d10000000-0x0000047f90000000 with 2.00 MiB pages\n==================================================================\nBUG: KASAN: double-free in kasan_remove_zero_shadow+0x9c4/0xa20\nFree of addr c0000003c38e0000 by task ndctl/2164\n\nCPU: 34 UID: 0 PID: 2164 Comm: ndctl Not tainted 6.19.0-rc1-00048-gea1013c15392 #157 VOLUNTARY\nHardware name: IBM,9080-HEX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_012) hv:phyp pSeries\nCall Trace:\n dump_stack_lvl+0x88/0xc4 (unreliable)\n print_report+0x214/0x63c\n kasan_report_invalid_free+0xe4/0x110\n check_slab_allocation+0x100/0x150\n kmem_cache_free+0x128/0x6e0\n kasan_remove_zero_shadow+0x9c4/0xa20\n memunmap_pages+0x2b8/0x5c0\n devm_action_release+0x54/0x70\n release_nodes+0xc8/0x1a0\n devres_release_all+0xe0/0x140\n device_unbind_cleanup+0x30/0x120\n device_release_driver_internal+0x3e4/0x450\n unbind_store+0xfc/0x110\n drv_attr_store+0x78/0xb0\n sysfs_kf_write+0x114/0x140\n kernfs_fop_write_iter+0x264/0x3f0\n vfs_write+0x3bc/0x7d0\n ksys_write+0xa4/0x190\n system_call_exception+0x190/0x480\n system_call_vectored_common+0x15c/0x2ec\n---- interrupt: 3000 at 0x7fff93b3d3f4\nNIP: 00007fff93b3d3f4 LR: 00007fff93b3d3f4 CTR: 0000000000000000\nREGS: c0000003f1b07e80 TRAP: 3000 Not tainted (6.19.0-rc1-00048-gea1013c15392)\nMSR: 800000000280f033 CR: 48888208 XER: 00000000\n<...>\nNIP [00007fff93b3d3f4] 0x7fff93b3d3f4\nLR [00007fff93b3d3f4] 0x7fff93b3d3f4\n---- interrupt: 3000\n\n The buggy address belongs to the object at c0000003c38e0000\n which belongs to the cache pgtable-2^9 of size 4096\n The buggy address is located 0 bytes inside of\n 4096-byte region [c0000003c38e0000, c0000003c38e1000)\n\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3c38c\n head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n memcg:c0000003bfd63e01\n flags: 0x63ffff800000040(head|node=6|zone=0|lastcpupid=0x7ffff)\n page_type: f5(slab)\n raw: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000\n raw: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01\n head: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000\n head: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01\n head: 063ffff800000002 c00c000000f0e301 00000000ffffffff 00000000ffffffff\n head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004\n page dumped because: kasan: bad access detected\n\n[ 138.953636] [ T2164] Memory state around the buggy address:\n[ 138.953643] [ T2164] c0000003c38dff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953652] [ T2164] c0000003c38dff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953661] [ T2164] >c0000003c38e0000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953669] [ T2164] ^\n[ 138.953675] [ T2164] c0000003c38e0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953684] [ T2164] c0000003c38e0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953692] [ T2164] ==================================================================\n[ 138.953701] [ T2164] Disabling lock debugging due to kernel taint"}],"id":"CVE-2026-31686","lastModified":"2026-11-06T16:18:07.867","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31686","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:18.800871Z","version":"2.0.3"}}]},"published":"2026-04-27T18:16:53.987","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2277246ea265cdca64ce6fdea4b26cd6ff0ec4db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3298bdf5a878ded06351eb293856fa84e050029e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51d8c78be0c27ddb91bc2c0263941d8b30a47d3b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7d7b2d5c107a1f6302cf0006d859985e7c3ddd1c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/85d98614e089a67dc6faa8ca766fe10a639f82b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a05f77cb227c39c5069aea6f12762a29d1e6c103"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b38237a2ea9c6c19836eee2c57037e1f9f103576"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cec74b2ab7dff866b1d77eaa545b9e8fd14a1f87"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6204f7ff6aff62ce6242a76982c5ba3a9ded707"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["mm/kasan/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"7d7b2d5c107a1f6302cf0006d859985e7c3ddd1c","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"3298bdf5a878ded06351eb293856fa84e050029e","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"2277246ea265cdca64ce6fdea4b26cd6ff0ec4db","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"cec74b2ab7dff866b1d77eaa545b9e8fd14a1f87","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"a05f77cb227c39c5069aea6f12762a29d1e6c103","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"f6204f7ff6aff62ce6242a76982c5ba3a9ded707","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"85d98614e089a67dc6faa8ca766fe10a639f82b4","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"b38237a2ea9c6c19836eee2c57037e1f9f103576","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"},{"lessThan":"51d8c78be0c27ddb91bc2c0263941d8b30a47d3b","status":"affected","version":"0207df4fa1a869281ddbf72db6203dbf036b3e1a","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["mm/kasan/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.136","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.83","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.24","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"C65C5FE4-6002-4BBA-98A9-87D1F99A643F","versionEndExcluding":"6.6.136","versionStartIncluding":"4.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8","versionEndExcluding":"6.12.83","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"8126B8B8-6D0B-4443-86C1-672AEE893555","versionEndExcluding":"6.18.24","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"D6A8A074-BBF4-4803-ABED-519A839435BB","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"9B5888AB-7403-4335-89E4-21CC0B48366A","versionEndExcluding":"7.0.1","versionStartIncluding":"7.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/kasan: fix double free for kasan pXds\n\nkasan_free_pxd() assumes the page table is always struct page aligned. \nBut that's not always the case for all architectures. E.g. In case of\npowerpc with 64K pagesize, PUD table (of size 4096) comes from slab cache\nnamed pgtable-2^9. Hence instead of page_to_virt(pxd_page()) let's just\ndirectly pass the start of the pxd table which is passed as the 1st\nargument.\n\nThis fixes the below double free kasan issue seen with PMEM:\n\nradix-mmu: Mapped 0x0000047d10000000-0x0000047f90000000 with 2.00 MiB pages\n==================================================================\nBUG: KASAN: double-free in kasan_remove_zero_shadow+0x9c4/0xa20\nFree of addr c0000003c38e0000 by task ndctl/2164\n\nCPU: 34 UID: 0 PID: 2164 Comm: ndctl Not tainted 6.19.0-rc1-00048-gea1013c15392 #157 VOLUNTARY\nHardware name: IBM,9080-HEX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NH1060_012) hv:phyp pSeries\nCall Trace:\n dump_stack_lvl+0x88/0xc4 (unreliable)\n print_report+0x214/0x63c\n kasan_report_invalid_free+0xe4/0x110\n check_slab_allocation+0x100/0x150\n kmem_cache_free+0x128/0x6e0\n kasan_remove_zero_shadow+0x9c4/0xa20\n memunmap_pages+0x2b8/0x5c0\n devm_action_release+0x54/0x70\n release_nodes+0xc8/0x1a0\n devres_release_all+0xe0/0x140\n device_unbind_cleanup+0x30/0x120\n device_release_driver_internal+0x3e4/0x450\n unbind_store+0xfc/0x110\n drv_attr_store+0x78/0xb0\n sysfs_kf_write+0x114/0x140\n kernfs_fop_write_iter+0x264/0x3f0\n vfs_write+0x3bc/0x7d0\n ksys_write+0xa4/0x190\n system_call_exception+0x190/0x480\n system_call_vectored_common+0x15c/0x2ec\n---- interrupt: 3000 at 0x7fff93b3d3f4\nNIP: 00007fff93b3d3f4 LR: 00007fff93b3d3f4 CTR: 0000000000000000\nREGS: c0000003f1b07e80 TRAP: 3000 Not tainted (6.19.0-rc1-00048-gea1013c15392)\nMSR: 800000000280f033 CR: 48888208 XER: 00000000\n<...>\nNIP [00007fff93b3d3f4] 0x7fff93b3d3f4\nLR [00007fff93b3d3f4] 0x7fff93b3d3f4\n---- interrupt: 3000\n\n The buggy address belongs to the object at c0000003c38e0000\n which belongs to the cache pgtable-2^9 of size 4096\n The buggy address is located 0 bytes inside of\n 4096-byte region [c0000003c38e0000, c0000003c38e1000)\n\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3c38c\n head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n memcg:c0000003bfd63e01\n flags: 0x63ffff800000040(head|node=6|zone=0|lastcpupid=0x7ffff)\n page_type: f5(slab)\n raw: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000\n raw: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01\n head: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000\n head: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01\n head: 063ffff800000002 c00c000000f0e301 00000000ffffffff 00000000ffffffff\n head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004\n page dumped because: kasan: bad access detected\n\n[ 138.953636] [ T2164] Memory state around the buggy address:\n[ 138.953643] [ T2164] c0000003c38dff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953652] [ T2164] c0000003c38dff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953661] [ T2164] >c0000003c38e0000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953669] [ T2164] ^\n[ 138.953675] [ T2164] c0000003c38e0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953684] [ T2164] c0000003c38e0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953692] [ T2164] ==================================================================\n[ 138.953701] [ T2164] Disabling lock debugging due to kernel taint"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmm/kasan: corregir doble liberación para kasan pXds\n\nkasan_free_pxd() asume que la tabla de páginas siempre está alineada con struct page. Pero ese no es siempre el caso para todas las arquitecturas. Por ejemplo, en el caso de powerpc con un tamaño de página de 64K, la tabla PUD (de tamaño 4096) proviene de la caché de losa (slab cache) llamada pgtable-2^9. Por lo tanto, en lugar de page_to_virt(pxd_page()), pasemos directamente el inicio de la tabla pxd que se pasa como el 1er argumento.\n\nEsto corrige el siguiente problema de doble liberación de kasan visto con PMEM:\n\nradix-mmu: Mapeado 0x 0000047d10000000-0x 0000047f90000000 con páginas de 2.00 MiB\n==================================================================\nBUG: KASAN: doble-liberación en kasan_remove_zero_shadow+0x9c4/0xa20\nLiberación de la dirección c0000003c38e0000 por la tarea ndctl/2164\n\nCPU: 34 UID: 0 PID: 2164 Comm: ndctl No contaminado 6.19.0-rc1-00048-gea1013c15392 #157 VOLUNTARIO\nNombre del hardware: IBM,9080-HEX POWER10 (arquitectado) 0x 800200 0x f000006 de:IBM,FW1060.00 (NH1060_012) hv:phyp pSeries\nTraza de Llamada:\n dump_stack_lvl+0x88/0xc4 (no fiable)\n print_report+0x214/0x63c\n kasan_report_invalid_free+0xe4/0x110\n check_slab_allocation+0x100/0x150\n kmem_cache_free+0x128/0x6e0\n kasan_remove_zero_shadow+0x9c4/0xa20\n memunmap_pages+0x2b8/0x5c0\n devm_action_release+0x54/0x70\n release_nodes+0xc8/0x1a0\n devres_release_all+0xe0/0x140\n device_unbind_cleanup+0x30/0x120\n device_release_driver_internal+0x3e4/0x450\n unbind_store+0xfc/0x110\n drv_attr_store+0x78/0xb0\n sysfs_kf_write+0x114/0x140\n kernfs_fop_write_iter+0x264/0x3f0\n vfs_write+0x3bc/0x7d0\n ksys_write+0xa4/0x190\n system_call_exception+0x190/0x480\n system_call_vectored_common+0x15c/0x2ec\n- - - - interrupción: 3000 en 0x 7fff93b3d3f4\nNIP: 00007fff93b3d3f4 LR: 00007fff93b3d3f4 CTR: 0000000000000000\nREGS: c0000003f1b07e80 TRAP: 3000 No contaminado (6.19.0-rc1-00048-gea1013c15392)\nMSR: 800000000280f033 CR: 48888208 XER: 00000000\n<...>\nNIP [00007fff93b3d3f4] 0x 7fff93b3d3f4\nLR [00007fff93b3d3f4] 0x 7fff93b3d3f4\n- - - - interrupción: 3000\n\n La dirección errónea pertenece al objeto en c0000003c38e0000\n que pertenece a la caché pgtable-2^9 de tamaño 4096\n La dirección errónea se encuentra a 0 bytes dentro de\n la región de 4096 bytes [c0000003c38e0000, c0000003c38e1000)\n\n La dirección errónea pertenece a la página física:\npágina: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x 3c38c\ncabecera: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\nmemcg:c0000003bfd63e01\nflags: 0x 63ffff800000040(head|node=6|zone=0|lastcpupid=0x 7ffff)\npage_type: f5(slab)\nraw: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000\nraw: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01\nhead: 063ffff800000040 c000000140058980 5deadbeef0000122 0000000000000000\nhead: 0000000000000000 0000000080200020 00000000f5000000 c0000003bfd63e01\nhead: 063ffff800000002 c00c000000f0e301 00000000ffffffff 00000000ffffffff\nhead: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004\npágina volcada porque: kasan: acceso incorrecto detectado\n\n[ 138.953636] [ T2164] Estado de la memoria alrededor de la dirección errónea:\n[ 138.953643] [ T2164] c0000003c38dff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953652] [ T2164] c0000003c38dff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953661] [ T2164] >c0000003c38e0000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953669] [ T2164] ^\n[ 138.953675] [ T2164] c0000003c38e0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953684] [ T2164] c0000003c38e0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n[ 138.953692] [ T2164] ==================================================================\n[ 138.953701] [ T2164] Deshabilitando la depuración de bloqueos debido a la contaminación del kernel"}],"id":"CVE-2026-31686","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31686","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:18.800871Z","version":"2.0.3"}}]},"published":"2026-04-27T18:16:53.987","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/2277246ea265cdca64ce6fdea4b26cd6ff0ec4db"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/3298bdf5a878ded06351eb293856fa84e050029e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51d8c78be0c27ddb91bc2c0263941d8b30a47d3b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","url":"https://git.kernel.org/stable/c/7d7b2d5c107a1f6302cf0006d859985e7c3ddd1c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/85d98614e089a67dc6faa8ca766fe10a639f82b4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a05f77cb227c39c5069aea6f12762a29d1e6c103"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b38237a2ea9c6c19836eee2c57037e1f9f103576"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/cec74b2ab7dff866b1d77eaa545b9e8fd14a1f87"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/f6204f7ff6aff62ce6242a76982c5ba3a9ded707"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-415"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31687.json b/data/2026/CVE-2026-31687.json index 44354d66ba..019954b1e6 100644 --- a/data/2026/CVE-2026-31687.json +++ b/data/2026/CVE-2026-31687.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpio/gpio-omap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"57bcd3feffa79544c73a1a1872472389a391cc79","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"86588916e1887a5edb8a9161cd7ae81e47a7ed25","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"a29215961d833f4de33a09c3964d31ebc6083033","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"1c04c3a4de8d4bcb9202f94c44f26c57c2572308","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"673dafb9a86349a12a93151fd467625614dc7e12","status":"affected","version":"adc1796eced46b48e23ec200a219d635f33a38ee","versionType":"git"},{"lessThan":"2211d77892913804d16c28c7415b82804ab1e54c","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"a7fa9460b86f810913b6779461d0448e7c11214c","status":"affected","version":"cd0e0a76e40c2e77bcfc88291d00dca22b00158e","versionType":"git"},{"lessThan":"32f08c3ddd6dda6cbb6c9d715de10f21dccde50f","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"53a76425e0764421ba93bb9045d2e454667d5687","status":"affected","version":"8d76b2488eb3cc0717ab81b60622cff4a5f90f79","versionType":"git"},{"lessThan":"730e5ebff40c852e3ea57b71bf02a4b89c69435f","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"03db4dc9ad6eb91e640b517e00373ce877682854","status":"affected","version":"bc82e5f4d7dc8237ae8cabc73aa46fc93c85d98c","versionType":"git"},{"lessThan":"6.6.126","status":"affected","version":"6.6.125","versionType":"semver"},{"lessThan":"6.12.73","status":"affected","version":"6.12.72","versionType":"semver"},{"lessThan":"6.18.12","status":"affected","version":"6.18.11","versionType":"semver"},{"lessThan":"6.19.2","status":"affected","version":"6.19.1","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpio/gpio-omap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.251","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.201","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.164","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.125","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.126","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.72","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.73","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.12","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.19","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"37FB49FC-871B-4978-83B6-4B6AA54014C2","versionEndExcluding":"5.10.251","versionStartIncluding":"2.6.22","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"600A89ED-86F2-48D8-BB7C-5EE7A8832FC5","versionEndExcluding":"5.15.201","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6892F74B-3F14-4500-9652-24A2ECB04144","versionEndExcluding":"6.1.164","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"74B70CDE-7B74-4280-BBCC-8889B8F28466","versionEndExcluding":"6.6.125","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F1A7E514-FB3C-4B6B-8046-07D5A8F04644","versionEndExcluding":"6.12.72","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7099A9EC-3D54-4424-BF01-7224EF88C79C","versionEndExcluding":"6.18.11","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*","matchCriteriaId":"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*","matchCriteriaId":"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*","matchCriteriaId":"F71D92C0-C023-48BD-B3B6-70B638EEE298","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*","matchCriteriaId":"13580667-0A98-40CC-B29F-D12790B91BDB","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*","matchCriteriaId":"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*","matchCriteriaId":"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*","matchCriteriaId":"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: omap: do not register driver in probe()\n\nCommit 11a78b794496 (\"ARM: OMAP: MPUIO wake updates\") registers the\nomap_mpuio_driver from omap_mpuio_init(), which is called from\nomap_gpio_probe().\n\nHowever, it neither makes sense to register drivers from probe()\ncallbacks of other drivers, nor does the driver core allow registering\ndrivers with a device lock already being held.\n\nThe latter was revealed by commit dc23806a7c47 (\"driver core: enforce\ndevice_lock for driver_match_device()\") leading to a potential deadlock\ncondition described in [1].\n\nAdditionally, the omap_mpuio_driver is never unregistered from the\ndriver core, even if the module is unloaded.\n\nHence, register the omap_mpuio_driver from the module initcall and\nunregister it in module_exit()."}],"id":"CVE-2026-31687","lastModified":"2026-06-17T10:34:14.477","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-27T18:16:54.143","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03db4dc9ad6eb91e640b517e00373ce877682854"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c04c3a4de8d4bcb9202f94c44f26c57c2572308"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2211d77892913804d16c28c7415b82804ab1e54c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/32f08c3ddd6dda6cbb6c9d715de10f21dccde50f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/53a76425e0764421ba93bb9045d2e454667d5687"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/57bcd3feffa79544c73a1a1872472389a391cc79"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/673dafb9a86349a12a93151fd467625614dc7e12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/730e5ebff40c852e3ea57b71bf02a4b89c69435f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/86588916e1887a5edb8a9161cd7ae81e47a7ed25"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a29215961d833f4de33a09c3964d31ebc6083033"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7fa9460b86f810913b6779461d0448e7c11214c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpio/gpio-omap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"57bcd3feffa79544c73a1a1872472389a391cc79","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"86588916e1887a5edb8a9161cd7ae81e47a7ed25","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"a29215961d833f4de33a09c3964d31ebc6083033","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"1c04c3a4de8d4bcb9202f94c44f26c57c2572308","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"673dafb9a86349a12a93151fd467625614dc7e12","status":"affected","version":"adc1796eced46b48e23ec200a219d635f33a38ee","versionType":"git"},{"lessThan":"2211d77892913804d16c28c7415b82804ab1e54c","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"a7fa9460b86f810913b6779461d0448e7c11214c","status":"affected","version":"cd0e0a76e40c2e77bcfc88291d00dca22b00158e","versionType":"git"},{"lessThan":"32f08c3ddd6dda6cbb6c9d715de10f21dccde50f","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"53a76425e0764421ba93bb9045d2e454667d5687","status":"affected","version":"8d76b2488eb3cc0717ab81b60622cff4a5f90f79","versionType":"git"},{"lessThan":"730e5ebff40c852e3ea57b71bf02a4b89c69435f","status":"affected","version":"11a78b7944963a8b052be46108d07a3ced9e2762","versionType":"git"},{"lessThan":"03db4dc9ad6eb91e640b517e00373ce877682854","status":"affected","version":"bc82e5f4d7dc8237ae8cabc73aa46fc93c85d98c","versionType":"git"},{"lessThan":"6.6.126","status":"affected","version":"6.6.125","versionType":"semver"},{"lessThan":"6.12.73","status":"affected","version":"6.12.72","versionType":"semver"},{"lessThan":"6.18.12","status":"affected","version":"6.18.11","versionType":"semver"},{"lessThan":"6.19.2","status":"affected","version":"6.19.1","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpio/gpio-omap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.251","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.201","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.164","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.125","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.126","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.72","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.73","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.11","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.12","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.2","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.19","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"37FB49FC-871B-4978-83B6-4B6AA54014C2","versionEndExcluding":"5.10.251","versionStartIncluding":"2.6.22","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"600A89ED-86F2-48D8-BB7C-5EE7A8832FC5","versionEndExcluding":"5.15.201","versionStartIncluding":"5.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6892F74B-3F14-4500-9652-24A2ECB04144","versionEndExcluding":"6.1.164","versionStartIncluding":"5.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"74B70CDE-7B74-4280-BBCC-8889B8F28466","versionEndExcluding":"6.6.125","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"F1A7E514-FB3C-4B6B-8046-07D5A8F04644","versionEndExcluding":"6.12.72","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"7099A9EC-3D54-4424-BF01-7224EF88C79C","versionEndExcluding":"6.18.11","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*","matchCriteriaId":"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*","matchCriteriaId":"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*","matchCriteriaId":"F71D92C0-C023-48BD-B3B6-70B638EEE298","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*","matchCriteriaId":"13580667-0A98-40CC-B29F-D12790B91BDB","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*","matchCriteriaId":"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*","matchCriteriaId":"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*","matchCriteriaId":"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: omap: do not register driver in probe()\n\nCommit 11a78b794496 (\"ARM: OMAP: MPUIO wake updates\") registers the\nomap_mpuio_driver from omap_mpuio_init(), which is called from\nomap_gpio_probe().\n\nHowever, it neither makes sense to register drivers from probe()\ncallbacks of other drivers, nor does the driver core allow registering\ndrivers with a device lock already being held.\n\nThe latter was revealed by commit dc23806a7c47 (\"driver core: enforce\ndevice_lock for driver_match_device()\") leading to a potential deadlock\ncondition described in [1].\n\nAdditionally, the omap_mpuio_driver is never unregistered from the\ndriver core, even if the module is unloaded.\n\nHence, register the omap_mpuio_driver from the module initcall and\nunregister it in module_exit()."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngpio: omap: no registrar controlador en probe()\n\nEl commit 11a78b794496 (’ARM: OMAP: actualizaciones de activación de MPUIO’) registra el omap_mpuio_driver desde omap_mpuio_init(), que es llamado desde omap_gpio_probe().\n\nSin embargo, ni tiene sentido registrar controladores desde las retrollamadas de probe() de otros controladores, ni el núcleo del controlador permite registrar controladores con un bloqueo de dispositivo ya mantenido.\n\nEsto último fue revelado por el commit dc23806a7c47 (’núcleo del controlador: forzar device_lock para driver_match_device()’) lo que lleva a una posible condición de interbloqueo descrita en [1].\n\nAdemás, el omap_mpuio_driver nunca es dado de baja del núcleo del controlador, incluso si el módulo es descargado.\n\nPor lo tanto, registrar el omap_mpuio_driver desde la llamada de inicialización del módulo y darlo de baja en module_exit()."}],"id":"CVE-2026-31687","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-27T18:16:54.143","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/03db4dc9ad6eb91e640b517e00373ce877682854"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/1c04c3a4de8d4bcb9202f94c44f26c57c2572308"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/2211d77892913804d16c28c7415b82804ab1e54c"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/32f08c3ddd6dda6cbb6c9d715de10f21dccde50f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/53a76425e0764421ba93bb9045d2e454667d5687"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/57bcd3feffa79544c73a1a1872472389a391cc79"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/673dafb9a86349a12a93151fd467625614dc7e12"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/730e5ebff40c852e3ea57b71bf02a4b89c69435f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/86588916e1887a5edb8a9161cd7ae81e47a7ed25"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a29215961d833f4de33a09c3964d31ebc6083033"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/a7fa9460b86f810913b6779461d0448e7c11214c"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-667"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31689.json b/data/2026/CVE-2026-31689.json index 41df5ff474..1cea315c16 100644 --- a/data/2026/CVE-2026-31689.json +++ b/data/2026/CVE-2026-31689.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/edac/edac_mc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"aae95970fad2127a1bd49d8713c7cd0677dcd2d6","status":"affected","version":"0bbb265f7089584aaa6d440805ca75ea4f3930d4","versionType":"git"},{"lessThan":"d3de72e2a2b9ee3a57734c1c068823e41a707715","status":"affected","version":"0bbb265f7089584aaa6d440805ca75ea4f3930d4","versionType":"git"},{"lessThan":"d20e98c2df9354cc744431ad8ccbf49405b8b40f","status":"affected","version":"0bbb265f7089584aaa6d440805ca75ea4f3930d4","versionType":"git"},{"lessThan":"87ce8ae511962e105bcb3534944208c6a9471ed9","status":"affected","version":"0bbb265f7089584aaa6d440805ca75ea4f3930d4","versionType":"git"},{"lessThan":"75825648ce984ca4cebb28e4bd2bf8c3a7e837c5","status":"affected","version":"0bbb265f7089584aaa6d440805ca75ea4f3930d4","versionType":"git"},{"lessThan":"51520e03e70d6c73e33ee7cbe0319767d05764fe","status":"affected","version":"0bbb265f7089584aaa6d440805ca75ea4f3930d4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/edac/edac_mc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3AB249AE-837F-4928-AD92-D399D2D3E94A","versionEndExcluding":"6.1.169","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/mc: Fix error path ordering in edac_mc_alloc()\n\nWhen the mci->pvt_info allocation in edac_mc_alloc() fails, the error path\nwill call put_device() which will end up calling the device's release\nfunction.\n\nHowever, the init ordering is wrong such that device_initialize() happens\n*after* the failed allocation and thus the device itself and the release\nfunction pointer are not initialized yet when they're called:\n\n MCE: In-kernel MCE decoding enabled.\n ------------[ cut here ]------------\n kobject: '(null)': is not initialized, yet kobject_put() is being called.\n WARNING: lib/kobject.c:734 at kobject_put, CPU#22: systemd-udevd\n CPU: 22 UID: 0 PID: 538 Comm: systemd-udevd Not tainted 7.0.0-rc1+ #2 PREEMPT(full)\n RIP: 0010:kobject_put\n Call Trace:\n \n edac_mc_alloc+0xbe/0xe0 [edac_core]\n amd64_edac_init+0x7a4/0xff0 [amd64_edac]\n ? __pfx_amd64_edac_init+0x10/0x10 [amd64_edac]\n do_one_initcall\n ...\n\nReorder the calling sequence so that the device is initialized and thus the\nrelease function pointer is properly set before it can be used.\n\nThis was found by Claude while reviewing another EDAC patch."}],"id":"CVE-2026-31689","lastModified":"2026-06-17T10:34:14.720","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-27T18:16:54.387","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51520e03e70d6c73e33ee7cbe0319767d05764fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75825648ce984ca4cebb28e4bd2bf8c3a7e837c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/87ce8ae511962e105bcb3534944208c6a9471ed9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aae95970fad2127a1bd49d8713c7cd0677dcd2d6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d20e98c2df9354cc744431ad8ccbf49405b8b40f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3de72e2a2b9ee3a57734c1c068823e41a707715"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/edac/edac_mc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"aae95970fad2127a1bd49d8713c7cd0677dcd2d6","status":"affected","version":"0bbb265f7089584aaa6d440805ca75ea4f3930d4","versionType":"git"},{"lessThan":"d3de72e2a2b9ee3a57734c1c068823e41a707715","status":"affected","version":"0bbb265f7089584aaa6d440805ca75ea4f3930d4","versionType":"git"},{"lessThan":"d20e98c2df9354cc744431ad8ccbf49405b8b40f","status":"affected","version":"0bbb265f7089584aaa6d440805ca75ea4f3930d4","versionType":"git"},{"lessThan":"87ce8ae511962e105bcb3534944208c6a9471ed9","status":"affected","version":"0bbb265f7089584aaa6d440805ca75ea4f3930d4","versionType":"git"},{"lessThan":"75825648ce984ca4cebb28e4bd2bf8c3a7e837c5","status":"affected","version":"0bbb265f7089584aaa6d440805ca75ea4f3930d4","versionType":"git"},{"lessThan":"51520e03e70d6c73e33ee7cbe0319767d05764fe","status":"affected","version":"0bbb265f7089584aaa6d440805ca75ea4f3930d4","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/edac/edac_mc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.169","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.135","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.82","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"3AB249AE-837F-4928-AD92-D399D2D3E94A","versionEndExcluding":"6.1.169","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"15C1A1B2-14EE-494C-AF3E-D5A7BA640B39","versionEndExcluding":"6.6.135","versionStartIncluding":"6.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"02904CAE-71D2-45B3-9EC3-F6A9D18B6307","versionEndExcluding":"6.12.82","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"E9E09FDD-9EE3-4A56-92E2-2B30AFD0072F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/mc: Fix error path ordering in edac_mc_alloc()\n\nWhen the mci->pvt_info allocation in edac_mc_alloc() fails, the error path\nwill call put_device() which will end up calling the device's release\nfunction.\n\nHowever, the init ordering is wrong such that device_initialize() happens\n*after* the failed allocation and thus the device itself and the release\nfunction pointer are not initialized yet when they're called:\n\n MCE: In-kernel MCE decoding enabled.\n ------------[ cut here ]------------\n kobject: '(null)': is not initialized, yet kobject_put() is being called.\n WARNING: lib/kobject.c:734 at kobject_put, CPU#22: systemd-udevd\n CPU: 22 UID: 0 PID: 538 Comm: systemd-udevd Not tainted 7.0.0-rc1+ #2 PREEMPT(full)\n RIP: 0010:kobject_put\n Call Trace:\n \n edac_mc_alloc+0xbe/0xe0 [edac_core]\n amd64_edac_init+0x7a4/0xff0 [amd64_edac]\n ? __pfx_amd64_edac_init+0x10/0x10 [amd64_edac]\n do_one_initcall\n ...\n\nReorder the calling sequence so that the device is initialized and thus the\nrelease function pointer is properly set before it can be used.\n\nThis was found by Claude while reviewing another EDAC patch."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nEDAC/mc: Corregir el orden de la ruta de error en edac_mc_alloc()\n\nCuando la asignación de mci -> pvt_info en edac_mc_alloc() falla, la ruta de error llamará a put_device(), lo que terminará llamando a la función de liberación del dispositivo.\n\nSin embargo, el orden de inicialización es incorrecto, de tal manera que device_initialize() ocurre después de la asignación fallida y, por lo tanto, el dispositivo en sí y el puntero de la función de liberación no están inicializados aún cuando son llamados:\n\n MCE: In-kernel MCE decoding enabled.\n - - - - - - - - - - - -[ cut here ]- - - - - - - - - - - -\n kobject: ’(null)’: is not initialized, yet kobject_put() is being called.\n WARNING: lib/kobject.c:734 at kobject_put, CPU#22: systemd-udevd\n CPU: 22 UID: 0 PID: 538 Comm: systemd-udevd Not tainted 7.0.0-rc1+ #2 PREEMPT(full)\n RIP: 0010:kobject_put\n Call Trace:\n [TASK]\n edac_mc_alloc+0xbe/0xe0 [edac_core]\n amd64_edac_init+0x7a4/0xff0 [amd64_edac]\n ? __pfx_amd64_edac_init+0x10/0x10 [amd64_edac]\n do_one_initcall\n ...\n\nReordenar la secuencia de llamadas para que el dispositivo sea inicializado y, por lo tanto, el puntero de la función de liberación esté correctamente establecido antes de que pueda ser utilizado.\n\nEsto fue encontrado por Claude mientras revisaba otro parche EDAC."}],"id":"CVE-2026-31689","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-27T18:16:54.387","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/51520e03e70d6c73e33ee7cbe0319767d05764fe"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/75825648ce984ca4cebb28e4bd2bf8c3a7e837c5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/87ce8ae511962e105bcb3534944208c6a9471ed9"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/aae95970fad2127a1bd49d8713c7cd0677dcd2d6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d20e98c2df9354cc744431ad8ccbf49405b8b40f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/d3de72e2a2b9ee3a57734c1c068823e41a707715"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-476"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31690.json b/data/2026/CVE-2026-31690.json index 0276464ae6..307ec0e57b 100644 --- a/data/2026/CVE-2026-31690.json +++ b/data/2026/CVE-2026-31690.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/firmware/thead,th1520-aon.c","include/linux/firmware/thead/thead,th1520-aon.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb","status":"affected","version":"e4b3cbd840e565484d0ad8d260d27c057466ed17","versionType":"git"},{"lessThan":"bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97","status":"affected","version":"e4b3cbd840e565484d0ad8d260d27c057466ed17","versionType":"git"},{"lessThan":"88c4bd90725557796c15878b7cb70066e9e6b5ab","status":"affected","version":"e4b3cbd840e565484d0ad8d260d27c057466ed17","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/firmware/thead,th1520-aon.c","include/linux/firmware/thead/thead,th1520-aon.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"087D96F9-5A25-4AC4-AA79-B18E87DE65DF","versionEndExcluding":"6.18.23","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: thead: Fix buffer overflow and use standard endian macros\n\nAddresses two issues in the TH1520 AON firmware protocol driver:\n\n1. Fix a potential buffer overflow where the code used unsafe pointer\n arithmetic to access the 'mode' field through the 'resource' pointer\n with an offset. This was flagged by Smatch static checker as:\n \"buffer overflow 'data' 2 <= 3\"\n\n2. Replace custom RPC_SET_BE* and RPC_GET_BE* macros with standard\n kernel endianness conversion macros (cpu_to_be16, etc.) for better\n portability and maintainability.\n\nThe functionality was re-tested with the GPU power-up sequence,\nconfirming the GPU powers up correctly and the driver probes\nsuccessfully.\n\n[ 12.702370] powervr ffef400000.gpu: [drm] loaded firmware\npowervr/rogue_36.52.104.182_v1.fw\n[ 12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build\n6645434 OS)\n[ 12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gpu on\nminor 0"}],"id":"CVE-2026-31690","lastModified":"2026-06-17T10:34:14.837","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-27T18:16:54.507","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/88c4bd90725557796c15878b7cb70066e9e6b5ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/firmware/thead,th1520-aon.c","include/linux/firmware/thead/thead,th1520-aon.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb","status":"affected","version":"e4b3cbd840e565484d0ad8d260d27c057466ed17","versionType":"git"},{"lessThan":"bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97","status":"affected","version":"e4b3cbd840e565484d0ad8d260d27c057466ed17","versionType":"git"},{"lessThan":"88c4bd90725557796c15878b7cb70066e9e6b5ab","status":"affected","version":"e4b3cbd840e565484d0ad8d260d27c057466ed17","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/firmware/thead,th1520-aon.c","include/linux/firmware/thead/thead,th1520-aon.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.15"},{"lessThan":"6.15","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"087D96F9-5A25-4AC4-AA79-B18E87DE65DF","versionEndExcluding":"6.18.23","versionStartIncluding":"6.15","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: thead: Fix buffer overflow and use standard endian macros\n\nAddresses two issues in the TH1520 AON firmware protocol driver:\n\n1. Fix a potential buffer overflow where the code used unsafe pointer\n arithmetic to access the 'mode' field through the 'resource' pointer\n with an offset. This was flagged by Smatch static checker as:\n \"buffer overflow 'data' 2 <= 3\"\n\n2. Replace custom RPC_SET_BE* and RPC_GET_BE* macros with standard\n kernel endianness conversion macros (cpu_to_be16, etc.) for better\n portability and maintainability.\n\nThe functionality was re-tested with the GPU power-up sequence,\nconfirming the GPU powers up correctly and the driver probes\nsuccessfully.\n\n[ 12.702370] powervr ffef400000.gpu: [drm] loaded firmware\npowervr/rogue_36.52.104.182_v1.fw\n[ 12.711043] powervr ffef400000.gpu: [drm] FW version v1.0 (build\n6645434 OS)\n[ 12.719787] [drm] Initialized powervr 1.0.0 for ffef400000.gpu on\nminor 0"},{"lang":"es","value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:\n\nfirmware: thead: Corrige el desbordamiento de búfer y usa macros endian estándar\n\nAborda dos problemas en el controlador del protocolo de firmware AON TH1520:\n\n1. Corrige un posible desbordamiento de búfer donde el código usaba aritmética de punteros insegura para acceder al campo ’mode’ a través del puntero ’resource’ con un desplazamiento. Esto fue marcado por el verificador estático Smatch como: ’buffer overflow ’data’ 2 menor o igual que 3’\n\n2. Reemplaza las macros personalizadas RPC_SET_BE y RPC_GET_BE con macros estándar de conversión de endianness del kernel (cpu_to_be16, etc.) para una mejor portabilidad y mantenibilidad.\n\nLa funcionalidad fue reevaluada con la secuencia de encendido de la GPU, confirmando que la GPU se enciende correctamente y el controlador se inicializa con éxito.\n\n[ 12.702370] powervr ffef400000.gpu: [drm] firmware cargado powervr/rogue_36.52.104.182_v1.fw\n[ 12.711043] powervr ffef400000.gpu: [drm] Versión de FW v1.0 (compilación 6645434 OS)\n[ 12.719787] [drm] powervr 1.0.0 inicializado para ffef400000.gpu en minor 0"}],"id":"CVE-2026-31690","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-04-27T18:16:54.507","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/88c4bd90725557796c15878b7cb70066e9e6b5ab"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/bd15a5deb5a7251dc1a0cf9186f0253f7eacdb97"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/fbdb43f6bb2a15ed382d6eb0ef82c8b07b0d47bb"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31691.json b/data/2026/CVE-2026-31691.json index 15bf9a6f13..637bb68fff 100644 --- a/data/2026/CVE-2026-31691.json +++ b/data/2026/CVE-2026-31691.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/intel/igb/igb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4700471775746058c962ded6e659bf908fd76e13","status":"affected","version":"2c6196013f84651772388a86dfd4bb033d0c0d45","versionType":"git"},{"lessThan":"27f5997686ee7fb7ac01be72b2010f168a3409fc","status":"affected","version":"2c6196013f84651772388a86dfd4bb033d0c0d45","versionType":"git"},{"lessThan":"b1e067240379f950a0022208e0685f3465c211cb","status":"affected","version":"2c6196013f84651772388a86dfd4bb033d0c0d45","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/intel/igb/igb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EA76AE25-9812-47C4-9714-A85435AEFA0F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nigb: remove napi_synchronize() in igb_down()\n\nWhen an AF_XDP zero-copy application terminates abruptly (e.g., kill -9),\nthe XSK buffer pool is destroyed but NAPI polling continues.\nigb_clean_rx_irq_zc() repeatedly returns the full budget, preventing\nnapi_complete_done() from clearing NAPI_STATE_SCHED.\n\nigb_down() calls napi_synchronize() before napi_disable() for each queue\nvector. napi_synchronize() spins waiting for NAPI_STATE_SCHED to clear,\nwhich never happens. igb_down() blocks indefinitely, the TX watchdog\nfires, and the TX queue remains permanently stalled.\n\nnapi_disable() already handles this correctly: it sets NAPI_STATE_DISABLE.\nAfter a full-budget poll, __napi_poll() checks napi_disable_pending(). If\nset, it forces completion and clears NAPI_STATE_SCHED, breaking the loop\nthat napi_synchronize() cannot.\n\nnapi_synchronize() was added in commit 41f149a285da (\"igb: Fix possible\npanic caused by Rx traffic arrival while interface is down\").\nnapi_disable() provides stronger guarantees: it prevents further\nscheduling and waits for any active poll to exit.\nOther Intel drivers (ixgbe, ice, i40e) use napi_disable() without a\npreceding napi_synchronize() in their down paths.\n\nRemove redundant napi_synchronize() call and reorder napi_disable()\nbefore igb_set_queue_napi() so the queue-to-NAPI mapping is only\ncleared after polling has fully stopped."}],"id":"CVE-2026-31691","lastModified":"2026-11-06T16:18:08.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31691","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:22.822570Z","version":"2.0.3"}}]},"published":"2026-04-27T18:16:54.610","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/27f5997686ee7fb7ac01be72b2010f168a3409fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4700471775746058c962ded6e659bf908fd76e13"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b1e067240379f950a0022208e0685f3465c211cb"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/intel/igb/igb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"4700471775746058c962ded6e659bf908fd76e13","status":"affected","version":"2c6196013f84651772388a86dfd4bb033d0c0d45","versionType":"git"},{"lessThan":"27f5997686ee7fb7ac01be72b2010f168a3409fc","status":"affected","version":"2c6196013f84651772388a86dfd4bb033d0c0d45","versionType":"git"},{"lessThan":"b1e067240379f950a0022208e0685f3465c211cb","status":"affected","version":"2c6196013f84651772388a86dfd4bb033d0c0d45","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/intel/igb/igb_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.14"},{"lessThan":"6.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.23","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.13","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"EA76AE25-9812-47C4-9714-A85435AEFA0F","versionEndExcluding":"6.18.23","versionStartIncluding":"6.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"1490EF9B-9080-481C-8D22-1306AAE664E4","versionEndExcluding":"6.19.13","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*","matchCriteriaId":"512EE3A8-A590-4501-9A94-5D4B268D6138","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nigb: remove napi_synchronize() in igb_down()\n\nWhen an AF_XDP zero-copy application terminates abruptly (e.g., kill -9),\nthe XSK buffer pool is destroyed but NAPI polling continues.\nigb_clean_rx_irq_zc() repeatedly returns the full budget, preventing\nnapi_complete_done() from clearing NAPI_STATE_SCHED.\n\nigb_down() calls napi_synchronize() before napi_disable() for each queue\nvector. napi_synchronize() spins waiting for NAPI_STATE_SCHED to clear,\nwhich never happens. igb_down() blocks indefinitely, the TX watchdog\nfires, and the TX queue remains permanently stalled.\n\nnapi_disable() already handles this correctly: it sets NAPI_STATE_DISABLE.\nAfter a full-budget poll, __napi_poll() checks napi_disable_pending(). If\nset, it forces completion and clears NAPI_STATE_SCHED, breaking the loop\nthat napi_synchronize() cannot.\n\nnapi_synchronize() was added in commit 41f149a285da (\"igb: Fix possible\npanic caused by Rx traffic arrival while interface is down\").\nnapi_disable() provides stronger guarantees: it prevents further\nscheduling and waits for any active poll to exit.\nOther Intel drivers (ixgbe, ice, i40e) use napi_disable() without a\npreceding napi_synchronize() in their down paths.\n\nRemove redundant napi_synchronize() call and reorder napi_disable()\nbefore igb_set_queue_napi() so the queue-to-NAPI mapping is only\ncleared after polling has fully stopped."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nigb: eliminar napi_synchronize() en igb_down()\n\nCuando una aplicación AF_XDP de copia cero termina abruptamente (por ejemplo, kill -9), el pool de búferes XSK es destruido pero el sondeo NAPI continúa. igb_clean_rx_irq_zc() devuelve repetidamente el presupuesto completo, impidiendo que napi_complete_done() borre NAPI_STATE_SCHED.\n\nigb_down() llama a napi_synchronize() antes de napi_disable() para cada vector de cola. napi_synchronize() gira esperando que NAPI_STATE_SCHED se borre, lo cual nunca ocurre. igb_down() se bloquea indefinidamente, el watchdog TX se activa, y la cola TX permanece permanentemente estancada.\n\nnapi_disable() ya maneja esto correctamente: establece NAPI_STATE_DISABLE. Después de un sondeo de presupuesto completo, __napi_poll() verifica napi_disable_pending(). Si está establecido, fuerza la finalización y borra NAPI_STATE_SCHED, rompiendo el bucle que napi_synchronize() no puede.\n\nnapi_synchronize() fue añadido en el commit 41f149a285da (’igb: Solucionar posible pánico causado por la llegada de tráfico Rx mientras la interfaz está inactiva’). napi_disable() proporciona garantías más sólidas: previene la programación adicional y espera a que cualquier sondeo activo finalice. Otros controladores Intel (ixgbe, ice, i40e) usan napi_disable() sin un napi_synchronize() precedente en sus rutas de desactivación.\n\nEliminar la llamada redundante a napi_synchronize() y reordenar napi_disable() antes de igb_set_queue_napi() para que el mapeo de cola a NAPI solo se borre después de que el sondeo se haya detenido por completo."}],"id":"CVE-2026-31691","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31691","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:24:22.822570Z","version":"2.0.3"}}]},"published":"2026-04-27T18:16:54.610","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/27f5997686ee7fb7ac01be72b2010f168a3409fc"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/4700471775746058c962ded6e659bf908fd76e13"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b1e067240379f950a0022208e0685f3465c211cb"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31783.json b/data/2026/CVE-2026-31783.json index 442e48f169..7762b2210f 100644 --- a/data/2026/CVE-2026-31783.json +++ b/data/2026/CVE-2026-31783.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/spi/spi-amlogic-spifc-a4.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ee4c064e37d4d0ddc5a7580933dbe79a2c6acafc","status":"affected","version":"4670db6f32e9379f5ab6c9bb2a6787cd9b9230a9","versionType":"git"},{"lessThan":"5e11741aec3b242a197250b473c37b58f53a16b6","status":"affected","version":"4670db6f32e9379f5ab6c9bb2a6787cd9b9230a9","versionType":"git"},{"lessThan":"b0dc7e7c56573e7a52080f25f3179a45f3dd7e6f","status":"affected","version":"4670db6f32e9379f5ab6c9bb2a6787cd9b9230a9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/spi/spi-amlogic-spifc-a4.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BF0DA3C1-164D-4E48-AFBD-FE1A0F1A543C","versionEndExcluding":"6.18.22","versionStartIncluding":"6.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*","matchCriteriaId":"DCE57113-2223-4308-A0F2-5E6ECFBB3C23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback\n\naml_sfc_probe() registers the on-host NAND ECC engine, but teardown was\nmissing from both probe unwind and remove-time cleanup. Add a devm cleanup\naction after successful registration so\nnand_ecc_unregister_on_host_hw_engine() runs automatically on probe\nfailures and during device removal."}],"id":"CVE-2026-31783","lastModified":"2026-06-17T10:34:27.347","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:41.813","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e11741aec3b242a197250b473c37b58f53a16b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b0dc7e7c56573e7a52080f25f3179a45f3dd7e6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee4c064e37d4d0ddc5a7580933dbe79a2c6acafc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/spi/spi-amlogic-spifc-a4.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ee4c064e37d4d0ddc5a7580933dbe79a2c6acafc","status":"affected","version":"4670db6f32e9379f5ab6c9bb2a6787cd9b9230a9","versionType":"git"},{"lessThan":"5e11741aec3b242a197250b473c37b58f53a16b6","status":"affected","version":"4670db6f32e9379f5ab6c9bb2a6787cd9b9230a9","versionType":"git"},{"lessThan":"b0dc7e7c56573e7a52080f25f3179a45f3dd7e6f","status":"affected","version":"4670db6f32e9379f5ab6c9bb2a6787cd9b9230a9","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/spi/spi-amlogic-spifc-a4.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BF0DA3C1-164D-4E48-AFBD-FE1A0F1A543C","versionEndExcluding":"6.18.22","versionStartIncluding":"6.18.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*","matchCriteriaId":"DCE57113-2223-4308-A0F2-5E6ECFBB3C23","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: amlogic: spifc-a4: unregister ECC engine on probe failure and remove() callback\n\naml_sfc_probe() registers the on-host NAND ECC engine, but teardown was\nmissing from both probe unwind and remove-time cleanup. Add a devm cleanup\naction after successful registration so\nnand_ecc_unregister_on_host_hw_engine() runs automatically on probe\nfailures and during device removal."},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nspi: amlogic: spifc-a4: desregistrar el motor ECC en caso de fallo de sondeo y en la función de devolución de llamada remove()\n\naml_sfc_probe() registra el motor ECC NAND en el host, pero faltaba la limpieza tanto de la reversión del sondeo como de la limpieza en tiempo de eliminación. Añadir una acción de limpieza devm después del registro exitoso para que nand_ecc_unregister_on_host_hw_engine() se ejecute automáticamente en caso de fallos de sondeo y durante la eliminación del dispositivo."}],"id":"CVE-2026-31783","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:41.813","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/5e11741aec3b242a197250b473c37b58f53a16b6"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b0dc7e7c56573e7a52080f25f3179a45f3dd7e6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/ee4c064e37d4d0ddc5a7580933dbe79a2c6acafc"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31784.json b/data/2026/CVE-2026-31784.json index f6a89c270a..0c81f87edb 100644 --- a/data/2026/CVE-2026-31784.json +++ b/data/2026/CVE-2026-31784.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_pxp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9e962e68a9d26135af67c423767c0983d9ad94c3","status":"affected","version":"ccd3c6820a9024bcb68c249b644b5e42f0f7b9d2","versionType":"git"},{"lessThan":"400ee45f80480c05c3fa673967f25faab8323753","status":"affected","version":"ccd3c6820a9024bcb68c249b644b5e42f0f7b9d2","versionType":"git"},{"lessThan":"76903b2057c8677c2c006e87fede15f496555dc0","status":"affected","version":"ccd3c6820a9024bcb68c249b644b5e42f0f7b9d2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_pxp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BAFCD467-09C6-4175-86E9-C7D4ED97987D","versionEndExcluding":"6.18.22","versionStartIncluding":"6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pxp: Clear restart flag in pxp_start after jumping back\n\nIf we don't clear the flag we'll keep jumping back at the beginning of\nthe function once we reach the end.\n\n(cherry picked from commit 0850ec7bb2459602351639dccf7a68a03c9d1ee0)"}],"id":"CVE-2026-31784","lastModified":"2026-11-06T16:18:10.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31784","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:35.194438Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:41.923","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/400ee45f80480c05c3fa673967f25faab8323753"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76903b2057c8677c2c006e87fede15f496555dc0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e962e68a9d26135af67c423767c0983d9ad94c3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_pxp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"9e962e68a9d26135af67c423767c0983d9ad94c3","status":"affected","version":"ccd3c6820a9024bcb68c249b644b5e42f0f7b9d2","versionType":"git"},{"lessThan":"400ee45f80480c05c3fa673967f25faab8323753","status":"affected","version":"ccd3c6820a9024bcb68c249b644b5e42f0f7b9d2","versionType":"git"},{"lessThan":"76903b2057c8677c2c006e87fede15f496555dc0","status":"affected","version":"ccd3c6820a9024bcb68c249b644b5e42f0f7b9d2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_pxp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"BAFCD467-09C6-4175-86E9-C7D4ED97987D","versionEndExcluding":"6.18.22","versionStartIncluding":"6.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"0A2B9540-02D5-41B4-B16A-82AF66FD4F36","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/pxp: Clear restart flag in pxp_start after jumping back\n\nIf we don't clear the flag we'll keep jumping back at the beginning of\nthe function once we reach the end.\n\n(cherry picked from commit 0850ec7bb2459602351639dccf7a68a03c9d1ee0)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe/pxp: Limpiar la bandera de reinicio en pxp_start después de saltar hacia atrás\n\nSi no limpiamos la bandera, seguiremos saltando hacia atrás al principio de la función una vez que lleguemos al final.\n\n(seleccionado de la confirmación 0850ec7bb2459602351639dccf7a68a03c9d1ee0)"}],"id":"CVE-2026-31784","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-31784","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-06T15:25:35.194438Z","version":"2.0.3"}}]},"published":"2026-05-01T15:16:41.923","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/400ee45f80480c05c3fa673967f25faab8323753"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/76903b2057c8677c2c006e87fede15f496555dc0"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/9e962e68a9d26135af67c423767c0983d9ad94c3"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-31785.json b/data/2026/CVE-2026-31785.json index d9151ae303..a966e34f18 100644 --- a/data/2026/CVE-2026-31785.json +++ b/data/2026/CVE-2026-31785.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_pagefault.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b656f040ed4ed2074dfb78072745b41d44368be0","status":"affected","version":"fb544b8445080c6488a58c01022550adc0873283","versionType":"git"},{"lessThan":"6d192b4f2d644d15d9a9f1d33dab05af936f6540","status":"affected","version":"fb544b8445080c6488a58c01022550adc0873283","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_pagefault.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6A3292BD-59D7-4901-9701-EF89FB933C8E","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/xe_pagefault: Disallow writes to read-only VMAs\n\nThe page fault handler should reject write/atomic access to read only\nVMAs. Add code to handle this in xe_pagefault_service after the VMA\nlookup.\n\nv2:\n- Apply max line length (Matthew)\n\n(cherry picked from commit 714ee6754ac5fa3dc078856a196a6b124cd797a0)"}],"id":"CVE-2026-31785","lastModified":"2026-06-17T10:34:27.540","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:42.033","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6d192b4f2d644d15d9a9f1d33dab05af936f6540"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b656f040ed4ed2074dfb78072745b41d44368be0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_pagefault.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"b656f040ed4ed2074dfb78072745b41d44368be0","status":"affected","version":"fb544b8445080c6488a58c01022550adc0873283","versionType":"git"},{"lessThan":"6d192b4f2d644d15d9a9f1d33dab05af936f6540","status":"affected","version":"fb544b8445080c6488a58c01022550adc0873283","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/xe/xe_pagefault.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","matchCriteriaId":"6A3292BD-59D7-4901-9701-EF89FB933C8E","versionEndExcluding":"6.19.12","versionStartIncluding":"6.19.1","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*","matchCriteriaId":"35C8A871-4971-433E-A046-FC9F7B7D190A","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*","matchCriteriaId":"F253B622-8837-4245-BCE5-A7BF8FC76A16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*","matchCriteriaId":"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*","matchCriteriaId":"F666C8D8-6538-46D4-B318-87610DE64C34","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*","matchCriteriaId":"02259FDA-961B-47BC-AE7F-93D7EC6E90C2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*","matchCriteriaId":"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*","matchCriteriaId":"1D2315C0-D46F-4F85-9754-F9E5E11374A6","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/xe_pagefault: Disallow writes to read-only VMAs\n\nThe page fault handler should reject write/atomic access to read only\nVMAs. Add code to handle this in xe_pagefault_service after the VMA\nlookup.\n\nv2:\n- Apply max line length (Matthew)\n\n(cherry picked from commit 714ee6754ac5fa3dc078856a196a6b124cd797a0)"},{"lang":"es","value":"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/xe/xe_pagefault: Prohibir escrituras a VMAs de solo lectura\n\nEl gestor de fallos de página debería rechazar el acceso de escritura/atómico a VMAs de solo lectura. Añadir código para manejar esto en xe_pagefault_service después de la búsqueda de VMA.\n\nv2:\n- Aplicar longitud máxima de línea (Matthew)\n\n(extraído de la confirmación 714ee6754ac5fa3dc078856a196a6b124cd797a0)"}],"id":"CVE-2026-31785","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2026-05-01T15:16:42.033","references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/6d192b4f2d644d15d9a9f1d33dab05af936f6540"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"url":"https://git.kernel.org/stable/c/b656f040ed4ed2074dfb78072745b41d44368be0"}],"sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-32135.json b/data/2026/CVE-2026-32135.json index 369a08eab7..25c9e0cca6 100644 --- a/data/2026/CVE-2026-32135.json +++ b/data/2026/CVE-2026-32135.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"nanomq","vendor":"nanomq","versions":[{"status":"affected","version":"< 0.24.11"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:emqx:nanomq:*:*:*:*:*:*:*:*","matchCriteriaId":"35273A6D-FB4C-49AD-8472-02B33895DADB","versionEndExcluding":"0.24.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_param_parse` function of NanoMQ's REST API. The vulnerability occurs due to an off-by-one error when allocating memory for query parameter keys and values, allowing an attacker to write a null byte beyond the allocated buffer. This can be triggered via a crafted HTTP request. Version 0.24.11 patches the issue."}],"id":"CVE-2026-32135","lastModified":"2026-06-17T10:35:11.917","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-32135","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T13:32:34.532703Z","version":"2.0.3"}}]},"published":"2026-04-20T20:16:48.510","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/nanomq/nanomq/commit/69a97b3b39cc218f044f1c8896f4d3d8757bb394"},{"source":"security-advisories@github.com","tags":["Issue Tracking"],"url":"https://github.com/nanomq/nanomq/issues/2247"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/nanomq/nanomq/security/advisories/GHSA-6w96-9qw7-m599"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"nanomq","vendor":"nanomq","versions":[{"status":"affected","version":"< 0.24.11"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:emqx:nanomq:*:*:*:*:*:*:*:*","matchCriteriaId":"35273A6D-FB4C-49AD-8472-02B33895DADB","versionEndExcluding":"0.24.11","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggerable heap buffer overflow in the `uri_param_parse` function of NanoMQ's REST API. The vulnerability occurs due to an off-by-one error when allocating memory for query parameter keys and values, allowing an attacker to write a null byte beyond the allocated buffer. This can be triggered via a crafted HTTP request. Version 0.24.11 patches the issue."},{"lang":"es","value":"NanoMQ MQTT Broker (NanoMQ) es una plataforma de mensajería perimetral integral. Las versiones anteriores a la 0.24.11 tienen un desbordamiento de búfer de pila (heap) activable remotamente en la función ’uri_param_parse’ de la API REST de NanoMQ. La vulnerabilidad se produce debido a un error de uno (off-by-one) al asignar memoria para las claves y valores de los parámetros de consulta, permitiendo a un atacante escribir un byte nulo más allá del búfer asignado. Esto puede ser activado mediante una solicitud HTTP manipulada. La versión 0.24.11 soluciona el problema."}],"id":"CVE-2026-32135","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-32135","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T13:32:34.532703Z","version":"2.0.3"}}]},"published":"2026-04-20T20:16:48.510","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/nanomq/nanomq/commit/69a97b3b39cc218f044f1c8896f4d3d8757bb394"},{"source":"security-advisories@github.com","tags":["Issue Tracking"],"url":"https://github.com/nanomq/nanomq/issues/2247"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/nanomq/nanomq/security/advisories/GHSA-6w96-9qw7-m599"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-122"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-32241.json b/data/2026/CVE-2026-32241.json index f31ee2485b..d7edc0485c 100644 --- a/data/2026/CVE-2026-32241.json +++ b/data/2026/CVE-2026-32241.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"flannel","vendor":"flannel-io","versions":[{"status":"affected","version":"< 0.28.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:flannel-io:flannel:*:*:*:*:*:kubernetes:*:*","matchCriteriaId":"8670D1E4-2A5B-42ED-94C1-F8AFCD308809","versionEndExcluding":"0.28.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend's SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard."}],"id":"CVE-2026-32241","lastModified":"2026-06-17T10:35:24.630","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-32241","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-31T18:51:18.552973Z","version":"2.0.3"}}]},"published":"2026-03-27T20:16:30.570","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/flannel-io/flannel/releases/tag/v0.28.2"},{"source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"],"url":"https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"flannel","vendor":"flannel-io","versions":[{"status":"affected","version":"< 0.28.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:flannel-io:flannel:*:*:*:*:*:kubernetes:*:*","matchCriteriaId":"8670D1E4-2A5B-42ED-94C1-F8AFCD308809","versionEndExcluding":"0.28.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Flannel is a network fabric for containers, designed for Kubernetes. The Flannel project includes an experimental Extension backend that allows users to easily prototype new backend types. In versions of Flannel prior to 0.28.2, this Extension backend is vulnerable to a command injection that allows an attacker who can set Kubernetes Node annotations to achieve root-level arbitrary command execution on every flannel node in the cluster. The Extension backend's SubnetAddCommand and SubnetRemoveCommand receive attacker-controlled data via stdin (from the `flannel.alpha.coreos.com/backend-data` Node annotation). The content of this annotation is unmarshalled and piped directly to a shell command without checks. Kubernetes clusters using Flannel with the Extension backend are affected by this vulnerability. Other backends such as vxlan and wireguard are unaffected. The vulnerability is fixed in version v0.28.2. As a workaround, use Flannel with another backend such as vxlan or wireguard."},{"lang":"es","value":"Flannel es un tejido de red para contenedores, diseñado para Kubernetes. El proyecto Flannel incluye un backend de Extensión experimental que permite a los usuarios prototipar fácilmente nuevos tipos de backend. En versiones de Flannel anteriores a la 0.28.2, este backend de Extensión es vulnerable a una inyección de comandos que permite a un atacante que puede establecer anotaciones de Nodo de Kubernetes lograr la ejecución arbitraria de comandos a nivel de root en cada nodo flannel del clúster. Los comandos SubnetAddCommand y SubnetRemoveCommand del backend de Extensión reciben datos controlados por el atacante a través de stdin (de la anotación de Nodo ’flannel.alpha.coreos.com/backend-data’). El contenido de esta anotación se deserializa y se canaliza directamente a un comando de shell sin comprobaciones. Los clústeres de Kubernetes que utilizan Flannel con el backend de Extensión se ven afectados por esta vulnerabilidad. Otros backends como vxlan y wireguard no se ven afectados. La vulnerabilidad se corrige en la versión v0.28.2. Como solución alternativa, utilice Flannel con otro backend como vxlan o wireguard."}],"id":"CVE-2026-32241","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.6,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-32241","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-03-31T18:51:18.552973Z","version":"2.0.3"}}]},"published":"2026-03-27T20:16:30.570","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/flannel-io/flannel/releases/tag/v0.28.2"},{"source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"],"url":"https://github.com/flannel-io/flannel/security/advisories/GHSA-vchx-5pr6-ffx2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-3254.json b/data/2026/CVE-2026-3254.json index 5f628b1c59..0073078b72 100644 --- a/data/2026/CVE-2026-3254.json +++ b/data/2026/CVE-2026-3254.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"GitLab","repo":"git://git@gitlab.com:gitlab-org/gitlab.git","vendor":"GitLab","versions":[{"lessThan":"18.11.1","status":"affected","version":"18.11","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gitlab:gitlab:18.11.0:*:*:*:community:*:*:*","matchCriteriaId":"A6100523-821F-4F41-872D-AC5A60EECC19","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:18.11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"C78F9577-CDD5-497B-A92F-3C578AC6709E","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to load unauthorized content into another user's browser due to improper input validation in the Mermaid sandbox."}],"id":"CVE-2026-3254","lastModified":"2026-06-17T10:43:16.920","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3254","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T17:39:38.576809Z","version":"2.0.3"}}]},"published":"2026-04-22T17:16:43.433","references":[{"source":"cve@gitlab.com","tags":["Broken Link"],"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/591587"},{"source":"cve@gitlab.com","tags":["Permissions Required"],"url":"https://hackerone.com/reports/3572752"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1021"}],"source":"cve@gitlab.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","product":"GitLab","repo":"git://git@gitlab.com:gitlab-org/gitlab.git","vendor":"GitLab","versions":[{"lessThan":"18.11.1","status":"affected","version":"18.11","versionType":"semver"}]}],"source":"cve@gitlab.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:gitlab:gitlab:18.11.0:*:*:*:community:*:*:*","matchCriteriaId":"A6100523-821F-4F41-872D-AC5A60EECC19","vulnerable":true},{"criteria":"cpe:2.3:a:gitlab:gitlab:18.11.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"C78F9577-CDD5-497B-A92F-3C578AC6709E","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to load unauthorized content into another user's browser due to improper input validation in the Mermaid sandbox."},{"lang":"es","value":"GitLab ha remediado un problema en GitLab CE/EE que afecta a todas las versiones desde la 18.11 anteriores a la 18.11.1 y que, bajo ciertas condiciones, podría haber permitido a un usuario autenticado cargar contenido no autorizado en el navegador de otro usuario debido a una validación de entrada incorrecta en el sandbox de Mermaid."}],"id":"CVE-2026-3254","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":1.4,"source":"cve@gitlab.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3254","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T17:39:38.576809Z","version":"2.0.3"}}]},"published":"2026-04-22T17:16:43.433","references":[{"source":"cve@gitlab.com","tags":["Broken Link"],"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/591587"},{"source":"cve@gitlab.com","tags":["Permissions Required"],"url":"https://hackerone.com/reports/3572752"}],"sourceIdentifier":"cve@gitlab.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1021"}],"source":"cve@gitlab.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-32604.json b/data/2026/CVE-2026-32604.json index ef84682cb1..7e68a7e1bc 100644 --- a/data/2026/CVE-2026-32604.json +++ b/data/2026/CVE-2026-32604.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"spinnaker","vendor":"spinnaker","versions":[{"status":"affected","version":"< 2026.0.1"},{"status":"affected","version":"< 2025.4.2"},{"status":"affected","version":"< 2025.3.2"},{"status":"affected","version":"< 2026.1.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","matchCriteriaId":"07B7FB62-8F2B-479F-9A67-BF089F62CBD8","versionEndExcluding":"2025.3.2","vulnerable":true},{"criteria":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","matchCriteriaId":"46906F2E-400B-4A1F-A36D-C9BD40E9E7D0","versionEndExcluding":"2025.4.2","versionStartIncluding":"2025.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","matchCriteriaId":"667562C0-156D-4D2B-A446-67A2EBFB4CEF","versionEndExcluding":"2026.0.1","versionStartIncluding":"2026.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types."}],"id":"CVE-2026-32604","lastModified":"2026-06-17T10:36:05.033","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-32604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-21T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-04-20T21:16:32.457","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1"},{"source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"],"url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-x3j7-7pgj-h87r"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://zeropath.com/blog/spinnaker-rce-production-compromise"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"spinnaker","vendor":"spinnaker","versions":[{"status":"affected","version":"< 2026.0.1"},{"status":"affected","version":"< 2025.4.2"},{"status":"affected","version":"< 2025.3.2"},{"status":"affected","version":"< 2026.1.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","matchCriteriaId":"07B7FB62-8F2B-479F-9A67-BF089F62CBD8","versionEndExcluding":"2025.3.2","vulnerable":true},{"criteria":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","matchCriteriaId":"46906F2E-400B-4A1F-A36D-C9BD40E9E7D0","versionEndExcluding":"2025.4.2","versionStartIncluding":"2025.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","matchCriteriaId":"667562C0-156D-4D2B-A446-67A2EBFB4CEF","versionEndExcluding":"2026.0.1","versionStartIncluding":"2026.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Spinnaker is an open source, multi-cloud continuous delivery platform. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, a bad actor can execute arbitrary commands very simply on the clouddriver pods. This can expose credentials, remove files, or inject resources easily. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable the gitrepo artifact types."},{"lang":"es","value":"Spinnaker es una plataforma de entrega continua de código abierto y multinube. En versiones anteriores a la 2026.1.0, 2026.0.1, 2025.4.2 y 2025.3.2, un actor malicioso puede ejecutar comandos arbitrarios de forma muy sencilla en los pods de clouddriver. Esto puede exponer credenciales, eliminar archivos o inyectar recursos fácilmente. Las versiones 2026.1.0, 2026.0.1, 2025.4.2 y 2025.3.2 contienen un parche. Como solución alternativa, deshabilite los tipos de artefacto gitrepo."}],"id":"CVE-2026-32604","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-32604","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-21T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-04-20T21:16:32.457","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1"},{"source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"],"url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-x3j7-7pgj-h87r"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://zeropath.com/blog/spinnaker-rce-production-compromise"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-32613.json b/data/2026/CVE-2026-32613.json index b3914d93d2..48e5e5ceda 100644 --- a/data/2026/CVE-2026-32613.json +++ b/data/2026/CVE-2026-32613.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"spinnaker","vendor":"spinnaker","versions":[{"status":"affected","version":"< 2026.0.1"},{"status":"affected","version":"< 2025.4.2"},{"status":"affected","version":"< 2025.3.2"},{"status":"affected","version":"< 2026.1.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","matchCriteriaId":"07B7FB62-8F2B-479F-9A67-BF089F62CBD8","versionEndExcluding":"2025.3.2","vulnerable":true},{"criteria":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","matchCriteriaId":"46906F2E-400B-4A1F-A36D-C9BD40E9E7D0","versionEndExcluding":"2025.4.2","versionStartIncluding":"2025.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","matchCriteriaId":"667562C0-156D-4D2B-A446-67A2EBFB4CEF","versionEndExcluding":"2026.0.1","versionStartIncluding":"2026.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely."}],"id":"CVE-2026-32613","lastModified":"2026-06-17T10:36:06.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-32613","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-21T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-04-20T21:16:32.623","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1"},{"source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"],"url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-69rw-45wj-g4v6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://zeropath.com/blog/spinnaker-rce-production-compromise"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"spinnaker","vendor":"spinnaker","versions":[{"status":"affected","version":"< 2026.0.1"},{"status":"affected","version":"< 2025.4.2"},{"status":"affected","version":"< 2025.3.2"},{"status":"affected","version":"< 2026.1.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","matchCriteriaId":"07B7FB62-8F2B-479F-9A67-BF089F62CBD8","versionEndExcluding":"2025.3.2","vulnerable":true},{"criteria":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","matchCriteriaId":"46906F2E-400B-4A1F-A36D-C9BD40E9E7D0","versionEndExcluding":"2025.4.2","versionStartIncluding":"2025.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*","matchCriteriaId":"667562C0-156D-4D2B-A446-67A2EBFB4CEF","versionEndExcluding":"2026.0.1","versionStartIncluding":"2026.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Spinnaker is an open source, multi-cloud continuous delivery platform. Echo like some other services, uses SPeL (Spring Expression Language) to process information - specifically around expected artifacts. In versions prior to 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2, unlike orca, it was NOT restricting that context to a set of trusted classes, but allowing FULL JVM access. This enabled a user to use arbitrary java classes which allow deep access to the system. This enabled the ability to invoke commands, access files, etc. Versions 2026.1.0, 2026.0.1, 2025.4.2, and 2025.3.2 contain a patch. As a workaround, disable echo entirely."},{"lang":"es","value":"Spinnaker es una plataforma de entrega continua de código abierto y multinube. Echo, al igual que otros servicios, utiliza SPeL (Spring Expression Language) para procesar información, específicamente en torno a los artefactos esperados. En versiones anteriores a 2026.1.0, 2026.0.1, 2025.4.2 y 2025.3.2, a diferencia de orca, NO estaba restringiendo ese contexto a un conjunto de clases de confianza, sino que permitía acceso COMPLETO a la JVM. Esto permitía a un usuario utilizar clases Java arbitrarias que permiten un acceso profundo al sistema. Esto permitía la capacidad de invocar comandos, acceder a archivos, etc. Las versiones 2026.1.0, 2026.0.1, 2025.4.2 y 2025.3.2 contienen un parche. Como solución alternativa, deshabilite echo por completo."}],"id":"CVE-2026-32613","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.1,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-32613","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-21T00:00:00+00:00","version":"2.0.3"}}]},"published":"2026-04-20T21:16:32.623","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.3.2"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2025.4.2"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/spinnaker/spinnaker/releases/tag/spinnaker-release-2026.0.1"},{"source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"],"url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-69rw-45wj-g4v6"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://zeropath.com/blog/spinnaker-rce-production-compromise"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-94"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-32885.json b/data/2026/CVE-2026-32885.json index 274592f844..1980bc3400 100644 --- a/data/2026/CVE-2026-32885.json +++ b/data/2026/CVE-2026-32885.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ddev","vendor":"ddev","versions":[{"status":"affected","version":"< 1.25.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ddev:ddev:*:*:*:*:*:*:*:*","matchCriteriaId":"02CC25E0-AC06-4A75-8C5E-609888883FDC","versionEndExcluding":"1.25.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. Downloads and extracts archives from remote sources without path validation. Version 1.25.2 patches the issue."}],"id":"CVE-2026-32885","lastModified":"2026-06-17T10:36:30.530","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-32885","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T18:25:23.835580Z","version":"2.0.3"}}]},"published":"2026-04-22T17:16:34.770","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/ddev/ddev/releases/tag/v1.25.2"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/ddev/ddev/security/advisories/GHSA-x2xq-qhjf-5mvg"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/ddev/ddev/security/advisories/GHSA-x2xq-qhjf-5mvg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"ddev","vendor":"ddev","versions":[{"status":"affected","version":"< 1.25.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ddev:ddev:*:*:*:*:*:*:*:*","matchCriteriaId":"02CC25E0-AC06-4A75-8C5E-609888883FDC","versionEndExcluding":"1.25.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2 have unsanitized extraction in both `Untar()` and `Unzip()` functions in `pkg/archive/archive.go`. Downloads and extracts archives from remote sources without path validation. Version 1.25.2 patches the issue."},{"lang":"es","value":"DDEV es una herramienta de código abierto para ejecutar entornos de desarrollo web locales para PHP y Node.js. Las versiones anteriores a la 1.25.2 tienen extracción no saneada tanto en las funciones ’Untar()’ como ’Unzip()’ en ’pkg/archive/archive.go’. Descarga y extrae archivos de fuentes remotas sin validación de ruta. La versión 1.25.2 soluciona el problema."}],"id":"CVE-2026-32885","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-32885","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T18:25:23.835580Z","version":"2.0.3"}}]},"published":"2026-04-22T17:16:34.770","references":[{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/ddev/ddev/releases/tag/v1.25.2"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/ddev/ddev/security/advisories/GHSA-x2xq-qhjf-5mvg"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/ddev/ddev/security/advisories/GHSA-x2xq-qhjf-5mvg"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-33076.json b/data/2026/CVE-2026-33076.json index a636609a54..b313951efa 100644 --- a/data/2026/CVE-2026-33076.json +++ b/data/2026/CVE-2026-33076.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"roxy-wi","vendor":"roxy-wi","versions":[{"status":"affected","version":"< 8.2.6.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*","matchCriteriaId":"C493C2DE-0B9D-48E1-BEDA-9ECBE24DB508","versionEndExcluding":"8.2.6.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the haproxy_section_save interface presents a vulnerability that could lead to remote code execution due to path traversal and writing into scheduled tasks. Version 8.2.6.4 fixes the issue."}],"id":"CVE-2026-33076","lastModified":"2026-06-17T10:36:54.760","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33076","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-24T17:10:38.187304Z","version":"2.0.3"}}]},"published":"2026-04-24T03:16:10.227","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092fa93e93531f1ffcde33524b031"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mmgm-p9x9-h33j"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mmgm-p9x9-h33j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"roxy-wi","vendor":"roxy-wi","versions":[{"status":"affected","version":"< 8.2.6.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*","matchCriteriaId":"C493C2DE-0B9D-48E1-BEDA-9ECBE24DB508","versionEndExcluding":"8.2.6.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the haproxy_section_save interface presents a vulnerability that could lead to remote code execution due to path traversal and writing into scheduled tasks. Version 8.2.6.4 fixes the issue."},{"lang":"es","value":"Roxy-WI es una interfaz web para gestionar servidores Haproxy, Nginx, Apache y Keepalived. Antes de la versión 8.2.6.4, la interfaz haproxy_section_save presenta una vulnerabilidad que podría conducir a la ejecución remota de código debido a salto de ruta y escritura en tareas programadas. La versión 8.2.6.4 soluciona el problema."}],"id":"CVE-2026-33076","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33076","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-24T17:10:38.187304Z","version":"2.0.3"}}]},"published":"2026-04-24T03:16:10.227","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092fa93e93531f1ffcde33524b031"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mmgm-p9x9-h33j"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mmgm-p9x9-h33j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-33077.json b/data/2026/CVE-2026-33077.json index 8da1686df6..1e478b4b11 100644 --- a/data/2026/CVE-2026-33077.json +++ b/data/2026/CVE-2026-33077.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"roxy-wi","vendor":"roxy-wi","versions":[{"status":"affected","version":"< 8.2.6.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*","matchCriteriaId":"C493C2DE-0B9D-48E1-BEDA-9ECBE24DB508","versionEndExcluding":"8.2.6.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the oldconfig parameter in the haproxy_section_save interface has an arbitrary file read vulnerability. Version 8.2.6.4 fixes the issue."}],"id":"CVE-2026-33077","lastModified":"2026-06-17T10:36:54.880","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33077","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-25T01:43:08.491834Z","version":"2.0.3"}}]},"published":"2026-04-24T03:16:10.477","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092fa93e93531f1ffcde33524b031"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-c799-4ww6-q93w"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-c799-4ww6-q93w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"roxy-wi","vendor":"roxy-wi","versions":[{"status":"affected","version":"< 8.2.6.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*","matchCriteriaId":"C493C2DE-0B9D-48E1-BEDA-9ECBE24DB508","versionEndExcluding":"8.2.6.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the oldconfig parameter in the haproxy_section_save interface has an arbitrary file read vulnerability. Version 8.2.6.4 fixes the issue."},{"lang":"es","value":"Roxy-WI es una interfaz web para gestionar servidores Haproxy, Nginx, Apache y Keepalived. Antes de la versión 8.2.6.4, el parámetro oldconfig en la interfaz haproxy_section_save tiene una vulnerabilidad de lectura arbitraria de archivos. La versión 8.2.6.4 corrige el problema."}],"id":"CVE-2026-33077","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33077","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-25T01:43:08.491834Z","version":"2.0.3"}}]},"published":"2026-04-24T03:16:10.477","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092fa93e93531f1ffcde33524b031"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-c799-4ww6-q93w"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-c799-4ww6-q93w"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-33078.json b/data/2026/CVE-2026-33078.json index b10916ea96..5fbc86ae40 100644 --- a/data/2026/CVE-2026-33078.json +++ b/data/2026/CVE-2026-33078.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"roxy-wi","vendor":"roxy-wi","versions":[{"status":"affected","version":"< 8.2.6.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*","matchCriteriaId":"C493C2DE-0B9D-48E1-BEDA-9ECBE24DB508","versionEndExcluding":"8.2.6.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxy_section_save function in app/routes/config/routes.py. The server_ip parameter, sourced from the URL path, is passed unsanitized through multiple function calls and ultimately interpolated into a SQL query string using Python string formatting, allowing attackers to execute arbitrary SQL commands. Version 8.2.6.4 fixes the issue."}],"id":"CVE-2026-33078","lastModified":"2026-06-17T10:36:54.993","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33078","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-24T12:10:21.211655Z","version":"2.0.3"}}]},"published":"2026-04-24T03:16:10.657","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092fa93e93531f1ffcde33524b031"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-jmj9-2c4q-849j"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-jmj9-2c4q-849j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"roxy-wi","vendor":"roxy-wi","versions":[{"status":"affected","version":"< 8.2.6.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*","matchCriteriaId":"C493C2DE-0B9D-48E1-BEDA-9ECBE24DB508","versionEndExcluding":"8.2.6.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxy_section_save function in app/routes/config/routes.py. The server_ip parameter, sourced from the URL path, is passed unsanitized through multiple function calls and ultimately interpolated into a SQL query string using Python string formatting, allowing attackers to execute arbitrary SQL commands. Version 8.2.6.4 fixes the issue."},{"lang":"es","value":"Roxy-WI es una interfaz web para gestionar servidores Haproxy, Nginx, Apache y Keepalived. Versiones anteriores a la 8.2.6.4 tienen una vulnerabilidad de inyección SQL en la función haproxy_section_save en app/routes/config/routes.py. El parámetro server_ip, procedente de la ruta URL, se pasa sin sanear a través de múltiples llamadas a funciones y finalmente se interpola en una cadena de consulta SQL mediante el formateo de cadenas de Python, permitiendo a los atacantes ejecutar comandos SQL arbitrarios. La versión 8.2.6.4 soluciona el problema."}],"id":"CVE-2026-33078","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.9,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33078","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-24T12:10:21.211655Z","version":"2.0.3"}}]},"published":"2026-04-24T03:16:10.657","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092fa93e93531f1ffcde33524b031"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-jmj9-2c4q-849j"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-jmj9-2c4q-849j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-33208.json b/data/2026/CVE-2026-33208.json index 3d7a9a8c03..f24b62b3bb 100644 --- a/data/2026/CVE-2026-33208.json +++ b/data/2026/CVE-2026-33208.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"roxy-wi","vendor":"roxy-wi","versions":[{"status":"affected","version":"< 8.2.6.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*","matchCriteriaId":"C493C2DE-0B9D-48E1-BEDA-9ECBE24DB508","versionEndExcluding":"8.2.6.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /config/ < service > /find-in-config endpoint in Roxy-WI fails to sanitize the user-supplied words parameter before embedding it into a shell command string that is subsequently executed on a remote managed server via SSH. An authenticated attacker can inject arbitrary shell metacharacters to break out of the intended grep command context and execute arbitrary OS commands with sudo privileges on the target server, resulting in full Remote Code Execution (RCE). Version 8.2.6.4 patches the issue."}],"id":"CVE-2026-33208","lastModified":"2026-06-17T10:37:07.557","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33208","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-24T16:27:47.197941Z","version":"2.0.3"}}]},"published":"2026-04-24T03:16:10.863","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/roxy-wi/roxy-wi/commit/02f147d567a3cc8cf61a4b58ea4c2b7866a544de"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-7m2h-gmvj-cjx2"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-7m2h-gmvj-cjx2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"roxy-wi","vendor":"roxy-wi","versions":[{"status":"affected","version":"< 8.2.6.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*","matchCriteriaId":"C493C2DE-0B9D-48E1-BEDA-9ECBE24DB508","versionEndExcluding":"8.2.6.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /config/ < service > /find-in-config endpoint in Roxy-WI fails to sanitize the user-supplied words parameter before embedding it into a shell command string that is subsequently executed on a remote managed server via SSH. An authenticated attacker can inject arbitrary shell metacharacters to break out of the intended grep command context and execute arbitrary OS commands with sudo privileges on the target server, resulting in full Remote Code Execution (RCE). Version 8.2.6.4 patches the issue."},{"lang":"es","value":"Roxy-WI es una interfaz web para gestionar servidores Haproxy, Nginx, Apache y Keepalived. Antes de la versión 8.2.6.4, el endpoint /config/ < service > /find-in-config en Roxy-WI no logra sanear el parámetro words proporcionado por el usuario antes de incrustarlo en una cadena de comando de shell que posteriormente se ejecuta en un servidor remoto gestionado a través de SSH. Un atacante autenticado puede inyectar metacaracteres de shell arbitrarios para salir del contexto del comando grep previsto y ejecutar comandos de SO arbitrarios con privilegios de sudo en el servidor objetivo, lo que resulta en una Ejecución Remota de Código (RCE) completa. La versión 8.2.6.4 corrige el problema."}],"id":"CVE-2026-33208","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33208","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-24T16:27:47.197941Z","version":"2.0.3"}}]},"published":"2026-04-24T03:16:10.863","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/roxy-wi/roxy-wi/commit/02f147d567a3cc8cf61a4b58ea4c2b7866a544de"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-7m2h-gmvj-cjx2"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-7m2h-gmvj-cjx2"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-78"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-33431.json b/data/2026/CVE-2026-33431.json index 8ed7c57751..453c4d92d9 100644 --- a/data/2026/CVE-2026-33431.json +++ b/data/2026/CVE-2026-33431.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"roxy-wi","vendor":"roxy-wi","versions":[{"status":"affected","version":"< 8.2.6.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*","matchCriteriaId":"C493C2DE-0B9D-48E1-BEDA-9ECBE24DB508","versionEndExcluding":"8.2.6.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config//show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and its contents returned to the caller. The existing path traversal guard only inspects the base directory variable (which is never user-controlled) and entirely ignores the user-supplied configver value. An authenticated attacker can supply a configver value containing `../` sequences to escape the intended directory and read arbitrary files accessible to the web application process. Version 8.2.6.4 contains a patch for the issue."}],"id":"CVE-2026-33431","lastModified":"2026-06-17T10:37:29.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33431","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T13:42:13.885336Z","version":"2.0.3"}}]},"published":"2026-04-20T21:16:34.823","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/roxy-wi/roxy-wi/commit/d4d100067dd0ee04317f05d3b51be8fcfdc3f802"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-w3c9-36jf-qrw4"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-w3c9-36jf-qrw4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-24"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"roxy-wi","vendor":"roxy-wi","versions":[{"status":"affected","version":"< 8.2.6.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*","matchCriteriaId":"C493C2DE-0B9D-48E1-BEDA-9ECBE24DB508","versionEndExcluding":"8.2.6.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config//show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and its contents returned to the caller. The existing path traversal guard only inspects the base directory variable (which is never user-controlled) and entirely ignores the user-supplied configver value. An authenticated attacker can supply a configver value containing `../` sequences to escape the intended directory and read arbitrary files accessible to the web application process. Version 8.2.6.4 contains a patch for the issue."},{"lang":"es","value":"Roxy-WI es una interfaz web para gestionar servidores Haproxy, Nginx, Apache y Keepalived. Antes de la versión 8.2.6.4, el endpoint de la API POST /config/[service]/show acepta un parámetro configver que se añade directamente a una ruta de directorio base para construir una ruta de archivo local, que posteriormente se abre y cuyo contenido se devuelve al llamador. La protección existente contra salto de ruta solo inspecciona la variable del directorio base (que nunca es controlada por el usuario) e ignora por completo el valor configver proporcionado por el usuario. Un atacante autenticado puede proporcionar un valor configver que contenga secuencias ’.. / ’ para escapar del directorio previsto y leer archivos arbitrarios accesibles para el proceso de la aplicación web. La versión 8.2.6.4 contiene un parche para el problema."}],"id":"CVE-2026-33431","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33431","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T13:42:13.885336Z","version":"2.0.3"}}]},"published":"2026-04-20T21:16:34.823","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/roxy-wi/roxy-wi/commit/d4d100067dd0ee04317f05d3b51be8fcfdc3f802"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-w3c9-36jf-qrw4"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-w3c9-36jf-qrw4"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-24"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-33432.json b/data/2026/CVE-2026-33432.json index 0866ef58a3..4d83fc0079 100644 --- a/data/2026/CVE-2026-33432.json +++ b/data/2026/CVE-2026-33432.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"roxy-wi","vendor":"roxy-wi","versions":[{"status":"affected","version":"<= 8.2.8.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*","matchCriteriaId":"E3F03A84-592D-4BAB-9D78-43D9E973DFDE","versionEndIncluding":"8.2.8.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without escaping LDAP special characters. An unauthenticated attacker can inject LDAP filter metacharacters into the username field to manipulate the search query, cause the directory to return an unintended user entry, and bypass authentication entirely — gaining access to the application without knowing any valid password. As of time of publication, no known patches are available."}],"id":"CVE-2026-33432","lastModified":"2026-06-17T10:37:29.480","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33432","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T17:37:36.446871Z","version":"2.0.3"}}]},"published":"2026-04-20T21:16:34.970","references":[{"source":"security-advisories@github.com","tags":["Product"],"url":"https://github.com/roxy-wi/roxy-wi/blob/v8.2.8.2/app/modules/roxywi/auth.py"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"product":"roxy-wi","vendor":"roxy-wi","versions":[{"status":"affected","version":"<= 8.2.8.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*","matchCriteriaId":"E3F03A84-592D-4BAB-9D78-43D9E973DFDE","versionEndIncluding":"8.2.8.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search filter by directly concatenating the user-supplied login username into the filter string without escaping LDAP special characters. An unauthenticated attacker can inject LDAP filter metacharacters into the username field to manipulate the search query, cause the directory to return an unintended user entry, and bypass authentication entirely — gaining access to the application without knowing any valid password. As of time of publication, no known patches are available."},{"lang":"es","value":"Roxy-WI es una interfaz web para gestionar servidores Haproxy, Nginx, Apache y Keepalived. En versiones hasta la 8.2.8.2 inclusive, cuando la autenticación LDAP está habilitada, Roxy-WI construye un filtro de búsqueda LDAP concatenando directamente el nombre de usuario de inicio de sesión proporcionado por el usuario en la cadena del filtro sin escapar los caracteres especiales de LDAP. Un atacante no autenticado puede inyectar metacaracteres de filtro LDAP en el campo de nombre de usuario para manipular la consulta de búsqueda, hacer que el directorio devuelva una entrada de usuario no deseada y eludir la autenticación por completo - obteniendo acceso a la aplicación sin conocer ninguna contraseña válida. En el momento de la publicación, no hay parches conocidos disponibles."}],"id":"CVE-2026-33432","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33432","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T17:37:36.446871Z","version":"2.0.3"}}]},"published":"2026-04-20T21:16:34.970","references":[{"source":"security-advisories@github.com","tags":["Product"],"url":"https://github.com/roxy-wi/roxy-wi/blob/v8.2.8.2/app/modules/roxywi/auth.py"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-hv3x-4w38-r92m"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-33587.json b/data/2026/CVE-2026-33587.json index fdc1afd172..5cf7238c58 100644 --- a/data/2026/CVE-2026-33587.json +++ b/data/2026/CVE-2026-33587.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Open Notebook","vendor":"Open Notebook","versions":[{"lessThanOrEqual":"1.8.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:lfnovo:open-notebook:*:*:*:*:*:*:*:*","matchCriteriaId":"29FD9785-0068-4D82-8528-DD40A74ECFC9","versionEndExcluding":"1.8.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations."}],"id":"CVE-2026-33587","lastModified":"2026-06-17T10:37:44.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-07T11:35:39.061623Z","version":"2.0.3"}}]},"published":"2026-05-07T11:16:00.887","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","tags":["Vendor Advisory"],"url":"https://github.com/lfnovo/open-notebook/security/advisories/GHSA-f35w-wx37-26q7"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Open Notebook","vendor":"Open Notebook","versions":[{"lessThanOrEqual":"1.8.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:lfnovo:open-notebook:*:*:*:*:*:*:*:*","matchCriteriaId":"29FD9785-0068-4D82-8528-DD40A74ECFC9","versionEndExcluding":"1.8.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and subsequently OS commands) on the docker container via Server-Side Template Injection (SSTI) for user-created transformations."},{"lang":"es","value":"Falta de saneamiento de la entrada del usuario en Open Notebook v1.8.3 permite al usuario de la aplicación ejecutar código Python (y, posteriormente, comandos del sistema operativo) en el contenedor docker mediante Inyección de Plantilla del Lado del Servidor (SSTI) para transformaciones creadas por el usuario."}],"id":"CVE-2026-33587","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":6.0,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":9.2,"baseSeverity":"CRITICAL","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-07T11:35:39.061623Z","version":"2.0.3"}}]},"published":"2026-05-07T11:16:00.887","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","tags":["Vendor Advisory"],"url":"https://github.com/lfnovo/open-notebook/security/advisories/GHSA-f35w-wx37-26q7"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-33588.json b/data/2026/CVE-2026-33588.json index 0ed131aafd..aaed85b359 100644 --- a/data/2026/CVE-2026-33588.json +++ b/data/2026/CVE-2026-33588.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Open Notebook","vendor":"Open Notebook","versions":[{"lessThanOrEqual":"1.8.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:lfnovo:open-notebook:*:*:*:*:*:*:*:*","matchCriteriaId":"29FD9785-0068-4D82-8528-DD40A74ECFC9","versionEndExcluding":"1.8.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files on the docker container via path traversal."}],"id":"CVE-2026-33588","lastModified":"2026-06-17T10:37:45.103","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-07T11:35:03.420629Z","version":"2.0.3"}}]},"published":"2026-05-07T11:16:01.020","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","tags":["Vendor Advisory"],"url":"https://github.com/lfnovo/open-notebook/security/advisories/GHSA-x4q2-89g5-594v"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Open Notebook","vendor":"Open Notebook","versions":[{"lessThanOrEqual":"1.8.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:lfnovo:open-notebook:*:*:*:*:*:*:*:*","matchCriteriaId":"29FD9785-0068-4D82-8528-DD40A74ECFC9","versionEndExcluding":"1.8.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files on the docker container via path traversal."},{"lang":"es","value":"Falta de validación de entrada del usuario en la funcionalidad de carga de archivos de Open Notebook v1.8.3 permite al usuario de la aplicación crear o modificar archivos en el contenedor de docker mediante salto de ruta."}],"id":"CVE-2026-33588","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-07T11:35:03.420629Z","version":"2.0.3"}}]},"published":"2026-05-07T11:16:01.020","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","tags":["Vendor Advisory"],"url":"https://github.com/lfnovo/open-notebook/security/advisories/GHSA-x4q2-89g5-594v"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-33589.json b/data/2026/CVE-2026-33589.json index 910fd0937b..ef2945beb6 100644 --- a/data/2026/CVE-2026-33589.json +++ b/data/2026/CVE-2026-33589.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Open Notebook","vendor":"Open Notebook","versions":[{"lessThanOrEqual":"1.8.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:lfnovo:open-notebook:*:*:*:*:*:*:*:*","matchCriteriaId":"29FD9785-0068-4D82-8528-DD40A74ECFC9","versionEndExcluding":"1.8.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the docker container via path traversal."}],"id":"CVE-2026-33589","lastModified":"2026-06-17T10:37:45.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-07T11:34:33.881622Z","version":"2.0.3"}}]},"published":"2026-05-07T11:16:01.150","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","tags":["Mitigation","Vendor Advisory"],"url":"https://github.com/lfnovo/open-notebook/security/advisories/GHSA-842v-h4cj-r646"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Open Notebook","vendor":"Open Notebook","versions":[{"lessThanOrEqual":"1.8.3","status":"affected","version":"0","versionType":"semver"}]}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:lfnovo:open-notebook:*:*:*:*:*:*:*:*","matchCriteriaId":"29FD9785-0068-4D82-8528-DD40A74ECFC9","versionEndExcluding":"1.8.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to access local files content from the docker container via path traversal."},{"lang":"es","value":"La falta de validación de entrada de usuario en la funcionalidad de carga de archivos de Open Notebook v1.8.3 permite al usuario de la aplicación acceder al contenido de archivos locales desde el contenedor de Docker mediante salto de ruta."}],"id":"CVE-2026-33589","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-07T11:34:33.881622Z","version":"2.0.3"}}]},"published":"2026-05-07T11:16:01.150","references":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","tags":["Mitigation","Vendor Advisory"],"url":"https://github.com/lfnovo/open-notebook/security/advisories/GHSA-842v-h4cj-r646"}],"sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary"},{"description":[{"lang":"en","value":"NVD-CWE-noinfo"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-33656.json b/data/2026/CVE-2026-33656.json index 2dd24077a2..2845216070 100644 --- a/data/2026/CVE-2026-33656.json +++ b/data/2026/CVE-2026-33656.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"espocrm","vendor":"espocrm","versions":[{"status":"affected","version":"< 9.3.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*","matchCriteriaId":"C81517CA-6567-41DC-A0A9-309FFD7B48E8","versionEndExcluding":"9.3.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attachment` entities. Because `sourceId` is concatenated directly into a file path with no sanitization in `EspoUploadDir::getFilePath()`, an attacker can redirect any file read or write operation to an arbitrary path within the web server's `open_basedir` scope. Version 9.3.4 fixes the issue."}],"id":"CVE-2026-33656","lastModified":"2026-06-17T10:37:52.333","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33656","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-23T13:47:31.281378Z","version":"2.0.3"}}]},"published":"2026-04-22T21:17:05.330","references":[{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"espocrm","vendor":"espocrm","versions":[{"status":"affected","version":"< 9.3.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*","matchCriteriaId":"C81517CA-6567-41DC-A0A9-309FFD7B48E8","versionEndExcluding":"9.3.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, EspoCRM's built-in formula scripting engine allowing updating attachment's sourceId thus allowing an authenticated admin to overwrite the `sourceId` field on `Attachment` entities. Because `sourceId` is concatenated directly into a file path with no sanitization in `EspoUploadDir::getFilePath()`, an attacker can redirect any file read or write operation to an arbitrary path within the web server's `open_basedir` scope. Version 9.3.4 fixes the issue."},{"lang":"es","value":"EspoCRM es una aplicación de gestión de relaciones con clientes de código abierto. Antes de la versión 9.3.4, el motor de scripting de fórmulas integrado de EspoCRM permitía actualizar el ’sourceId’ de los adjuntos, permitiendo así a un administrador autenticado sobrescribir el campo ’sourceId’ en las entidades Attachment. Debido a que ’sourceId’ se concatena directamente en una ruta de archivo sin sanitización en EspoUploadDir::getFilePath(), un atacante puede redirigir cualquier operación de lectura o escritura de archivos a una ruta arbitraria dentro del ámbito open_basedir del servidor web. La versión 9.3.4 corrige el problema."}],"id":"CVE-2026-33656","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.3,"impactScore":6.0,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33656","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-23T13:47:31.281378Z","version":"2.0.3"}}]},"published":"2026-04-22T21:17:05.330","references":[{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-7922-x7cf-j54x"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-33733.json b/data/2026/CVE-2026-33733.json index f985683b0b..6fb81257c9 100644 --- a/data/2026/CVE-2026-33733.json +++ b/data/2026/CVE-2026-33733.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"espocrm","vendor":"espocrm","versions":[{"status":"affected","version":"< 9.3.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*","matchCriteriaId":"C81517CA-6567-41DC-A0A9-309FFD7B48E8","versionEndExcluding":"9.3.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled `name` and `scope` values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use `../` sequences to escape the intended template directory and read, create, overwrite, or delete arbitrary files that resolve to `body.tpl` or `subject.tpl` under the web application user's filesystem permissions. Version 9.3.4 fixes the issue."}],"id":"CVE-2026-33733","lastModified":"2026-06-17T10:38:00.420","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33733","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-23T13:36:13.697532Z","version":"2.0.3"}}]},"published":"2026-04-22T21:17:05.970","references":[{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-44c3-xjfp-3jrh"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-44c3-xjfp-3jrh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"espocrm","vendor":"espocrm","versions":[{"status":"affected","version":"< 9.3.4"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:espocrm:espocrm:*:*:*:*:*:*:*:*","matchCriteriaId":"C81517CA-6567-41DC-A0A9-309FFD7B48E8","versionEndExcluding":"9.3.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled `name` and `scope` values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use `../` sequences to escape the intended template directory and read, create, overwrite, or delete arbitrary files that resolve to `body.tpl` or `subject.tpl` under the web application user's filesystem permissions. Version 9.3.4 fixes the issue."},{"lang":"es","value":"EspoCRM es una aplicación de gestión de relaciones con clientes de código abierto. Antes de la versión 9.3.4, los puntos finales de gestión de plantillas de administrador aceptan valores ’name’ y ’scope’ controlados por el atacante y los pasan a la construcción de la ruta de la plantilla sin normalización ni filtrado de recorrido. Como resultado, un administrador autenticado puede usar secuencias ’.. / ’ para escapar del directorio de plantillas previsto y leer, crear, sobrescribir o eliminar archivos arbitrarios que se resuelven en ’body.tpl’ o ’subject.tpl’ bajo los permisos del sistema de archivos del usuario de la aplicación web. La versión 9.3.4 corrige el problema."}],"id":"CVE-2026-33733","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33733","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-23T13:36:13.697532Z","version":"2.0.3"}}]},"published":"2026-04-22T21:17:05.970","references":[{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-44c3-xjfp-3jrh"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/espocrm/espocrm/security/advisories/GHSA-44c3-xjfp-3jrh"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-33900.json b/data/2026/CVE-2026-33900.json index 34965d4b59..81bc4d90d7 100644 --- a/data/2026/CVE-2026-33900.json +++ b/data/2026/CVE-2026-33900.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ImageMagick","vendor":"ImageMagick","versions":[{"status":"affected","version":"< 6.9.13-44"},{"status":"affected","version":"< 7.1.2-19"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","matchCriteriaId":"FEBAB6BF-AFEC-4D29-95E8-88C4585C9896","versionEndExcluding":"6.9.13-44","vulnerable":true},{"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","matchCriteriaId":"80D20334-B25F-479D-A411-DBD1364D303C","versionEndExcluding":"7.1.2-19","versionStartIncluding":"7.0.0-0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."}],"id":"CVE-2026-33900","lastModified":"2026-06-17T10:38:17.073","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33900","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T15:29:30.528868Z","version":"2.0.3"}}]},"published":"2026-04-13T21:16:25.333","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d"},{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19"},{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9"},{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"ImageMagick","vendor":"ImageMagick","versions":[{"status":"affected","version":"< 6.9.13-44"},{"status":"affected","version":"< 7.1.2-19"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","matchCriteriaId":"FEBAB6BF-AFEC-4D29-95E8-88C4585C9896","versionEndExcluding":"6.9.13-44","vulnerable":true},{"criteria":"cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*","matchCriteriaId":"80D20334-B25F-479D-A411-DBD1364D303C","versionEndExcluding":"7.1.2-19","versionStartIncluding":"7.0.0-0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, the viff encoder contains an integer truncation/wraparound issue on 32-bit builds that could trigger an out of bounds heap write, potentially causing a crash. This issue has been fixed in versions 6.9.13-44 and 7.1.2-19."},{"lang":"es","value":"ImageMagick es un software libre y de código abierto utilizado para editar y manipular imágenes digitales. En versiones anteriores tanto a la 7.1.2-19 como a la 6.9.13-44, el codificador viff contiene un problema de truncamiento/ajuste de enteros en compilaciones de 32 bits que podría desencadenar una escritura en el heap fuera de límites, causando potencialmente un fallo. Este problema ha sido solucionado en las versiones 6.9.13-44 y 7.1.2-19."}],"id":"CVE-2026-33900","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-33900","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T15:29:30.528868Z","version":"2.0.3"}}]},"published":"2026-04-13T21:16:25.333","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/ImageMagick/ImageMagick/commit/d27b840a61b322419a66d0d192ff56d52498148d"},{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-19"},{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v67w-737x-v2c9"},{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/dlemstra/Magick.NET/releases/tag/14.12.0"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-190"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-34447.json b/data/2026/CVE-2026-34447.json index 85ef0a3f4e..b1797ce2a0 100644 --- a/data/2026/CVE-2026-34447.json +++ b/data/2026/CVE-2026-34447.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"onnx","vendor":"onnx","versions":[{"status":"affected","version":"< 1.21.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*","matchCriteriaId":"D94F43D7-D50D-4698-B07D-215EBBAB63F2","versionEndExcluding":"1.21.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. This issue has been patched in version 1.21.0."}],"id":"CVE-2026-34447","lastModified":"2026-06-17T10:39:03.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-34447","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-01T19:14:28.777731Z","version":"2.0.3"}}]},"published":"2026-04-01T18:16:30.810","references":[{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/onnx/onnx/security/advisories/GHSA-p433-9wv8-28xj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-61"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"onnx","vendor":"onnx","versions":[{"status":"affected","version":"< 1.21.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*","matchCriteriaId":"D94F43D7-D50D-4698-B07D-215EBBAB63F2","versionEndExcluding":"1.21.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. This issue has been patched in version 1.21.0."},{"lang":"es","value":"Open Neural Network Exchange (ONNX) es un estándar abierto para la interoperabilidad del aprendizaje automático. Antes de la versión 1.21.0, existe una vulnerabilidad de recorrido de enlaces simbólicos en la carga de datos externos que permite leer archivos fuera del directorio del modelo. Este problema ha sido parcheado en la versión 1.21.0."}],"id":"CVE-2026-34447","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.8,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-34447","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-01T19:14:28.777731Z","version":"2.0.3"}}]},"published":"2026-04-01T18:16:30.810","references":[{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/onnx/onnx/security/advisories/GHSA-p433-9wv8-28xj"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-61"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-34873.json b/data/2026/CVE-2026-34873.json index bb1f2928ba..b5f9de0a7f 100644 --- a/data/2026/CVE-2026-34873.json +++ b/data/2026/CVE-2026-34873.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*","matchCriteriaId":"82C4C22E-673B-4A33-B855-978948957EA0","versionEndExcluding":"3.6.6","versionStartIncluding":"3.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*","matchCriteriaId":"2FBDC6AB-62EF-44D9-9AE6-EE7C1C6B6E79","versionEndExcluding":"4.1.0","versionStartIncluding":"4.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client impersonation can occur while resuming a TLS 1.3 session."}],"id":"CVE-2026-34873","lastModified":"2026-06-17T10:39:46.210","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-34873","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-02T15:54:35.519227Z","version":"2.0.3"}}]},"published":"2026-04-01T21:17:01.990","references":[{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-client-impersonation-while-resuming-tls13-session/"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*","matchCriteriaId":"82C4C22E-673B-4A33-B855-978948957EA0","versionEndExcluding":"3.6.6","versionStartIncluding":"3.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*","matchCriteriaId":"2FBDC6AB-62EF-44D9-9AE6-EE7C1C6B6E79","versionEndExcluding":"4.1.0","versionStartIncluding":"4.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in Mbed TLS 3.5.0 through 4.0.0. Client impersonation can occur while resuming a TLS 1.3 session."},{"lang":"es","value":"Se descubrió un problema en Mbed TLS 3.5.0 hasta 4.0.0. La suplantación de cliente puede ocurrir al reanudar una sesión TLS 1.3."}],"id":"CVE-2026-34873","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-34873","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-02T15:54:35.519227Z","version":"2.0.3"}}]},"published":"2026-04-01T21:17:01.990","references":[{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-client-impersonation-while-resuming-tls13-session/"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35206.json b/data/2026/CVE-2026-35206.json index 90e340ac85..9ffb5fe41c 100644 --- a/data/2026/CVE-2026-35206.json +++ b/data/2026/CVE-2026-35206.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"helm","vendor":"helm","versions":[{"status":"affected","version":">= 4.0.0, < 4.1.4"},{"status":"affected","version":"< 3.20.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*","matchCriteriaId":"07487FEE-D6F0-42D6-953A-C1C68CFEB0EE","versionEndExcluding":"3.20.2","vulnerable":true},{"criteria":"cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*","matchCriteriaId":"800B9949-E36B-45F3-9EA0-CA9DDA3D8868","versionEndExcluding":"4.1.4","versionStartIncluding":"4.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4."}],"id":"CVE-2026-35206","lastModified":"2026-06-17T10:40:12.610","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35206","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T14:45:03.230344Z","version":"2.0.3"}}]},"published":"2026-04-09T21:16:09.993","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/helm/helm/releases/tag/v4.1.4"},{"source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"],"url":"https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"helm","vendor":"helm","versions":[{"status":"affected","version":">= 4.0.0, < 4.1.4"},{"status":"affected","version":"< 3.20.2"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*","matchCriteriaId":"07487FEE-D6F0-42D6-953A-C1C68CFEB0EE","versionEndExcluding":"3.20.2","vulnerable":true},{"criteria":"cpe:2.3:a:helm:helm:*:*:*:*:*:*:*:*","matchCriteriaId":"800B9949-E36B-45F3-9EA0-CA9DDA3D8868","versionEndExcluding":"4.1.4","versionStartIncluding":"4.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Helm is a package manager for Charts for Kubernetes. In Helm versions <=3.20.1 and <=4.1.3, a specially crafted Chart will cause helm pull --untar [chart URL | repo/chartname] to write the Chart's contents to the immediate output directory (as defaulted to the current working directory; or as given by the --destination and --untardir flags), rather than the expected output directory suffixed by the chart's name. This vulnerability is fixed in 3.20.2 and 4.1.4."},{"lang":"es","value":"Helm es un gestor de paquetes para Charts para Kubernetes. En las versiones de Helm menor o igual que 3.20.1 y menor o igual que 4.1.3, un Chart especialmente diseñado hará que helm pull --untar [URL del chart | repo/nombre_del_chart] escriba el contenido del Chart en el directorio de salida inmediato (por defecto, el directorio de trabajo actual; o el especificado por las banderas --destination y --untardir), en lugar del directorio de salida esperado con el nombre del chart como sufijo. Esta vulnerabilidad se corrige en 3.20.2 y 4.1.4."}],"id":"CVE-2026-35206","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":4.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.8,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35206","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T14:45:03.230344Z","version":"2.0.3"}}]},"published":"2026-04-09T21:16:09.993","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/helm/helm/commit/4e7994d4467182f535b6797c94b5b0e994a91436"},{"source":"security-advisories@github.com","tags":["Product","Release Notes"],"url":"https://github.com/helm/helm/releases/tag/v4.1.4"},{"source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"],"url":"https://github.com/helm/helm/security/advisories/GHSA-hr2v-4r36-88hr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35405.json b/data/2026/CVE-2026-35405.json index 308f2a0a28..8ed03f86c4 100644 --- a/data/2026/CVE-2026-35405.json +++ b/data/2026/CVE-2026-35405.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"rust-libp2p","vendor":"libp2p","versions":[{"status":"affected","version":"< 0.17.1"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:protocol:libp2p:*:*:*:*:*:rust:*:*","matchCriteriaId":"0EA2FB25-A1F1-4E02-A0C9-0BCC07AFCA5C","versionEndExcluding":"0.17.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1."}],"id":"CVE-2026-35405","lastModified":"2026-06-17T10:40:32.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35405","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-09T17:44:02.373442Z","version":"2.0.3"}}]},"published":"2026-04-07T15:17:43.367","references":[{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"rust-libp2p","vendor":"libp2p","versions":[{"status":"affected","version":"< 0.17.1"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:protocol:libp2p:*:*:*:*:*:rust:*:*","matchCriteriaId":"0EA2FB25-A1F1-4E02-A0C9-0BCC07AFCA5C","versionEndExcluding":"0.17.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"libp2p-rust is the official rust language Implementation of the libp2p networking stack. Prior to 0.17.1, libp2p-rendezvous server has no limit on how many namespaces a single peer can register. A malicious peer can just keep registering unique namespaces in a loop and the server happily accepts every single one allocating memory for each registration with no pushback. Keep doing this long enough (or with multiple sybil peers) and the server process gets OOM killed. This vulnerability is fixed in 0.17.1."},{"lang":"es","value":"libp2p-rust es la implementación oficial en lenguaje Rust de la pila de red libp2p. Antes de la versión 0.17.1, el servidor libp2p-rendezvous no tiene límite en la cantidad de espacios de nombres que un único par puede registrar. Un par malicioso puede seguir registrando espacios de nombres únicos en un bucle y el servidor acepta felizmente cada uno de ellos, asignando memoria para cada registro sin resistencia. Si se hace esto el tiempo suficiente (o con múltiples pares sybil), el proceso del servidor se termina por falta de memoria. Esta vulnerabilidad está corregida en la versión 0.17.1."}],"id":"CVE-2026-35405","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35405","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-09T17:44:02.373442Z","version":"2.0.3"}}]},"published":"2026-04-07T15:17:43.367","references":[{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/libp2p/rust-libp2p/security/advisories/GHSA-cqfx-gf56-8x59"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35526.json b/data/2026/CVE-2026-35526.json index f20f47b842..9556847b23 100644 --- a/data/2026/CVE-2026-35526.json +++ b/data/2026/CVE-2026-35526.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"strawberry","vendor":"strawberry-graphql","versions":[{"status":"affected","version":"< 0.312.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:strawberry:strawberry_graphql:*:*:*:*:*:python:*:*","matchCriteriaId":"480FB826-3577-47DB-8F4B-B7B6F5C474E5","versionEndExcluding":"0.312.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An unauthenticated attacker can open a single WebSocket connection, send connection_init, and then flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation. This leads to server degradation or an OOM crash. This vulnerability is fixed in 0.312.3."}],"id":"CVE-2026-35526","lastModified":"2026-06-17T10:40:43.620","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35526","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-08T14:55:45.309490Z","version":"2.0.3"}}]},"published":"2026-04-07T16:16:28.843","references":[{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-hv3w-m4g2-5x77"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"strawberry","vendor":"strawberry-graphql","versions":[{"status":"affected","version":"< 0.312.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:strawberry:strawberry_graphql:*:*:*:*:*:python:*:*","matchCriteriaId":"480FB826-3577-47DB-8F4B-B7B6F5C474E5","versionEndExcluding":"0.312.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Strawberry GraphQL is a library for creating GraphQL APIs. Prior to 0.312.3, Strawberry GraphQL's WebSocket subscription handlers for both the graphql-transport-ws and legacy graphql-ws protocols allocate an asyncio.Task and associated Operation object for every incoming subscribe message without enforcing any limit on the number of active subscriptions per connection. An unauthenticated attacker can open a single WebSocket connection, send connection_init, and then flood subscribe messages with unique IDs. Each message unconditionally spawns a new asyncio.Task and async generator, causing linear memory growth and event loop saturation. This leads to server degradation or an OOM crash. This vulnerability is fixed in 0.312.3."},{"lang":"es","value":"Strawberry GraphQL es una biblioteca para crear APIs GraphQL. Antes de la versión 0.312.3, los manejadores de suscripción WebSocket de Strawberry GraphQL, tanto para los protocolos graphql-transport-ws como para los legados graphql-ws, asignan una asyncio.Task y un objeto Operation asociado por cada mensaje de suscripción entrante sin aplicar ningún límite en el número de suscripciones activas por conexión. Un atacante no autenticado puede abrir una única conexión WebSocket, enviar connection_init y luego inundar con mensajes de suscripción con IDs únicos. Cada mensaje genera incondicionalmente una nueva asyncio.Task y un generador asíncrono, causando un crecimiento lineal de la memoria y la saturación del bucle de eventos. Esto lleva a la degradación del servidor o a un fallo por OOM. Esta vulnerabilidad se corrige en la versión 0.312.3."}],"id":"CVE-2026-35526","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35526","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-08T14:55:45.309490Z","version":"2.0.3"}}]},"published":"2026-04-07T16:16:28.843","references":[{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-hv3w-m4g2-5x77"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35548.json b/data/2026/CVE-2026-35548.json index 52d7ed790e..ffa5f11aea 100644 --- a/data/2026/CVE-2026-35548.json +++ b/data/2026/CVE-2026-35548.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:guardsix:logpoint:*:*:*:*:*:*:*:*","matchCriteriaId":"A2D3137A-300D-4400-B643-B8E9CCDA06D4","versionEndExcluding":"7.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:guardsix:odbc:*:*:*:*:*:*:*:*","matchCriteriaId":"4722C193-9502-4A23-88EF-8A6ED4F5EE4C","versionEndExcluding":"5.2.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flaw allowed stored database credentials to be reused after modification of the target Host, IP address, or Port. When editing an existing Enrichment Source, previously stored credentials were retained even if the connection endpoint was changed. An authenticated Operator user could redirect the database connection to unintended internal systems, resulting in SSRF and potential misuse of valid stored credentials."}],"id":"CVE-2026-35548","lastModified":"2026-06-17T10:40:45.710","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T15:20:42.631183Z","version":"2.0.3"}}]},"published":"2026-04-22T15:16:16.100","references":[{"source":"cve@mitre.org","tags":["Product"],"url":"https://guardsix.com/media-room#/pressreleases/logpoint-becomes-guardsix-as-europe-reassesses-sovereign-security-operations-3436974"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://servicedesk.guardsix.com/hc/en-us/articles/35555683205021-SSRF-in-ODBC-Enrichment-Source"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:guardsix:logpoint:*:*:*:*:*:*:*:*","matchCriteriaId":"A2D3137A-300D-4400-B643-B8E9CCDA06D4","versionEndExcluding":"7.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:guardsix:odbc:*:*:*:*:*:*:*:*","matchCriteriaId":"4722C193-9502-4A23-88EF-8A6ED4F5EE4C","versionEndExcluding":"5.2.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix 7.9.0.0). A logic flaw allowed stored database credentials to be reused after modification of the target Host, IP address, or Port. When editing an existing Enrichment Source, previously stored credentials were retained even if the connection endpoint was changed. An authenticated Operator user could redirect the database connection to unintended internal systems, resulting in SSRF and potential misuse of valid stored credentials."},{"lang":"es","value":"Se descubrió un problema en los Complementos de Enriquecimiento ODBC de guardsix (anteriormente Logpoint) anteriores a la versión 5.2.1 (la versión 5.2.1 se utiliza en guardsix 7.9.0.0). Una falla lógica permitía que las credenciales de la base de datos almacenadas se reutilizaran después de la modificación del Host, la dirección IP o el puerto de destino. Al editar una Fuente de Enriquecimiento existente, las credenciales almacenadas previamente se retenían incluso si se cambiaba el punto final de conexión. Un usuario Operador autenticado podía redirigir la conexión de la base de datos a sistemas internos no deseados, lo que resultaba en SSRF y un posible uso indebido de credenciales válidas almacenadas."}],"id":"CVE-2026-35548","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.7,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T15:20:42.631183Z","version":"2.0.3"}}]},"published":"2026-04-22T15:16:16.100","references":[{"source":"cve@mitre.org","tags":["Product"],"url":"https://guardsix.com/media-room#/pressreleases/logpoint-becomes-guardsix-as-europe-reassesses-sovereign-security-operations-3436974"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://servicedesk.guardsix.com/hc/en-us/articles/35555683205021-SSRF-in-ODBC-Enrichment-Source"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35620.json b/data/2026/CVE-2026-35620.json index 652edbed21..24d709f10c 100644 --- a/data/2026/CVE-2026-35620.json +++ b/data/2026/CVE-2026-35620.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.24","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.24","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"4220D4A6-550A-410D-9E21-4DAAB4E46485","versionEndExcluding":"2026.3.24","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers. The /send command allows non-owner command-authorized senders to change owner-only session delivery policy settings, and the /allowlist mutating commands fail to enforce operator.admin scope. Attackers with operator.write scope can invoke /send on|off|inherit to persistently mutate the current session's sendPolicy, and execute /allowlist add commands to modify config-backed allowFrom entries and pairing-store allowlist entries without proper admin authorization."}],"id":"CVE-2026-35620","lastModified":"2026-06-17T10:40:52.770","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T20:15:56.507137Z","version":"2.0.3"}}]},"published":"2026-04-10T17:17:04.320","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/555b2578a8cc6e1b93f717496935ead97bfbed8b"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/ccfeecb6887cd97937e33a71877ad512741e82b2"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/ea018a68ccb92dbc735bc1df9880d5c95c63ca35"},{"source":"disclosure@vulncheck.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-39mp-545q-w789"},{"source":"disclosure@vulncheck.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vqvg-86cc-cg83"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-missing-authorization-in-send-and-allowlist-chat-commands"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.24","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.24","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"4220D4A6-550A-410D-9E21-4DAAB4E46485","versionEndExcluding":"2026.3.24","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers. The /send command allows non-owner command-authorized senders to change owner-only session delivery policy settings, and the /allowlist mutating commands fail to enforce operator.admin scope. Attackers with operator.write scope can invoke /send on|off|inherit to persistently mutate the current session's sendPolicy, and execute /allowlist add commands to modify config-backed allowFrom entries and pairing-store allowlist entries without proper admin authorization."},{"lang":"es","value":"OpenClaw anterior a 2026.3.24 contiene vulnerabilidades de autorización faltante en los manejadores de comandos de chat /send y /allowlist. El comando /send permite a remitentes no propietarios autorizados por comando cambiar la configuración de la política de entrega de la sesión solo para propietarios, y los comandos mutadores de /allowlist no logran aplicar el alcance operator.admin. Atacantes con alcance operator.write pueden invocar /send on|off|inherit para mutar persistentemente la sendPolicy de la sesión actual, y ejecutar comandos /allowlist add para modificar entradas allowFrom respaldadas por configuración y entradas de allowlist del almacén de emparejamiento sin la autorización de administrador adecuada."}],"id":"CVE-2026-35620","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35620","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T20:15:56.507137Z","version":"2.0.3"}}]},"published":"2026-04-10T17:17:04.320","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/555b2578a8cc6e1b93f717496935ead97bfbed8b"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/ccfeecb6887cd97937e33a71877ad512741e82b2"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/ea018a68ccb92dbc735bc1df9880d5c95c63ca35"},{"source":"disclosure@vulncheck.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-39mp-545q-w789"},{"source":"disclosure@vulncheck.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vqvg-86cc-cg83"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-missing-authorization-in-send-and-allowlist-chat-commands"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35624.json b/data/2026/CVE-2026-35624.json index 8aa3b59c9b..1c82ef22c2 100644 --- a/data/2026/CVE-2026-35624.json +++ b/data/2026/CVE-2026-35624.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms."}],"id":"CVE-2026-35624","lastModified":"2026-06-17T10:40:53.280","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35624","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T17:15:46.123024Z","version":"2.0.3"}}]},"published":"2026-04-09T22:16:30.683","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xhq5-45pm-2gjr"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-policy-confusion-via-room-name-collision-in-nextcloud-talk"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms."},{"lang":"es","value":"OpenClaw anterior a 2026.3.22 contiene una vulnerabilidad de confusión de políticas en la autorización de salas que coincide con nombres de salas en colisión en lugar de tokens de sala estables. Los atacantes pueden explotar salas con nombres similares para eludir políticas de lista de permitidos y obtener acceso no autorizado a salas protegidas de Nextcloud Talk."}],"id":"CVE-2026-35624","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35624","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T17:15:46.123024Z","version":"2.0.3"}}]},"published":"2026-04-09T22:16:30.683","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/a47722de7e3c9cbda8d5512747ca7e3bb8f6ee66"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xhq5-45pm-2gjr"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-policy-confusion-via-room-name-collision-in-nextcloud-talk"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-807"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35626.json b/data/2026/CVE-2026-35626.json index e25306a05b..835da7179e 100644 --- a/data/2026/CVE-2026-35626.json +++ b/data/2026/CVE-2026-35626.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassing signature validation."}],"id":"CVE-2026-35626","lastModified":"2026-06-17T10:40:53.533","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35626","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T03:08:51.368183Z","version":"2.0.3"}}]},"published":"2026-04-09T22:16:31.047","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/651dc7450b68a5396a009db78ef9382633707ead"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rm59-992w-x2mv"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-unauthenticated-resource-exhaustion-via-voice-call-webhook"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-405"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains an unauthenticated resource exhaustion vulnerability in voice call webhook handling that buffers request bodies before provider signature checks. Attackers can send large or malicious webhook requests to exhaust server resources without authentication by bypassing signature validation."},{"lang":"es","value":"OpenClaw anterior a 2026.3.22 contiene una vulnerabilidad de agotamiento de recursos sin autenticación en el manejo de webhooks de llamadas de voz que almacena en búfer los cuerpos de las solicitudes antes de las comprobaciones de firma del proveedor. Los atacantes pueden enviar solicitudes de webhook grandes o maliciosas para agotar los recursos del servidor sin autenticación al eludir la validación de firma."}],"id":"CVE-2026-35626","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35626","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T03:08:51.368183Z","version":"2.0.3"}}]},"published":"2026-04-09T22:16:31.047","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/651dc7450b68a5396a009db78ef9382633707ead"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rm59-992w-x2mv"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-unauthenticated-resource-exhaustion-via-voice-call-webhook"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-405"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35629.json b/data/2026/CVE-2026-35629.json index 3a9f4140da..46de3c32af 100644 --- a/data/2026/CVE-2026-35629.json +++ b/data/2026/CVE-2026-35629.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.25","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.25","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"AC9C9003-CE72-4BFC-85B4-1E778E125CB1","versionEndExcluding":"2026.3.25","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.25 contains a server-side request forgery vulnerability in multiple channel extensions that fail to properly guard configured base URLs against SSRF attacks. Attackers can exploit unprotected fetch() calls against configured endpoints to rebind requests to blocked internal destinations and access restricted resources."}],"id":"CVE-2026-35629","lastModified":"2026-06-17T10:40:53.907","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":3.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35629","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T15:52:32.705810Z","version":"2.0.3"}}]},"published":"2026-04-09T22:16:31.603","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/f92c92515bd439a71bd03eb1bc969c1964f17acf"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rhfg-j8jq-7v2h"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unguarded-configured-base-urls-in-channel-extensions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.25","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.25","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"AC9C9003-CE72-4BFC-85B4-1E778E125CB1","versionEndExcluding":"2026.3.25","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.25 contains a server-side request forgery vulnerability in multiple channel extensions that fail to properly guard configured base URLs against SSRF attacks. Attackers can exploit unprotected fetch() calls against configured endpoints to rebind requests to blocked internal destinations and access restricted resources."},{"lang":"es","value":"OpenClaw anterior a 2026.3.25 contiene una vulnerabilidad de falsificación de petición del lado del servidor en múltiples extensiones de canal que no protegen adecuadamente las URL base configuradas contra ataques SSRF. Los atacantes pueden explotar llamadas fetch() no protegidas contra puntos finales configurados para reasignar peticiones a destinos internos bloqueados y acceder a recursos restringidos."}],"id":"CVE-2026-35629","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.1,"impactScore":3.7,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35629","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T15:52:32.705810Z","version":"2.0.3"}}]},"published":"2026-04-09T22:16:31.603","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/f92c92515bd439a71bd03eb1bc969c1964f17acf"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rhfg-j8jq-7v2h"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-server-side-request-forgery-via-unguarded-configured-base-urls-in-channel-extensions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-918"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35633.json b/data/2026/CVE-2026-35633.json index a7dca860a2..30345130ef 100644 --- a/data/2026/CVE-2026-35633.json +++ b/data/2026/CVE-2026-35633.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive memory consumption. Attackers can send crafted HTTP error responses with large bodies to remote media endpoints, causing the application to allocate unbounded memory before failure handling occurs."}],"id":"CVE-2026-35633","lastModified":"2026-06-17T10:40:54.393","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35633","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T03:09:43.862490Z","version":"2.0.3"}}]},"published":"2026-04-09T22:16:32.187","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/81445a901091a5d27ef0b56fceedbe4724566438"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4qwc-c7g9-4xcw"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-unbounded-memory-allocation-via-remote-media-error-responses"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-789"}],"source":"disclosure@vulncheck.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-770"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains an unbounded memory allocation vulnerability in remote media HTTP error handling that allows attackers to trigger excessive memory consumption. Attackers can send crafted HTTP error responses with large bodies to remote media endpoints, causing the application to allocate unbounded memory before failure handling occurs."},{"lang":"es","value":"OpenClaw anterior a 2026.3.22 contiene una vulnerabilidad de asignación de memoria ilimitada en el manejo de errores HTTP de medios remotos que permite a los atacantes desencadenar un consumo excesivo de memoria. Los atacantes pueden enviar respuestas de error HTTP manipuladas con cuerpos grandes a los puntos finales de medios remotos, lo que provoca que la aplicación asigne memoria ilimitada antes de que se produzca el manejo de fallos."}],"id":"CVE-2026-35633","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35633","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-14T03:09:43.862490Z","version":"2.0.3"}}]},"published":"2026-04-09T22:16:32.187","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/81445a901091a5d27ef0b56fceedbe4724566438"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4qwc-c7g9-4xcw"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-unbounded-memory-allocation-via-remote-media-error-responses"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-789"}],"source":"disclosure@vulncheck.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-770"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-35640.json b/data/2026/CVE-2026-35640.json index faf14ed272..3fc1ffc4c9 100644 --- a/data/2026/CVE-2026-35640.json +++ b/data/2026/CVE-2026-35640.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.25","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.25","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"AC9C9003-CE72-4BFC-85B4-1E778E125CB1","versionEndExcluding":"2026.3.25","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote attackers can send malicious webhook requests to trigger denial of service by exhausting server resources through forced JSON parsing before signature rejection."}],"id":"CVE-2026-35640","lastModified":"2026-06-17T10:40:56.503","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35640","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T12:25:51.531666Z","version":"2.0.3"}}]},"published":"2026-04-09T22:16:33.507","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/5e8cb22176e9235e224be0bc530699261eb60e53"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3h52-cx59-c456"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-unauthenticated-webhook-request-parsing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-696"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.25","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.25","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"AC9C9003-CE72-4BFC-85B4-1E778E125CB1","versionEndExcluding":"2026.3.25","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote attackers can send malicious webhook requests to trigger denial of service by exhausting server resources through forced JSON parsing before signature rejection."},{"lang":"es","value":"OpenClaw anterior a 2026.3.25 analiza cuerpos de solicitud JSON antes de validar firmas de webhook, permitiendo a atacantes no autenticados forzar operaciones de análisis que consumen muchos recursos. Atacantes remotos pueden enviar solicitudes de webhook maliciosas para desencadenar una denegación de servicio agotando los recursos del servidor mediante el análisis JSON forzado antes del rechazo de la firma."}],"id":"CVE-2026-35640","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35640","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T12:25:51.531666Z","version":"2.0.3"}}]},"published":"2026-04-09T22:16:33.507","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/5e8cb22176e9235e224be0bc530699261eb60e53"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3h52-cx59-c456"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-denial-of-service-via-unauthenticated-webhook-request-parsing"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-696"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35644.json b/data/2026/CVE-2026-35644.json index 9b9f53e42a..f020c84f0c 100644 --- a/data/2026/CVE-2026-35644.json +++ b/data/2026/CVE-2026-35644.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via config.get and channels.status endpoints to retrieve sensitive authentication information from URL userinfo components."}],"id":"CVE-2026-35644","lastModified":"2026-06-17T10:40:57.010","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35644","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T15:52:16.978928Z","version":"2.0.3"}}]},"published":"2026-04-09T22:16:33.873","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/f0202264d0de7ad345382b9008c5963bcefb01b7"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ppwq-6v66-5m6j"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-credential-exposure-via-baseurl-fields-in-gateway-snapshots"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via config.get and channels.status endpoints to retrieve sensitive authentication information from URL userinfo components."},{"lang":"es","value":"OpenClaw anterior a 2026.3.22 contiene una vulnerabilidad de revelación de información que permite a atacantes con alcance operator.read exponer credenciales incrustadas en los campos baseUrl y httpUrl del canal. Los atacantes pueden acceder a instantáneas de la pasarela a través de los endpoints config.get y channels.status para recuperar información de autenticación sensible de los componentes userinfo de la URL."}],"id":"CVE-2026-35644","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35644","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T15:52:16.978928Z","version":"2.0.3"}}]},"published":"2026-04-09T22:16:33.873","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/f0202264d0de7ad345382b9008c5963bcefb01b7"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ppwq-6v66-5m6j"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-credential-exposure-via-baseurl-fields-in-gateway-snapshots"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-312"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35648.json b/data/2026/CVE-2026-35648.json index f7fa2b0652..eb420c9082 100644 --- a/data/2026/CVE-2026-35648.json +++ b/data/2026/CVE-2026-35648.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or declarations that survive policy tightening to execute unauthorized commands."}],"id":"CVE-2026-35648","lastModified":"2026-06-17T10:40:57.517","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35648","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-13T17:46:09.782606Z","version":"2.0.3"}}]},"published":"2026-04-10T17:17:05.253","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/ec2c6d83b9f5f91d6d9094842e0f19b88e63e3e2"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wj55-88gf-x564"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-policy-bypass-via-unvalidated-queued-node-actions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or declarations that survive policy tightening to execute unauthorized commands."},{"lang":"es","value":"OpenClaw anterior a 2026.3.22 contiene una vulnerabilidad de omisión de políticas donde las acciones de nodo en cola no se revalidan contra la política de comandos actual cuando se entregan. Los atacantes pueden explotar listas de permitidos obsoletas o declaraciones que sobreviven al endurecimiento de políticas para ejecutar comandos no autorizados."}],"id":"CVE-2026-35648","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.3,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35648","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-13T17:46:09.782606Z","version":"2.0.3"}}]},"published":"2026-04-10T17:17:05.253","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/ec2c6d83b9f5f91d6d9094842e0f19b88e63e3e2"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wj55-88gf-x564"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-policy-bypass-via-unvalidated-queued-node-actions"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35659.json b/data/2026/CVE-2026-35659.json index 7e3e9f4ae1..4d27f4d288 100644 --- a/data/2026/CVE-2026-35659.json +++ b/data/2026/CVE-2026-35659.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious discovery metadata."}],"id":"CVE-2026-35659","lastModified":"2026-06-17T10:40:58.907","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35659","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T16:58:41.204384Z","version":"2.0.3"}}]},"published":"2026-04-10T17:17:07.277","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/deecf68b59a9b7eea978e40fd3c2fe543087b569"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rvqr-hrcc-j9vv"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-unresolved-service-metadata-routing-via-bonjour-and-dns-sd-discovery"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious discovery metadata."},{"lang":"es","value":"OpenClaw anterior a 2026.3.22 contiene una vulnerabilidad de descubrimiento de servicios donde los metadatos TXT de Bonjour y DNS-SD podrían influir en el enrutamiento de la CLI incluso cuando la resolución real del servicio fallaba. Los atacantes pueden explotar pistas no resueltas para dirigir las decisiones de enrutamiento a objetivos no deseados al proporcionar metadatos de descubrimiento maliciosos."}],"id":"CVE-2026-35659","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":2.5,"source":"disclosure@vulncheck.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.1,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35659","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T16:58:41.204384Z","version":"2.0.3"}}]},"published":"2026-04-10T17:17:07.277","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/deecf68b59a9b7eea978e40fd3c2fe543087b569"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rvqr-hrcc-j9vv"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-unresolved-service-metadata-routing-via-bonjour-and-dns-sd-discovery"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-345"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35666.json b/data/2026/CVE-2026-35666.json index a7a45402d3..93cb427e32 100644 --- a/data/2026/CVE-2026-35666.json +++ b/data/2026/CVE-2026-35666.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass executable binding restrictions by using an unregistered time wrapper to reuse approval state for inner commands."}],"id":"CVE-2026-35666","lastModified":"2026-06-17T10:40:59.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35666","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-13T17:38:28.173357Z","version":"2.0.3"}}]},"published":"2026-04-10T17:17:08.680","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/39409b6a6dd4239deea682e626bac9ba547bfb14"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qm9x-v7cx-7rq4"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-unregistered-time-dispatch-wrapper"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-706"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.22","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.22","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"80A4431B-25A7-43D7-9618-5E37E4359DB5","versionEndExcluding":"2026.3.22","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass executable binding restrictions by using an unregistered time wrapper to reuse approval state for inner commands."},{"lang":"es","value":"OpenClaw antes de 2026.3.22 contiene una vulnerabilidad de omisión de lista de permitidos en las aprobaciones de system.run que no logra desenvolver los envoltorios de /usr/bin/time. Los atacantes pueden omitir las restricciones de enlace de ejecutables al usar un envoltorio de tiempo no registrado para reutilizar el estado de aprobación para comandos internos."}],"id":"CVE-2026-35666","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.7,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35666","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-13T17:38:28.173357Z","version":"2.0.3"}}]},"published":"2026-04-10T17:17:08.680","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/39409b6a6dd4239deea682e626bac9ba547bfb14"},{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/630f1479c44f78484dfa21bb407cbe6f171dac87"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qm9x-v7cx-7rq4"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-allowlist-bypass-via-unregistered-time-dispatch-wrapper"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-706"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-35668.json b/data/2026/CVE-2026-35668.json index 1816d7a166..40b8492026 100644 --- a/data/2026/CVE-2026-35668.json +++ b/data/2026/CVE-2026-35668.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.24","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.24","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"4220D4A6-550A-410D-9E21-4DAAB4E46485","versionEndExcluding":"2026.3.24","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit incomplete parameter validation in normalizeSandboxMediaParams and missing mediaLocalRoots context to access sensitive files including API keys and configuration data outside designated sandbox roots."}],"id":"CVE-2026-35668","lastModified":"2026-06-17T10:41:00.013","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35668","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T18:26:56.766030Z","version":"2.0.3"}}]},"published":"2026-04-10T17:17:09.060","references":[{"source":"disclosure@vulncheck.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hr5v-j9h9-xjhg"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-sandbox-media-root-bypass-via-unnormalized-mediaurl-and-fileurl-parameters"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.3.24","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.3.24","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"4220D4A6-550A-410D-9E21-4DAAB4E46485","versionEndExcluding":"2026.3.24","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspaces via unnormalized mediaUrl or fileUrl parameter keys. Attackers can exploit incomplete parameter validation in normalizeSandboxMediaParams and missing mediaLocalRoots context to access sensitive files including API keys and configuration data outside designated sandbox roots."},{"lang":"es","value":"OpenClaw anterior a 2026.3.24 contiene una vulnerabilidad de salto de ruta en la aplicación de sandbox que permite a los agentes en sandbox leer archivos arbitrarios de los espacios de trabajo de otros agentes a través de claves de parámetro mediaUrl o fileUrl no normalizadas. Los atacantes pueden explotar la validación incompleta de parámetros en normalizeSandboxMediaParams y la falta de contexto de mediaLocalRoots para acceder a archivos sensibles, incluyendo claves de API y datos de configuración, fuera de las raíces de sandbox designadas."}],"id":"CVE-2026-35668","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":4.0,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-35668","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-10T18:26:56.766030Z","version":"2.0.3"}}]},"published":"2026-04-10T17:17:09.060","references":[{"source":"disclosure@vulncheck.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hr5v-j9h9-xjhg"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-sandbox-media-root-bypass-via-unnormalized-mediaurl-and-fileurl-parameters"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-3590.json b/data/2026/CVE-2026-3590.json index d72fe02610..4b7a37824f 100644 --- a/data/2026/CVE-2026-3590.json +++ b/data/2026/CVE-2026-3590.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mattermost","vendor":"Mattermost","versions":[{"lessThanOrEqual":"10.11.12","status":"affected","version":"10.11.0","versionType":"semver"},{"lessThanOrEqual":"11.5.0","status":"affected","version":"11.5.0","versionType":"semver"},{"lessThanOrEqual":"11.4.2","status":"affected","version":"11.4.0","versionType":"semver"},{"lessThanOrEqual":"11.3.2","status":"affected","version":"11.3.0","versionType":"semver"},{"status":"unaffected","version":"11.6.0"},{"status":"unaffected","version":"10.11.13"},{"status":"unaffected","version":"11.5.1"},{"status":"unaffected","version":"11.4.3"},{"status":"unaffected","version":"11.3.3"}]}],"source":"responsibledisclosure@mattermost.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"FCC7A7BB-02AF-4CC9-9F33-8787C87B73F0","versionEndExcluding":"10.11.13","versionStartIncluding":"10.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"F9041D47-B3B0-4958-BD55-FC8A17789C72","versionEndExcluding":"11.3.3","versionStartIncluding":"11.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"D1C9027C-4E83-47E3-8D96-1928F34FBD8E","versionEndExcluding":"11.4.3","versionStartIncluding":"11.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"3D6803A0-3760-4659-95A9-3859B62C0EF4","versionEndExcluding":"11.5.1","versionStartIncluding":"11.5.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to enforce atomic single-use consumption of guest magic link tokens, which allows an attacker with access to a valid magic link to establish multiple independent authenticated sessions via concurrent requests.. Mattermost Advisory ID: MMSA-2026-00624"}],"id":"CVE-2026-3590","lastModified":"2026-06-17T10:43:49.983","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"responsibledisclosure@mattermost.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3590","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-15T14:00:15.919479Z","version":"2.0.3"}}]},"published":"2026-04-15T12:16:40.023","references":[{"source":"responsibledisclosure@mattermost.com","tags":["Vendor Advisory"],"url":"https://mattermost.com/security-updates"}],"sourceIdentifier":"responsibledisclosure@mattermost.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"responsibledisclosure@mattermost.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Mattermost","vendor":"Mattermost","versions":[{"lessThanOrEqual":"10.11.12","status":"affected","version":"10.11.0","versionType":"semver"},{"lessThanOrEqual":"11.5.0","status":"affected","version":"11.5.0","versionType":"semver"},{"lessThanOrEqual":"11.4.2","status":"affected","version":"11.4.0","versionType":"semver"},{"lessThanOrEqual":"11.3.2","status":"affected","version":"11.3.0","versionType":"semver"},{"status":"unaffected","version":"11.6.0"},{"status":"unaffected","version":"10.11.13"},{"status":"unaffected","version":"11.5.1"},{"status":"unaffected","version":"11.4.3"},{"status":"unaffected","version":"11.3.3"}]}],"source":"responsibledisclosure@mattermost.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"FCC7A7BB-02AF-4CC9-9F33-8787C87B73F0","versionEndExcluding":"10.11.13","versionStartIncluding":"10.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"F9041D47-B3B0-4958-BD55-FC8A17789C72","versionEndExcluding":"11.3.3","versionStartIncluding":"11.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"D1C9027C-4E83-47E3-8D96-1928F34FBD8E","versionEndExcluding":"11.4.3","versionStartIncluding":"11.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*","matchCriteriaId":"3D6803A0-3760-4659-95A9-3859B62C0EF4","versionEndExcluding":"11.5.1","versionStartIncluding":"11.5.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to enforce atomic single-use consumption of guest magic link tokens, which allows an attacker with access to a valid magic link to establish multiple independent authenticated sessions via concurrent requests.. Mattermost Advisory ID: MMSA-2026-00624"},{"lang":"es","value":"Las versiones de Mattermost 10.11.x menor o igual que 10.11.12, 11.5.x menor o igual que 11.5.0, 11.4.x menor o igual que 11.4.2, 11.3.x menor o igual que 11.3.2 no logran aplicar el consumo atómico de un solo uso de los tokens de enlace mágico para invitados, lo que permite a un atacante con acceso a un enlace mágico válido establecer múltiples sesiones autenticadas independientes a través de solicitudes concurrentes. ID de Aviso de Mattermost: MMSA-2026-00624"}],"id":"CVE-2026-3590","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"responsibledisclosure@mattermost.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3590","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-15T14:00:15.919479Z","version":"2.0.3"}}]},"published":"2026-04-15T12:16:40.023","references":[{"source":"responsibledisclosure@mattermost.com","tags":["Vendor Advisory"],"url":"https://mattermost.com/security-updates"}],"sourceIdentifier":"responsibledisclosure@mattermost.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-367"}],"source":"responsibledisclosure@mattermost.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-36235.json b/data/2026/CVE-2026-36235.json index 8f85448b65..997d9ce958 100644 --- a/data/2026/CVE-2026-36235.json +++ b/data/2026/CVE-2026-36235.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:itsourcecode:online_student_enrollment_system:1.0:*:*:*:*:*:*:*","matchCriteriaId":"206B072E-A37F-4569-B5E1-B2305B37DB95","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'subjcode' parameter is directly embedded into the SQL query via string interpolation without any sanitization or validation."}],"id":"CVE-2026-36235","lastModified":"2026-06-17T10:41:05.230","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-36235","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-14T14:03:32.958863Z","version":"2.0.3"}}]},"published":"2026-04-10T15:16:25.077","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Amorsec/CVE-PHP/blob/main/itsourcecode-Online_Student_Enrollment_System_in_scheduleSubList.php_sql_injection.pdf"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:itsourcecode:online_student_enrollment_system:1.0:*:*:*:*:*:*:*","matchCriteriaId":"206B072E-A37F-4569-B5E1-B2305B37DB95","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'subjcode' parameter is directly embedded into the SQL query via string interpolation without any sanitization or validation."},{"lang":"es","value":"Una vulnerabilidad de inyección SQL fue encontrada en el archivo scheduleSubList.php de itsourcecode Online Student Enrollment System v1.0. La razón de este problema es que el parámetro ’subjcode’ está directamente incrustado en la consulta SQL a través de interpolación de cadenas sin ninguna sanitización o validación."}],"id":"CVE-2026-36235","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-36235","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-14T14:03:32.958863Z","version":"2.0.3"}}]},"published":"2026-04-10T15:16:25.077","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/Amorsec/CVE-PHP/blob/main/itsourcecode-Online_Student_Enrollment_System_in_scheduleSubList.php_sql_injection.pdf"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-3673.json b/data/2026/CVE-2026-3673.json index a91fc999e2..9305946b2e 100644 --- a/data/2026/CVE-2026-3673.json +++ b/data/2026/CVE-2026-3673.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"product":"Frappe","vendor":"Frappe","versions":[{"status":"affected","version":"16.10.10"}]}],"source":"help@fluidattacks.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:frappe:frappe:16.10.10:*:*:*:*:*:*:*","matchCriteriaId":"42F5A21F-B8DB-4860-B79B-313619740B28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered. The vulnerable renderer interpolates tag content into HTML attributes and element content without escaping.\nThis issue affects Frappe: 16.10.10."}],"id":"CVE-2026-3673","lastModified":"2026-06-17T10:43:57.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3673","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T19:57:30.515469Z","version":"2.0.3"}}]},"published":"2026-04-22T20:16:41.790","references":[{"source":"help@fluidattacks.com","tags":["Exploit","Third Party Advisory"],"url":"https://fluidattacks.com/es/advisories/silvio"},{"source":"help@fluidattacks.com","tags":["Product"],"url":"https://github.com/frappe/frappe"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://fluidattacks.com/es/advisories/silvio"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"product":"Frappe","vendor":"Frappe","versions":[{"status":"affected","version":"16.10.10"}]}],"source":"help@fluidattacks.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:frappe:frappe:16.10.10:*:*:*:*:*:*:*","matchCriteriaId":"42F5A21F-B8DB-4860-B79B-313619740B28","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated attacker can store a crafted tag value in _user_tags and trigger JavaScript execution when a victim opens the list/report view where tags are rendered. The vulnerable renderer interpolates tag content into HTML attributes and element content without escaping.\nThis issue affects Frappe: 16.10.10."},{"lang":"es","value":"Un atacante autenticado puede almacenar un valor de etiqueta manipulado en _user_tags y desencadenar la ejecución de JavaScript cuando una víctima abre la vista de lista/informe donde se renderizan las etiquetas. El renderizador vulnerable interpola el contenido de la etiqueta en atributos HTML y contenido de elementos sin escapar.\nEste problema afecta a Frappe: 16.10.10."}],"id":"CVE-2026-3673","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3673","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T19:57:30.515469Z","version":"2.0.3"}}]},"published":"2026-04-22T20:16:41.790","references":[{"source":"help@fluidattacks.com","tags":["Exploit","Third Party Advisory"],"url":"https://fluidattacks.com/es/advisories/silvio"},{"source":"help@fluidattacks.com","tags":["Product"],"url":"https://github.com/frappe/frappe"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://fluidattacks.com/es/advisories/silvio"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-3690.json b/data/2026/CVE-2026-3690.json index 6d77f824a5..44691ff491 100644 --- a/data/2026/CVE-2026-3690.json +++ b/data/2026/CVE-2026-3690.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"OpenClaw","vendor":"OpenClaw","versions":[{"status":"affected","version":"2026.2.17"}]}],"source":"zdi-disclosures@trendmicro.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"539A1AE2-E6EC-4FC0-A794-28AA37D76D8E","versionEndExcluding":"2026.2.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the the authentication function for canvas endpoints. The issue results from improper implementation of authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29311."}],"id":"CVE-2026-3690","lastModified":"2026-06-17T10:44:00.707","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.0"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-14T03:55:56.908593Z","version":"2.0.3"}}]},"published":"2026-04-11T01:16:15.990","references":[{"source":"zdi-disclosures@trendmicro.com","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vvjh-f6p9-5vcf"},{"source":"zdi-disclosures@trendmicro.com","tags":["Exploit","Third Party Advisory"],"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-228/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-291"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"OpenClaw","vendor":"OpenClaw","versions":[{"status":"affected","version":"2026.2.17"}]}],"source":"zdi-disclosures@trendmicro.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"539A1AE2-E6EC-4FC0-A794-28AA37D76D8E","versionEndExcluding":"2026.2.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the the authentication function for canvas endpoints. The issue results from improper implementation of authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29311."},{"lang":"es","value":"Vulnerabilidad de omisión de autenticación de OpenClaw Canvas. Esta vulnerabilidad permite a atacantes remotos omitir la autenticación en instalaciones afectadas de OpenClaw. No se requiere autenticación para explotar esta vulnerabilidad.\n\nLa falla específica existe dentro de la implementación de la función de autenticación para los puntos finales de canvas. El problema resulta de una implementación incorrecta de la autenticación. Un atacante puede aprovechar esta vulnerabilidad para omitir la autenticación en el sistema. Fue ZDI-CAN-29311."}],"id":"CVE-2026-3690","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV30":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.0"},"exploitabilityScore":2.2,"impactScore":5.2,"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3690","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-14T03:55:56.908593Z","version":"2.0.3"}}]},"published":"2026-04-11T01:16:15.990","references":[{"source":"zdi-disclosures@trendmicro.com","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vvjh-f6p9-5vcf"},{"source":"zdi-disclosures@trendmicro.com","tags":["Exploit","Third Party Advisory"],"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-228/"}],"sourceIdentifier":"zdi-disclosures@trendmicro.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-291"}],"source":"zdi-disclosures@trendmicro.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-37457.json b/data/2026/CVE-2026-37457.json index 7bc84e6b1c..4127c8a6e3 100644 --- a/data/2026/CVE-2026-37457.json +++ b/data/2026/CVE-2026-37457.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"frr","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:10.4.4-1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"frr","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:7.5.1-24.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"frr10","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:10.4.3-3.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"frr","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.3-13.el9_8","versionType":"rpm"}]}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:frrouting:frrouting:10.0:-:*:*:*:*:*:*","matchCriteriaId":"E800C2CB-4B1D-46D5-BA29-9C5D911708F7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted FlowSpec component."}],"id":"CVE-2026-37457","lastModified":"2026-07-15T02:20:44.463","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37457","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T18:15:57.207525Z","version":"2.0.3"}}]},"published":"2026-05-01T18:16:14.770","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/FRRouting/frr/commit/0e6882bc72c0278988a47b2f0f73b7a91099a25c"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24340"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24347"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24370"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24371"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-37457"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464548"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-37457.json"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"frr","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:10.4.4-1.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"],"defaultStatus":"affected","packageName":"frr","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:7.5.1-24.el8_10","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"frr10","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:10.4.3-3.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"frr","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:8.5.3-13.el9_8","versionType":"rpm"}]}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:frrouting:frrouting:10.0:-:*:*:*:*:*:*","matchCriteriaId":"E800C2CB-4B1D-46D5-BA29-9C5D911708F7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted FlowSpec component."},{"lang":"es","value":"Una vulnerabilidad de escritura fuera de límites por un error de uno en la función bgp_flowspec_op_decode() (bgpd/bgp_flowspec_util.c) de FRRouting (FRR) stable/10.0 permite a los atacantes causar una Denegación de Servicio (DoS) mediante el suministro de un componente FlowSpec manipulado."}],"id":"CVE-2026-37457","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37457","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T18:15:57.207525Z","version":"2.0.3"}}]},"published":"2026-05-01T18:16:14.770","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/FRRouting/frr/commit/0e6882bc72c0278988a47b2f0f73b7a91099a25c"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24340"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24347"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24370"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:24371"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-37457"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464548"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-37457.json"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-787"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-37458.json b/data/2026/CVE-2026-37458.json index fe81133dfa..9f3cab0593 100644 --- a/data/2026/CVE-2026-37458.json +++ b/data/2026/CVE-2026-37458.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*","matchCriteriaId":"93799C85-83E1-4A71-B8A6-CFB9974CA661","versionEndIncluding":"10.6.0","versionStartIncluding":"10.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message."}],"id":"CVE-2026-37458","lastModified":"2026-06-17T10:41:32.323","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37458","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T15:45:04.388396Z","version":"2.0.3"}}]},"published":"2026-05-04T16:16:02.170","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/FRRouting/frr/commit/8102a8aeceb9f86fdfe1f80cd77080522bab69c8"},{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://github.com/mertsatilmaz/vulnerability-research/blob/main/advisories/CVE-2026-36365.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*","matchCriteriaId":"93799C85-83E1-4A71-B8A6-CFB9974CA661","versionEndIncluding":"10.6.0","versionStartIncluding":"10.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message."},{"lang":"es","value":"Falta de validación de entrada en el componente MP_REACH_NLRI de FRRouting (FRR) stable/10.0 a stable/10.6 permite a atacantes autenticados causar una Denegación de Servicio (DoS) mediante el suministro de un mensaje UPDATE manipulado."}],"id":"CVE-2026-37458","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37458","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-05T15:45:04.388396Z","version":"2.0.3"}}]},"published":"2026-05-04T16:16:02.170","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/FRRouting/frr/commit/8102a8aeceb9f86fdfe1f80cd77080522bab69c8"},{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://github.com/mertsatilmaz/vulnerability-research/blob/main/advisories/CVE-2026-36365.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-37503.json b/data/2026/CVE-2026-37503.json index 8e32bca1b1..39a78ce10c 100644 --- a/data/2026/CVE-2026-37503.json +++ b/data/2026/CVE-2026-37503.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:v2board:v2board:*:*:*:*:*:*:*:*","matchCriteriaId":"5514969D-29B0-4D10-A1F8-11154F0BCAF6","versionEndIncluding":"1.7.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in public/theme/v2board/dashboard.blade.php. An admin can inject arbitrary JavaScript via the saveThemeConfig API. All site visitors execute the payload, enabling cookie theft, session hijacking, or phishing."}],"id":"CVE-2026-37503","lastModified":"2026-06-17T10:41:33.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":4.7,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T19:40:04.043781Z","version":"2.0.3"}}]},"published":"2026-05-01T16:16:30.490","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/v2board/v2board"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:v2board:v2board:*:*:*:*:*:*:*:*","matchCriteriaId":"5514969D-29B0-4D10-A1F8-11154F0BCAF6","versionEndIncluding":"1.7.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Cross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in public/theme/v2board/dashboard.blade.php. An admin can inject arbitrary JavaScript via the saveThemeConfig API. All site visitors execute the payload, enabling cookie theft, session hijacking, or phishing."},{"lang":"es","value":"Cross-Site Scripting (XSS) en V2Board hasta 1.7.4. El campo custom_html en la configuración del tema se renderiza utilizando la salida sin escapar de Blade en public/theme/v2board/dashboard.blade.php. Un administrador puede inyectar JavaScript arbitrario a través de la API saveThemeConfig. Todos los visitantes del sitio ejecutan la carga útil, lo que permite el robo de cookies, el secuestro de sesiones o phishing."}],"id":"CVE-2026-37503","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":4.7,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.7,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T19:40:04.043781Z","version":"2.0.3"}}]},"published":"2026-05-01T16:16:30.490","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/v2board/v2board"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-37504.json b/data/2026/CVE-2026-37504.json index b0611c395d..180bca2719 100644 --- a/data/2026/CVE-2026-37504.json +++ b/data/2026/CVE-2026-37504.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:v2board:v2board:*:*:*:*:*:*:*:*","matchCriteriaId":"5514969D-29B0-4D10-A1F8-11154F0BCAF6","versionEndIncluding":"1.7.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GET parameter transmission. The token appears in URLs such as /api/v1/server/UniProxy/user?token=SECRET, causing it to be recorded in web server access logs, browser history, HTTP Referer headers, and proxy/CDN logs. An attacker who gains access to any log source can extract the token and impersonate a proxy server node, potentially intercepting all user traffic."}],"id":"CVE-2026-37504","lastModified":"2026-06-17T10:41:33.377","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T19:39:19.209018Z","version":"2.0.3"}}]},"published":"2026-05-01T16:16:30.633","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/v2board/v2board"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-598"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:v2board:v2board:*:*:*:*:*:*:*:*","matchCriteriaId":"5514969D-29B0-4D10-A1F8-11154F0BCAF6","versionEndIncluding":"1.7.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GET parameter transmission. The token appears in URLs such as /api/v1/server/UniProxy/user?token=SECRET, causing it to be recorded in web server access logs, browser history, HTTP Referer headers, and proxy/CDN logs. An attacker who gains access to any log source can extract the token and impersonate a proxy server node, potentially intercepting all user traffic."},{"lang":"es","value":"server_token sensible expuesto a través de un parámetro GET en V2Board hasta la versión 1.7.4. En app/Http/Controllers/Server/UniProxyController.php, el token de autenticación del servidor es aceptado a través de la transmisión de un parámetro GET. El token aparece en URLs como /api/v1/server/UniProxy/user?token=SECRET, lo que provoca que se registre en registros de acceso del servidor web, historial del navegador, encabezados HTTP Referer y registros de proxy/CDN. Un atacante que obtiene acceso a cualquier fuente de registro puede extraer el token e suplantar la identidad de un nodo de servidor proxy, interceptando potencialmente todo el tráfico de usuarios."}],"id":"CVE-2026-37504","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":3.6,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T19:39:19.209018Z","version":"2.0.3"}}]},"published":"2026-05-01T16:16:30.633","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/v2board/v2board"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-598"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-37505.json b/data/2026/CVE-2026-37505.json index eb2198a10f..515554323a 100644 --- a/data/2026/CVE-2026-37505.json +++ b/data/2026/CVE-2026-37505.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:v2board:v2board:*:*:*:*:*:*:*:*","matchCriteriaId":"5514969D-29B0-4D10-A1F8-11154F0BCAF6","versionEndIncluding":"1.7.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis."}],"id":"CVE-2026-37505","lastModified":"2026-06-17T10:41:33.527","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37505","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T19:38:55.423498Z","version":"2.0.3"}}]},"published":"2026-05-01T16:16:30.773","references":[{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/v2board/v2board"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:v2board:v2board:*:*:*:*:*:*:*:*","matchCriteriaId":"5514969D-29B0-4D10-A1F8-11154F0BCAF6","versionEndIncluding":"1.7.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis."},{"lang":"es","value":"Inyección SQL a través de la cláusula ORDER BY en V2Board hasta la versión 1.7.4. En app/Http/Controllers/Admin/UserController.php, el parámetro sort de la entrada del usuario se pasa directamente a User::orderBy($sort, $sortType) sin validación. Un administrador autenticado puede ordenar usuarios por cualquier columna de la base de datos, incluyendo password, remember_token y otros campos sensibles, lo que permite la revelación de información a través del análisis de ordenación."}],"id":"CVE-2026-37505","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"cve@mitre.org","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37505","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-01T19:38:55.423498Z","version":"2.0.3"}}]},"published":"2026-05-01T16:16:30.773","references":[{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9"},{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/v2board/v2board"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-37525.json b/data/2026/CVE-2026-37525.json index 5ea34487fc..ec33aad4c5 100644 --- a/data/2026/CVE-2026-37525.json +++ b/data/2026/CVE-2026-37525.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linuxfoundation:automotive_grade_linux:*:*:*:*:*:*:*:*","matchCriteriaId":"F565A1E5-42E5-4115-830F-2A328C92F35B","versionEndIncluding":"17.1.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call function in src/afb-supervision.c explicitly nullifies the request credentials by calling afb_context_change_cred(&xreq->context, NULL) before dispatching an attacker-controlled API call via xapi->itf->call(xapi->closure, xreq). The NULL propagation chain through afb-context.c:110 (context->credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context->credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14."},{"lang":"es","value":"AGL app-framework-binder (afb-daemon) hasta la v19.90.0 contiene una vulnerabilidad de escalada de privilegios en el comando Do de supervisión. La función on_supervision_call en src/afb-supervision.c anula explícitamente las credenciales de la solicitud al llamar a afb_context_change_cred(&xreq -> context, NULL) antes de despachar una llamada a la API controlada por el atacante a través de xapi -> itf -> call(xapi -> closure, xreq). La cadena de propagación NULL a través de afb-context.c:110 (context -> credentials = afb_cred_addref(NULL)) y afb-cred.c:163 (devuelve NULL cuando cred es NULL) confirma que las credenciales se ponen a cero antes de que se ejecute la API objetivo. El atacante controla ambos parámetros, api y verb, a través de la entrada JSON, permitiendo la ejecución de cualquier API registrada con un contexto de credenciales NULL. Las API que dependen de context -> credentials para decisiones de autorización pueden fallar en modo abierto al recibir credenciales NULL, lo que permite la escalada de privilegios. Esta vulnerabilidad fue introducida en el commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 el 14-02-2018."}],"id":"CVE-2026-37525","lastModified":"2026-11-08T16:10:00.183","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37525","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T19:35:21.065832Z","version":"2.0.3"}}]},"published":"2026-05-01T17:16:22.270","references":[{"source":"cve@mitre.org","tags":["Broken Link"],"url":"https://gerrit.automotivelinux.org/gerrit/src/app-framework-binder"},{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linuxfoundation:automotive_grade_linux:*:*:*:*:*:*:*:*","matchCriteriaId":"F565A1E5-42E5-4115-830F-2A328C92F35B","versionEndIncluding":"17.1.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"AGL app-framework-binder (afb-daemon) through v19.90.0 contains a privilege escalation vulnerability in the supervision Do command. The on_supervision_call function in src/afb-supervision.c explicitly nullifies the request credentials by calling afb_context_change_cred(&xreq->context, NULL) before dispatching an attacker-controlled API call via xapi->itf->call(xapi->closure, xreq). The NULL propagation chain through afb-context.c:110 (context->credentials = afb_cred_addref(NULL)) and afb-cred.c:163 (returns NULL when cred is NULL) confirms that credentials are zeroed before the target API executes. The attacker controls both api and verb parameters via JSON input, allowing execution of any registered API with a NULL credential context. APIs that rely on context->credentials for authorization decisions may fail open when receiving NULL credentials, enabling privilege escalation. This vulnerability was introduced in commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 on 2018-02-14."},{"lang":"es","value":"AGL app-framework-binder (afb-daemon) hasta la v19.90.0 contiene una vulnerabilidad de escalada de privilegios en el comando Do de supervisión. La función on_supervision_call en src/afb-supervision.c anula explícitamente las credenciales de la solicitud al llamar a afb_context_change_cred(ref:xreq -> context, NULL) antes de despachar una llamada a la API controlada por el atacante a través de xapi -> itf -> call(xapi -> closure, xreq). La cadena de propagación NULL a través de afb-context.c:110 (context -> credentials = afb_cred_addref(NULL)) y afb-cred.c:163 (devuelve NULL cuando cred es NULL) confirma que las credenciales se ponen a cero antes de que se ejecute la API objetivo. El atacante controla ambos parámetros, api y verb, a través de la entrada JSON, permitiendo la ejecución de cualquier API registrada con un contexto de credenciales NULL. Las API que dependen de context -> credentials para decisiones de autorización pueden fallar en modo abierto al recibir credenciales NULL, lo que permite la escalada de privilegios. Esta vulnerabilidad fue introducida en el commit abbb4599f0b921c6f434b6bd02bcfb277eecf745 el 14-02-2018."}],"id":"CVE-2026-37525","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.8,"impactScore":5.9,"source":"cve@mitre.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37525","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-01T19:35:21.065832Z","version":"2.0.3"}}]},"published":"2026-05-01T17:16:22.270","references":[{"source":"cve@mitre.org","tags":["Broken Link"],"url":"https://gerrit.automotivelinux.org/gerrit/src/app-framework-binder"},{"source":"cve@mitre.org","tags":["Third Party Advisory"],"url":"https://gist.github.com/sgInnora/8526eedcfd826d05ef1fc45d8f405643"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-269"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-37709.json b/data/2026/CVE-2026-37709.json index 5c59257a93..5d5e49ace4 100644 --- a/data/2026/CVE-2026-37709.json +++ b/data/2026/CVE-2026-37709.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*","matchCriteriaId":"EB07F5CD-5BCC-4858-8FAD-10A9DBEE5466","versionEndExcluding":"8.4.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component"}],"id":"CVE-2026-37709","lastModified":"2026-06-17T10:41:38.133","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37709","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-07T17:39:06.630573Z","version":"2.0.3"}}]},"published":"2026-05-07T18:16:19.013","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/grokability/snipe-it/commit/676a9958895a77de340565e7a0b17ae744664904"},{"source":"cve@mitre.org","tags":["Patch","Vendor Advisory"],"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-xg82-2hrv-hf64"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*","matchCriteriaId":"EB07F5CD-5BCC-4858-8FAD-10A9DBEE5466","versionEndExcluding":"8.4.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component"},{"lang":"es","value":"Vulnerabilidad de Permisos Inseguros en grokability snipe-it v.8.4.0 y anteriores y corregida después del commit 676a9958 del 10-03-2026 permite a un atacante remoto ejecutar código arbitrario a través del componente app/Http/Controllers/Api/UploadedFilesController.php"}],"id":"CVE-2026-37709","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-37709","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-07T17:39:06.630573Z","version":"2.0.3"}}]},"published":"2026-05-07T18:16:19.013","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/grokability/snipe-it/commit/676a9958895a77de340565e7a0b17ae744664904"},{"source":"cve@mitre.org","tags":["Patch","Vendor Advisory"],"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-xg82-2hrv-hf64"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-284"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-3837.json b/data/2026/CVE-2026-3837.json index fa90a5ad43..a3d503606f 100644 --- a/data/2026/CVE-2026-3837.json +++ b/data/2026/CVE-2026-3837.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Frappe","vendor":"Frappe","versions":[{"status":"affected","version":"16.10.0"}]}],"source":"help@fluidattacks.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:frappe:frappe:16.10.0:*:*:*:*:*:*:*","matchCriteriaId":"E6FD9F29-75F8-48EC-A7B3-67C0B342F6F7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter implementations interpolate stored values into raw HTML attributes and element content without escaping\n\nThis issue affects Frappe: 16.10.0."}],"id":"CVE-2026-3837","lastModified":"2026-06-17T10:44:19.287","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3837","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-23T13:29:56.841031Z","version":"2.0.3"}}]},"published":"2026-04-22T21:17:08.523","references":[{"source":"help@fluidattacks.com","tags":["Exploit","Third Party Advisory"],"url":"https://fluidattacks.com/es/advisories/sabina"},{"source":"help@fluidattacks.com","tags":["Product"],"url":"https://github.com/frappe/frappe"},{"source":"help@fluidattacks.com","tags":["Issue Tracking","Patch"],"url":"https://github.com/frappe/frappe/pull/38796"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Frappe","vendor":"Frappe","versions":[{"status":"affected","version":"16.10.0"}]}],"source":"help@fluidattacks.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:frappe:frappe:16.10.0:*:*:*:*:*:*:*","matchCriteriaId":"E6FD9F29-75F8-48EC-A7B3-67C0B342F6F7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter implementations interpolate stored values into raw HTML attributes and element content without escaping\n\nThis issue affects Frappe: 16.10.0."},{"lang":"es","value":"Un atacante autenticado puede persistir valores manipulados en múltiples tipos de campo y desencadenar la ejecución de scripts del lado del cliente cuando otro usuario abre el documento afectado en Desk. Las implementaciones vulnerables del formateador interpolan valores almacenados en atributos HTML sin procesar y contenido de elementos sin escapar. Este problema afecta a Frappe: 16.10.0."}],"id":"CVE-2026-3837","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"help@fluidattacks.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3837","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-23T13:29:56.841031Z","version":"2.0.3"}}]},"published":"2026-04-22T21:17:08.523","references":[{"source":"help@fluidattacks.com","tags":["Exploit","Third Party Advisory"],"url":"https://fluidattacks.com/es/advisories/sabina"},{"source":"help@fluidattacks.com","tags":["Product"],"url":"https://github.com/frappe/frappe"},{"source":"help@fluidattacks.com","tags":["Issue Tracking","Patch"],"url":"https://github.com/frappe/frappe/pull/38796"}],"sourceIdentifier":"help@fluidattacks.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"help@fluidattacks.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-38651.json b/data/2026/CVE-2026-38651.json index 3225c93f9f..08dafc9b64 100644 --- a/data/2026/CVE-2026-38651.json +++ b/data/2026/CVE-2026-38651.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:*","matchCriteriaId":"B8374AB6-A9C4-41F7-955E-65C91564EFA6","versionEndExcluding":"1.5.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information"}],"id":"CVE-2026-38651","lastModified":"2026-06-17T10:41:44.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-38651","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-28T17:34:36.148138Z","version":"2.0.3"}}]},"published":"2026-04-28T16:16:13.443","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/gravitl/netmaker/commit/5309aa70d464ef565911369714d661a61481a79b"},{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass"},{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://www.zyenra.com/blog/netmaker-jwt-verification-bypass"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass/"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://www.zyenra.com/blog/netmaker-jwt-verification-bypass"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:*","matchCriteriaId":"B8374AB6-A9C4-41F7-955E-65C91564EFA6","versionEndExcluding":"1.5.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Authentication Bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens. An attacker can forge a JWT signed with any arbitrary key and use it to impersonate any host in the network, gaining access to sensitive information"},{"lang":"es","value":"Vulnerabilidad de omisión de autenticación existe en versiones de Netmaker anteriores a la 1.5.0. La función VerifyHostToken en logic/jwts.go falla al validar la firma JWT al verificar tokens de host. Un atacante puede falsificar un JWT firmado con cualquier clave arbitraria y usarlo para suplantar a cualquier host en la red, obteniendo acceso a información sensible."}],"id":"CVE-2026-38651","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-38651","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-28T17:34:36.148138Z","version":"2.0.3"}}]},"published":"2026-04-28T16:16:13.443","references":[{"source":"cve@mitre.org","tags":["Patch"],"url":"https://github.com/gravitl/netmaker/commit/5309aa70d464ef565911369714d661a61481a79b"},{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass"},{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://www.zyenra.com/blog/netmaker-jwt-verification-bypass"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://www.zyenra.com/advisories/netmaker-jwt-verification-bypass/"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://www.zyenra.com/blog/netmaker-jwt-verification-bypass"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-347"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-38751.json b/data/2026/CVE-2026-38751.json index 66233d5907..b86ac1eba4 100644 --- a/data/2026/CVE-2026-38751.json +++ b/data/2026/CVE-2026-38751.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:devcode:openstamanager:*:*:*:*:*:*:*:*","matchCriteriaId":"61B52C15-FE15-45A5-8BE6-A5C47ACBE850","versionEndIncluding":"2.10","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php)"}],"id":"CVE-2026-38751","lastModified":"2026-06-17T10:41:46.300","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-38751","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-05T13:15:57.701238Z","version":"2.0.3"}}]},"published":"2026-05-04T19:16:03.613","references":[{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/devcode-it/openstamanager"},{"source":"cve@mitre.org","tags":["Broken Link"],"url":"https://github.com/fuutianyii/poc"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:devcode:openstamanager:*:*:*:*:*:*:*:*","matchCriteriaId":"61B52C15-FE15-45A5-8BE6-A5C47ACBE850","versionEndIncluding":"2.10","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php)"},{"lang":"es","value":"OpenSTAManager versión 2.10 y anteriores contiene una vulnerabilidad de carga arbitraria de archivos en la funcionalidad de actualización de módulos (modules/aggiornamenti/upload_modules.php)"}],"id":"CVE-2026-38751","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":1.2,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-38751","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-05-05T13:15:57.701238Z","version":"2.0.3"}}]},"published":"2026-05-04T19:16:03.613","references":[{"source":"cve@mitre.org","tags":["Product"],"url":"https://github.com/devcode-it/openstamanager"},{"source":"cve@mitre.org","tags":["Broken Link"],"url":"https://github.com/fuutianyii/poc"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-434"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-38834.json b/data/2026/CVE-2026-38834.json index 5f32daf68e..15fa8a57bb 100644 --- a/data/2026/CVE-2026-38834.json +++ b/data/2026/CVE-2026-38834.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:tenda:w30e_firmware:16.01.0.21:*:*:*:*:*:*:*","matchCriteriaId":"212C8B7B-FCC1-4C1C-92FD-374E4FC2B893","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:tenda:w30e:2.0:*:*:*:*:*:*:*","matchCriteriaId":"56B9C2BB-D36E-40F8-83FF-FC919337F6BD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the do_ping_action function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request."}],"id":"CVE-2026-38834","lastModified":"2026-06-17T10:41:46.897","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-38834","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T19:23:00.511813Z","version":"2.0.3"}}]},"published":"2026-04-21T17:16:53.257","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/jsjbcyber/repo/blob/main/rep_1.md"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/jsjbcyber/repo/blob/main/rep_1.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:tenda:w30e_firmware:16.01.0.21:*:*:*:*:*:*:*","matchCriteriaId":"212C8B7B-FCC1-4C1C-92FD-374E4FC2B893","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:tenda:w30e:2.0:*:*:*:*:*:*:*","matchCriteriaId":"56B9C2BB-D36E-40F8-83FF-FC919337F6BD","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the do_ping_action function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request."},{"lang":"es","value":"Se encontró que Tenda W30E V2.0 V16.01.0.21 contenía una vulnerabilidad de inyección de comandos en la función do_ping_action a través del parámetro hostName. Esta vulnerabilidad permite a los atacantes ejecutar comandos arbitrarios mediante una solicitud manipulada."}],"id":"CVE-2026-38834","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.4,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-38834","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T19:23:00.511813Z","version":"2.0.3"}}]},"published":"2026-04-21T17:16:53.257","references":[{"source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/jsjbcyber/repo/blob/main/rep_1.md"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"],"url":"https://github.com/jsjbcyber/repo/blob/main/rep_1.md"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-77"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-39388.json b/data/2026/CVE-2026-39388.json index 369c27d9f1..698deb0d3d 100644 --- a/data/2026/CVE-2026-39388.json +++ b/data/2026/CVE-2026-39388.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"openbao","vendor":"openbao","versions":[{"status":"affected","version":"< 2.5.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","matchCriteriaId":"FB9CD431-A4A7-47AC-8111-76D4F60A9D07","versionEndExcluding":"2.5.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request's presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information. Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the attacker had a sibling certificate+key signed by the same CA, but which did not necessarily match the original role or the originally supplied certificate. This implies an attacker could still authenticate to OpenBao in a similar scope, however, token renewal implies that an attacker may be able to extend the lifetime of dynamic leases held by the original token. This attack requires knowledge of either the original token or its accessor. This vulnerability is original from HashiCorp Vault. This is addressed in v2.5.3. As a workaround, ensure privileged roles are tightly scoped to single certificates."}],"id":"CVE-2026-39388","lastModified":"2026-06-17T10:42:02.083","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.5,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39388","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T19:35:56.012388Z","version":"2.0.3"}}]},"published":"2026-04-21T01:16:06.357","references":[{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-7ccv-rp6m-rffr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"openbao","vendor":"openbao","versions":[{"status":"affected","version":"< 2.5.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","matchCriteriaId":"FB9CD431-A4A7-47AC-8111-76D4F60A9D07","versionEndExcluding":"2.5.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, OpenBao's Certificate authentication method, when a token renewal is requested and `disable_binding=true` is set, attempts to verify the current request's presented mTLS certificate matches the original. Token renewals for other authentication methods do not require any supplied login information. Due to incorrect matching, the certificate authentication method would allow renewal of tokens for which the attacker had a sibling certificate+key signed by the same CA, but which did not necessarily match the original role or the originally supplied certificate. This implies an attacker could still authenticate to OpenBao in a similar scope, however, token renewal implies that an attacker may be able to extend the lifetime of dynamic leases held by the original token. This attack requires knowledge of either the original token or its accessor. This vulnerability is original from HashiCorp Vault. This is addressed in v2.5.3. As a workaround, ensure privileged roles are tightly scoped to single certificates."},{"lang":"es","value":"OpenBao es un sistema de gestión de secretos de código abierto basado en identidad. Antes de la versión 2.5.3, el método de autenticación de Certificado de OpenBao, cuando se solicita una renovación de token y “disable_binding=true” está configurado, intenta verificar que el certificado mTLS presentado en la solicitud actual coincide con el original. Las renovaciones de token para otros métodos de autenticación no requieren ninguna información de inicio de sesión suministrada. Debido a una coincidencia incorrecta, el método de autenticación de certificado permitiría la renovación de tokens para los cuales el atacante tenía un certificado+clave hermano firmado por la misma CA, pero que no coincidía necesariamente con el rol original o el certificado suministrado originalmente. Esto implica que un atacante aún podría autenticarse en OpenBao en un ámbito similar; sin embargo, la renovación de token implica que un atacante podría extender la vida útil de los arrendamientos dinámicos mantenidos por el token original. Este ataque requiere conocimiento del token original o de su accesor. Esta vulnerabilidad es original de HashiCorp Vault. Esto se aborda en la v2.5.3. Como solución alternativa, asegúrese de que los roles privilegiados estén estrictamente limitados a certificados únicos."}],"id":"CVE-2026-39388","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":0.5,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39388","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T19:35:56.012388Z","version":"2.0.3"}}]},"published":"2026-04-21T01:16:06.357","references":[{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-7ccv-rp6m-rffr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-295"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-39396.json b/data/2026/CVE-2026-39396.json index a3078a4789..4ff363139c 100644 --- a/data/2026/CVE-2026-39396.json +++ b/data/2026/CVE-2026-39396.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"openbao","vendor":"openbao","versions":[{"status":"affected","version":"< 2.5.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","matchCriteriaId":"FB9CD431-A4A7-47AC-8111-76D4F60A9D07","versionEndExcluding":"2.5.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no upper bound on the number of bytes written. An attacker who controls or compromises the OCI registry referenced in the victim's configuration can serve a crafted image containing a decompression bomb that decompresses to an arbitrarily large file. The SHA256 integrity check occurs after the full file is written to disk, meaning the hash mismatch is detected only after the damage (disk exhaustion) has already occurred. This allow the attacker to replace **legit plugin image** with no need to change its signature. Version 2.5.3 contains a patch."}],"id":"CVE-2026-39396","lastModified":"2026-06-17T10:42:02.940","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39396","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T15:57:04.802504Z","version":"2.0.3"}}]},"published":"2026-04-21T01:16:06.507","references":[{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"openbao","vendor":"openbao","versions":[{"status":"affected","version":"< 2.5.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","matchCriteriaId":"FB9CD431-A4A7-47AC-8111-76D4F60A9D07","versionEndExcluding":"2.5.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, `ExtractPluginFromImage()` in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via `io.Copy` with no upper bound on the number of bytes written. An attacker who controls or compromises the OCI registry referenced in the victim's configuration can serve a crafted image containing a decompression bomb that decompresses to an arbitrarily large file. The SHA256 integrity check occurs after the full file is written to disk, meaning the hash mismatch is detected only after the damage (disk exhaustion) has already occurred. This allow the attacker to replace **legit plugin image** with no need to change its signature. Version 2.5.3 contains a patch."},{"lang":"es","value":"OpenBao es un sistema de gestión de secretos basado en identidad de código abierto. Antes de la versión 2.5.3, ’ExtractPluginFromImage()’ en el descargador de plugins OCI de OpenBao extrae un binario de plugin de una imagen de contenedor mediante la transmisión de datos tar descomprimidos a través de ’io.Copy’ sin un límite superior en el número de bytes escritos. Un atacante que controla o compromete el registro OCI referenciado en la configuración de la víctima puede servir una imagen manipulada que contiene una bomba de descompresión que se descomprime en un archivo arbitrariamente grande. La verificación de integridad SHA256 ocurre después de que el archivo completo se escribe en el disco, lo que significa que la falta de coincidencia del hash se detecta solo después de que el daño (agotamiento del disco) ya ha ocurrido. Esto permite al atacante reemplazar la imagen de plugin legítima sin necesidad de cambiar su firma. La versión 2.5.3 contiene un parche."}],"id":"CVE-2026-39396","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39396","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T15:57:04.802504Z","version":"2.0.3"}}]},"published":"2026-04-21T01:16:06.507","references":[{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-r65v-xgwc-g56j"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-674"},{"lang":"en","value":"CWE-770"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-39817.json b/data/2026/CVE-2026-39817.json index f47f2b3f53..de65e6c172 100644 --- a/data/2026/CVE-2026-39817.json +++ b/data/2026/CVE-2026-39817.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pkg.go.dev","defaultStatus":"unaffected","packageName":"cmd/go","product":"cmd/go","vendor":"Go toolchain","versions":[{"lessThan":"1.25.10","status":"affected","version":"0","versionType":"semver"},{"lessThan":"1.26.3","status":"affected","version":"1.26.0-0","versionType":"semver"}]}],"source":"security@golang.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","matchCriteriaId":"1C966EF3-C51C-4239-B5FC-C44A5202FEC8","versionEndExcluding":"1.25.10","vulnerable":true},{"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","matchCriteriaId":"522E4CD0-2B99-4363-9C78-0BAFD988A2D6","versionEndExcluding":"1.26.3","versionStartIncluding":"1.26.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The \"go tool pack\" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the \"pack\" subcommand can write files to arbitrary locations on the filesystem."}],"id":"CVE-2026-39817","lastModified":"2026-06-17T10:42:37.910","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.5,"impactScore":4.0,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.5,"impactScore":4.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39817","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-08T16:58:23.255142Z","version":"2.0.3"}}]},"published":"2026-05-07T20:16:42.983","references":[{"source":"security@golang.org","tags":["Patch"],"url":"https://go.dev/cl/767520"},{"source":"security@golang.org","tags":["Issue Tracking"],"url":"https://go.dev/issue/78778"},{"source":"security@golang.org","tags":["Issue Tracking","Mailing List"],"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M"},{"source":"security@golang.org","tags":["Vendor Advisory"],"url":"https://pkg.go.dev/vuln/GO-2026-4979"}],"sourceIdentifier":"security@golang.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pkg.go.dev","defaultStatus":"unaffected","packageName":"cmd/go","product":"cmd/go","vendor":"Go toolchain","versions":[{"lessThan":"1.25.10","status":"affected","version":"0","versionType":"semver"},{"lessThan":"1.26.3","status":"affected","version":"1.26.0-0","versionType":"semver"}]}],"source":"security@golang.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","matchCriteriaId":"1C966EF3-C51C-4239-B5FC-C44A5202FEC8","versionEndExcluding":"1.25.10","vulnerable":true},{"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","matchCriteriaId":"522E4CD0-2B99-4363-9C78-0BAFD988A2D6","versionEndExcluding":"1.26.3","versionStartIncluding":"1.26.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The \"go tool pack\" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the \"pack\" subcommand can write files to arbitrary locations on the filesystem."},{"lang":"es","value":"El subcomando ’go tool pack’ (normalmente utilizado solo por el compilador como una herramienta interna con entradas de confianza) no sanea los nombres de archivo de salida. La extracción de un archivo comprimido malicioso con el subcomando ’pack’ puede escribir archivos en ubicaciones arbitrarias en el sistema de archivos."}],"id":"CVE-2026-39817","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.5,"impactScore":4.0,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":1.5,"impactScore":4.0,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39817","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-08T16:58:23.255142Z","version":"2.0.3"}}]},"published":"2026-05-07T20:16:42.983","references":[{"source":"security@golang.org","tags":["Patch"],"url":"https://go.dev/cl/767520"},{"source":"security@golang.org","tags":["Issue Tracking"],"url":"https://go.dev/issue/78778"},{"source":"security@golang.org","tags":["Issue Tracking","Mailing List"],"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M"},{"source":"security@golang.org","tags":["Vendor Advisory"],"url":"https://pkg.go.dev/vuln/GO-2026-4979"}],"sourceIdentifier":"security@golang.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-787"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-39819.json b/data/2026/CVE-2026-39819.json index 316ce596ab..c3b8f151fa 100644 --- a/data/2026/CVE-2026-39819.json +++ b/data/2026/CVE-2026-39819.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"collectionURL":"https://pkg.go.dev","defaultStatus":"unaffected","packageName":"cmd/go","product":"cmd/go","vendor":"Go toolchain","versions":[{"lessThan":"1.25.10","status":"affected","version":"0","versionType":"semver"},{"lessThan":"1.26.3","status":"affected","version":"1.26.0-0","versionType":"semver"}]}],"source":"security@golang.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","matchCriteriaId":"1C966EF3-C51C-4239-B5FC-C44A5202FEC8","versionEndExcluding":"1.25.10","vulnerable":true},{"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","matchCriteriaId":"522E4CD0-2B99-4363-9C78-0BAFD988A2D6","versionEndExcluding":"1.26.3","versionStartIncluding":"1.26.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The \"go bug\" command writes to two files with predictable names in the system temporary directory (for example, \"/tmp\"). An attacker with access to the temporary directory can create a symlink in one of these names, causing \"go bug\" to overwrite the target of the symlink."}],"id":"CVE-2026-39819","lastModified":"2026-06-17T10:42:38.053","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39819","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-08T16:56:43.015860Z","version":"2.0.3"}}]},"published":"2026-05-07T20:16:43.083","references":[{"source":"security@golang.org","tags":["Patch"],"url":"https://go.dev/cl/763882"},{"source":"security@golang.org","tags":["Issue Tracking"],"url":"https://go.dev/issue/78584"},{"source":"security@golang.org","tags":["Issue Tracking","Mailing List"],"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M"},{"source":"security@golang.org","tags":["Vendor Advisory"],"url":"https://pkg.go.dev/vuln/GO-2026-4978"}],"sourceIdentifier":"security@golang.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"nvd@nist.gov","type":"Primary"}]} +{"affected":[{"affectedData":[{"collectionURL":"https://pkg.go.dev","defaultStatus":"unaffected","packageName":"cmd/go","product":"cmd/go","vendor":"Go toolchain","versions":[{"lessThan":"1.25.10","status":"affected","version":"0","versionType":"semver"},{"lessThan":"1.26.3","status":"affected","version":"1.26.0-0","versionType":"semver"}]}],"source":"security@golang.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","matchCriteriaId":"1C966EF3-C51C-4239-B5FC-C44A5202FEC8","versionEndExcluding":"1.25.10","vulnerable":true},{"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","matchCriteriaId":"522E4CD0-2B99-4363-9C78-0BAFD988A2D6","versionEndExcluding":"1.26.3","versionStartIncluding":"1.26.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The \"go bug\" command writes to two files with predictable names in the system temporary directory (for example, \"/tmp\"). An attacker with access to the temporary directory can create a symlink in one of these names, causing \"go bug\" to overwrite the target of the symlink."},{"lang":"es","value":"El comando ’go bug’ escribe en dos archivos con nombres predecibles en el directorio temporal del sistema (por ejemplo, ’/tmp’). Un atacante con acceso al directorio temporal puede crear un enlace simbólico con uno de estos nombres, haciendo que ’go bug’ sobrescriba el objetivo del enlace simbólico."}],"id":"CVE-2026-39819","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"},{"cvssData":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"exploitabilityScore":1.0,"impactScore":4.2,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39819","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-08T16:56:43.015860Z","version":"2.0.3"}}]},"published":"2026-05-07T20:16:43.083","references":[{"source":"security@golang.org","tags":["Patch"],"url":"https://go.dev/cl/763882"},{"source":"security@golang.org","tags":["Issue Tracking"],"url":"https://go.dev/issue/78584"},{"source":"security@golang.org","tags":["Issue Tracking","Mailing List"],"url":"https://groups.google.com/g/golang-announce/c/qcCIEXso47M"},{"source":"security@golang.org","tags":["Vendor Advisory"],"url":"https://pkg.go.dev/vuln/GO-2026-4978"}],"sourceIdentifier":"security@golang.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-59"}],"source":"nvd@nist.gov","type":"Primary"}]} diff --git a/data/2026/CVE-2026-39946.json b/data/2026/CVE-2026-39946.json index b16a2777ce..80d67dc09d 100644 --- a/data/2026/CVE-2026-39946.json +++ b/data/2026/CVE-2026-39946.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"openbao","vendor":"openbao","versions":[{"status":"affected","version":"< 2.5.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","matchCriteriaId":"FB9CD431-A4A7-47AC-8111-76D4F60A9D07","versionEndExcluding":"2.5.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them."}],"id":"CVE-2026-39946","lastModified":"2026-06-17T10:42:48.423","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39946","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T13:34:12.690431Z","version":"2.0.3"}}]},"published":"2026-04-21T01:16:06.790","references":[{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"openbao","vendor":"openbao","versions":[{"status":"affected","version":"< 2.5.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","matchCriteriaId":"FB9CD431-A4A7-47AC-8111-76D4F60A9D07","versionEndExcluding":"2.5.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them."},{"lang":"es","value":"OpenBao es un sistema de gestión de secretos de código abierto basado en identidad. Antes de la versión 2.5.3, cuando OpenBao revocaba privilegios en un rol en el motor de secretos de la base de datos PostgreSQL, OpenBao no utilizaba el entrecomillado adecuado de la base de datos en los nombres de esquema proporcionados por PostgreSQL. Esto podría llevar a fallos en la revocación de roles o, más raramente, a inyección SQL como usuario de gestión. Esta vulnerabilidad era original de HashiCorp Vault. La vulnerabilidad se aborda en la v2.5.3. Como solución alternativa, audite los esquemas de las tablas y asegúrese de que los usuarios de la base de datos no puedan crear nuevos esquemas y conceder privilegios sobre ellos."}],"id":"CVE-2026-39946","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":1.2,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-39946","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T13:34:12.690431Z","version":"2.0.3"}}]},"published":"2026-04-21T01:16:06.790","references":[{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-6vgr-cp5c-ffx3"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40045.json b/data/2026/CVE-2026-40045.json index 50a06bcab6..b1adafbc87 100644 --- a/data/2026/CVE-2026-40045.json +++ b/data/2026/CVE-2026-40045.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"9E93D9F1-C6FA-4AEE-AC8B-27CDEE77637C","versionEndExcluding":"2026.4.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. Attackers can forge discovery results or craft setup codes to redirect clients to malicious endpoints, disclosing plaintext gateway credentials."}],"id":"CVE-2026-40045","lastModified":"2026-06-17T10:44:39.790","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40045","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T13:37:33.042953Z","version":"2.0.3"}}]},"published":"2026-04-21T00:16:29.300","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/a941a4fef9bc43b2973c92d0dcff5b8a426210c5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-83f3-hh45-vfw9"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-cleartext-credential-transmission-via-unencrypted-websocket-gateway-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-319"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"defaultStatus":"unaffected","packageURL":"pkg:npm/openclaw","product":"OpenClaw","vendor":"OpenClaw","versions":[{"lessThan":"2026.4.2","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"2026.4.2","versionType":"semver"}]}],"source":"disclosure@vulncheck.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:node.js:*:*","matchCriteriaId":"9E93D9F1-C6FA-4AEE-AC8B-27CDEE77637C","versionEndExcluding":"2026.4.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. Attackers can forge discovery results or craft setup codes to redirect clients to malicious endpoints, disclosing plaintext gateway credentials."},{"lang":"es","value":"OpenClaw antes de 2026.4.2 acepta puntos finales de pasarela ws:// en texto claro no-loopback y transmite credenciales de pasarela almacenadas a través de conexiones no cifradas. Los atacantes pueden falsificar resultados de descubrimiento o elaborar códigos de configuración para redirigir clientes a puntos finales maliciosos, revelando credenciales de pasarela en texto plano."}],"id":"CVE-2026-40045","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":5.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.1,"impactScore":3.6,"source":"disclosure@vulncheck.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@vulncheck.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40045","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T13:37:33.042953Z","version":"2.0.3"}}]},"published":"2026-04-21T00:16:29.300","references":[{"source":"disclosure@vulncheck.com","tags":["Patch"],"url":"https://github.com/openclaw/openclaw/commit/a941a4fef9bc43b2973c92d0dcff5b8a426210c5"},{"source":"disclosure@vulncheck.com","tags":["Vendor Advisory"],"url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-83f3-hh45-vfw9"},{"source":"disclosure@vulncheck.com","tags":["Third Party Advisory"],"url":"https://www.vulncheck.com/advisories/openclaw-cleartext-credential-transmission-via-unencrypted-websocket-gateway-endpoints"}],"sourceIdentifier":"disclosure@vulncheck.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-319"}],"source":"disclosure@vulncheck.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40170.json b/data/2026/CVE-2026-40170.json index 316e664cf7..6f5529a458 100644 --- a/data/2026/CVE-2026-40170.json +++ b/data/2026/CVE-2026-40170.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"ngtcp2","vendor":"ngtcp2","versions":[{"status":"affected","version":"< 1.22.1"}]}],"source":"security-advisories@github.com"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"samba","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.23.5-109.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"samba","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.23.5-10.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"ngtcp2-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.1-1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"nodejs22","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"nodejs24","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"nodejs","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"nodejs:20/nodejs","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"nodejs:22/nodejs","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"nodejs:24/nodejs","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"nodejs","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"nodejs:20/nodejs","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"nodejs:22/nodejs","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"nodejs:24/nodejs","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tatsuhiro-t:ngtcp2:*:*:*:*:*:*:*:*","matchCriteriaId":"B3AC791C-E488-4CC7-B224-81E5D60AB493","versionEndExcluding":"1.22.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client."}],"id":"CVE-2026-40170","lastModified":"2026-07-15T02:21:03.220","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40170","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-17T14:52:12.292330Z","version":"2.0.3"}}]},"published":"2026-04-16T22:16:38.220","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/ngtcp2/ngtcp2/commit/708a7640c1f48fb8ffb540c4b8ea5b4c1dfb8ee5"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Patch","Vendor Advisory"],"url":"https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8f"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Mitigation","Patch","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/04/17/12"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:22963"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25049"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:9113"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-40170"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459061"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Patch","Vendor Advisory"],"url":"https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8f"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40170.json"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-120"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"ngtcp2","vendor":"ngtcp2","versions":[{"status":"affected","version":"< 1.22.1"}]}],"source":"security-advisories@github.com"},{"affectedData":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"defaultStatus":"affected","packageName":"samba","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.23.5-109.el10_2","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9","cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"affected","packageName":"samba","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:4.23.5-10.el9_8","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:hummingbird:1"],"defaultStatus":"affected","packageName":"ngtcp2-main","product":"Red Hat Hardened Images","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.22.1-1.hum1","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"nodejs22","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"],"defaultStatus":"unaffected","packageName":"nodejs24","product":"Red Hat Enterprise Linux 10","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"nodejs","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"nodejs:20/nodejs","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"nodejs:22/nodejs","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"],"defaultStatus":"unaffected","packageName":"nodejs:24/nodejs","product":"Red Hat Enterprise Linux 8","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"nodejs","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"nodejs:20/nodejs","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"nodejs:22/nodejs","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"],"defaultStatus":"unaffected","packageName":"nodejs:24/nodejs","product":"Red Hat Enterprise Linux 9","vendor":"Red Hat"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:tatsuhiro-t:ngtcp2:*:*:*:*:*:*:*:*","matchCriteriaId":"B3AC791C-E488-4CC7-B224-81E5D60AB493","versionEndExcluding":"1.22.1","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport parameters into a fixed 1024-byte stack buffer without bounds checking. When qlog is enabled, a remote peer can send sufficiently large transport parameters during the QUIC handshake to cause writes beyond the buffer boundary, resulting in a stack buffer overflow. This affects deployments that enable the qlog callback and process untrusted peer transport parameters. This issue has been fixed in version 1.22.1. If developers are unable to immediately upgrade, they can disable the qlog on client."},{"lang":"es","value":"ngtcp2 es una implementación en C del protocolo QUIC de la IETF. En versiones anteriores a la 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializa los parámetros de transporte del par en un búfer de pila fijo de 1024 bytes sin comprobación de límites. Cuando qlog está habilitado, un par remoto puede enviar parámetros de transporte suficientemente grandes durante el handshake QUIC para causar escrituras más allá del límite del búfer, lo que resulta en un desbordamiento de búfer de pila. Esto afecta a las implementaciones que habilitan la devolución de llamada de qlog y procesan parámetros de transporte de pares no confiables. Este problema ha sido solucionado en la versión 1.22.1. Si los desarrolladores no pueden actualizar de inmediato, pueden deshabilitar qlog en el cliente."}],"id":"CVE-2026-40170","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40170","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-17T14:52:12.292330Z","version":"2.0.3"}}]},"published":"2026-04-16T22:16:38.220","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/ngtcp2/ngtcp2/commit/708a7640c1f48fb8ffb540c4b8ea5b4c1dfb8ee5"},{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Patch","Vendor Advisory"],"url":"https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8f"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Mitigation","Patch","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/04/17/12"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:22963"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:25049"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/errata/RHSA-2026:9113"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://access.redhat.com/security/cve/CVE-2026-40170"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459061"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Patch","Vendor Advisory"],"url":"https://github.com/ngtcp2/ngtcp2/security/advisories/GHSA-f523-465f-8c8f"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40170.json"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"}],"source":"security-advisories@github.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-120"}],"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40254.json b/data/2026/CVE-2026-40254.json index 70ca8c0200..a829fcb744 100644 --- a/data/2026/CVE-2026-40254.json +++ b/data/2026/CVE-2026-40254.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"FreeRDP","vendor":"FreeRDP","versions":[{"status":"affected","version":"< 3.25.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*","matchCriteriaId":"290894D9-8CE7-4908-ACED-2E467A3D2B36","versionEndExcluding":"3.25.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/drive/client/drive_file.c`. The `contains_dotdot()` function catches `../` and `..\\` mid-path but misses `..` when it's the last component with no trailing separator. A rogue RDP server can read, list, or write files one directory above the client's shared folder through RDPDR requests. This requires the victim to connect with drive redirection enabled. Version 3.25.0 patches the issue."}],"id":"CVE-2026-40254","lastModified":"2026-06-17T10:44:55.020","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40254","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-24T12:06:14.883337Z","version":"2.0.3"}}]},"published":"2026-04-24T03:16:11.373","references":[{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"FreeRDP","vendor":"FreeRDP","versions":[{"status":"affected","version":"< 3.25.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*","matchCriteriaId":"290894D9-8CE7-4908-ACED-2E467A3D2B36","versionEndExcluding":"3.25.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeRDP is a free implementation of the Remote Desktop Protocol. Versions prior to 3.25.0 have an off-by-one in the path traversal filter in `channels/drive/client/drive_file.c`. The `contains_dotdot()` function catches `../` and `..\\` mid-path but misses `..` when it's the last component with no trailing separator. A rogue RDP server can read, list, or write files one directory above the client's shared folder through RDPDR requests. This requires the victim to connect with drive redirection enabled. Version 3.25.0 patches the issue."},{"lang":"es","value":"FreeRDP es una implementación gratuita del Protocolo de Escritorio Remoto. Versiones anteriores a la 3.25.0 tienen un error de ’off-by-one’ en el filtro de salto de ruta en ’channels/drive/client/drive_file.c’. La función ’contains_dotdot()’ detecta ’.. / ’ y ’.. / ’ a mitad de ruta, pero omite ’..’ cuando es el último componente sin un separador final. Un servidor RDP malicioso puede leer, listar o escribir archivos un directorio por encima de la carpeta compartida del cliente a través de solicitudes RDPDR. Esto requiere que la víctima se conecte con la redirección de unidades habilitada. La versión 3.25.0 corrige el problema."}],"id":"CVE-2026-40254","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40254","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-24T12:06:14.883337Z","version":"2.0.3"}}]},"published":"2026-04-24T03:16:11.373","references":[{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-193"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40264.json b/data/2026/CVE-2026-40264.json index 1fd4c8e9f4..ffc1339a9e 100644 --- a/data/2026/CVE-2026-40264.json +++ b/data/2026/CVE-2026-40264.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"openbao","vendor":"openbao","versions":[{"status":"affected","version":"< 2.5.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","matchCriteriaId":"FB9CD431-A4A7-47AC-8111-76D4F60A9D07","versionEndExcluding":"2.5.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3."}],"id":"CVE-2026-40264","lastModified":"2026-06-17T10:44:55.967","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40264","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T19:30:42.448978Z","version":"2.0.3"}}]},"published":"2026-04-21T01:16:06.917","references":[{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-p49j-v9wc-wg57"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1259"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"openbao","vendor":"openbao","versions":[{"status":"affected","version":"< 2.5.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*","matchCriteriaId":"FB9CD431-A4A7-47AC-8111-76D4F60A9D07","versionEndExcluding":"2.5.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao is an open source identity-based secrets management system. OpenBao's namespaces provide multi-tenant separation. Prior to version 2.5.3, a tenant who leaks token accessors can have their token revoked or renewed by a privileged administrator in another tenant. This is addressed in v2.5.3."},{"lang":"es","value":"OpenBao es un sistema de gestión de secretos de código abierto basado en identidad. Los espacios de nombres de OpenBao proporcionan separación multi-inquilino. Antes de la versión 2.5.3, un inquilino que filtra accesores de token puede ver su token revocado o renovado por un administrador privilegiado en otro inquilino. Esto se aborda en la v2.5.3."}],"id":"CVE-2026-40264","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.2,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":2.0,"baseSeverity":"LOW","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40264","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T19:30:42.448978Z","version":"2.0.3"}}]},"published":"2026-04-21T01:16:06.917","references":[{"source":"security-advisories@github.com","tags":["Vendor Advisory"],"url":"https://github.com/openbao/openbao/security/advisories/GHSA-p49j-v9wc-wg57"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-1259"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40279.json b/data/2026/CVE-2026-40279.json index 601ff0cf7b..d462169288 100644 --- a/data/2026/CVE-2026-40279.json +++ b/data/2026/CVE-2026-40279.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:*:*:*:*:*:*:*:*","matchCriteriaId":"B46C7C2C-2BC3-4A72-AEDC-746D4D76A2DE","versionEndExcluding":"1.4.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decode_signed32() in src/bacnet/bacint.c reconstructs a 32-bit signed integer from four APDU bytes using signed left shifts. When any of the four bytes has bit 7 set (value ≥ 0x80), the left-shift operation overflows a signed int32_t, which is undefined behavior per the C standard. This is flagged thousands of times per minute by UndefinedBehaviorSanitizer on any BACnet input containing signed-integer property values with high-bit-set bytes. This vulnerability is fixed in 1.4.3."}],"id":"CVE-2026-40279","lastModified":"2026-06-17T10:44:56.177","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40279","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T19:18:55.401000Z","version":"2.0.3"}}]},"published":"2026-04-21T17:16:54.853","references":[{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-326g-j95f-gmxv"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-326g-j95f-gmxv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-758"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"bacnet-stack","vendor":"bacnet-stack","versions":[{"status":"affected","version":"< 1.4.3"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:bacnetstack:bacnet_stack:*:*:*:*:*:*:*:*","matchCriteriaId":"B46C7C2C-2BC3-4A72-AEDC-746D4D76A2DE","versionEndExcluding":"1.4.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decode_signed32() in src/bacnet/bacint.c reconstructs a 32-bit signed integer from four APDU bytes using signed left shifts. When any of the four bytes has bit 7 set (value ≥ 0x80), the left-shift operation overflows a signed int32_t, which is undefined behavior per the C standard. This is flagged thousands of times per minute by UndefinedBehaviorSanitizer on any BACnet input containing signed-integer property values with high-bit-set bytes. This vulnerability is fixed in 1.4.3."},{"lang":"es","value":"BACnet Stack es una biblioteca C de pila de protocolo BACnet de código abierto para sistemas embebidos. Antes de la versión 1.4.3, decode_signed32() en src/bacnet/bacint.c reconstruye un entero con signo de 32 bits a partir de cuatro bytes APDU utilizando desplazamientos a la izquierda con signo. Cuando cualquiera de los cuatro bytes tiene el bit 7 activado (valor ? 0x80), la operación de desplazamiento a la izquierda desborda un int32_t con signo, lo cual es un comportamiento indefinido según el estándar C. Esto es marcado miles de veces por minuto por UndefinedBehaviorSanitizer en cualquier entrada BACnet que contenga valores de propiedad de enteros con signo con bytes con el bit alto activado. Esta vulnerabilidad está corregida en la versión 1.4.3."}],"id":"CVE-2026-40279","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":2.2,"impactScore":1.4,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40279","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T19:18:55.401000Z","version":"2.0.3"}}]},"published":"2026-04-21T17:16:54.853","references":[{"source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-326g-j95f-gmxv"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"],"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-326g-j95f-gmxv"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-758"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40281.json b/data/2026/CVE-2026-40281.json index 6866f75e9d..9f3473db91 100644 --- a/data/2026/CVE-2026-40281.json +++ b/data/2026/CVE-2026-40281.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"gotenberg","vendor":"gotenberg","versions":[{"status":"affected","version":"<= 8.30.1"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:thecodingmachine:gotenberg:*:*:*:*:*:*:*:*","matchCriteriaId":"953D4808-E728-472B-94E3-9714C1E2EA1C","versionEndExcluding":"8.31.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths."}],"id":"CVE-2026-40281","lastModified":"2026-06-17T10:44:56.397","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40281","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-07T12:32:33.631778Z","version":"2.0.3"}}]},"published":"2026-05-06T21:16:01.353","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/gotenberg/gotenberg/commit/405f1069c026bb08f319fb5a44e5c67c33208318"},{"source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"],"url":"https://github.com/gotenberg/gotenberg/security/advisories/GHSA-q7r4-hc83-hf2q"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"],"url":"https://github.com/gotenberg/gotenberg/security/advisories/GHSA-q7r4-hc83-hf2q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"gotenberg","vendor":"gotenberg","versions":[{"status":"affected","version":"<= 8.30.1"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:thecodingmachine:gotenberg:*:*:*:*:*:*:*:*","matchCriteriaId":"953D4808-E728-472B-94E3-9714C1E2EA1C","versionEndExcluding":"8.31.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, and -HardLink. This is a bypass of the incomplete key-sanitization fix introduced in v8.30.1. An unauthenticated attacker can rename or move any PDF being processed to an arbitrary path in the container filesystem, overwrite arbitrary files, or create symlinks and hard links at arbitrary paths."},{"lang":"es","value":"Gotenberg es una API sin estado impulsada por Docker para archivos PDF. En las versiones 8.30.1 y anteriores, el punto final de escritura de metadatos valida las claves de metadatos en busca de caracteres de control, pero deja los valores de metadatos sin sanear. Un carácter de nueva línea en un valor de metadatos divide la línea stdin de ExifTool en dos argumentos separados, permitiendo la inyección de pseudoetiquetas ExifTool arbitrarias como -FileName, -Directory, -SymLink y -HardLink. Esto es un bypass de la corrección incompleta de saneamiento de claves introducida en la v8.30.1. Un atacante no autenticado puede renombrar o mover cualquier PDF que esté siendo procesado a una ruta arbitraria en el sistema de archivos del contenedor, sobrescribir archivos arbitrarios o crear enlaces simbólicos y enlaces duros en rutas arbitrarias."}],"id":"CVE-2026-40281","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":10.0,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.8,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40281","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-05-07T12:32:33.631778Z","version":"2.0.3"}}]},"published":"2026-05-06T21:16:01.353","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/gotenberg/gotenberg/commit/405f1069c026bb08f319fb5a44e5c67c33208318"},{"source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"],"url":"https://github.com/gotenberg/gotenberg/security/advisories/GHSA-q7r4-hc83-hf2q"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"],"url":"https://github.com/gotenberg/gotenberg/security/advisories/GHSA-q7r4-hc83-hf2q"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-88"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40344.json b/data/2026/CVE-2026-40344.json index 95c9482bae..d1a3a23757 100644 --- a/data/2026/CVE-2026-40344.json +++ b/data/2026/CVE-2026-40344.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"minio","vendor":"minio","versions":[{"status":"affected","version":">= RELEASE.2023-05-18T00-05-36Z, < RELEASE.2026-04-11T03-20-12Z"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*","matchCriteriaId":"C63B131C-F150-4741-9A5B-181A55DE20B8","versionEndExcluding":"2026-04-11T03-20-12Z","versionStartIncluding":"2023-05-18t00-05-36z","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler (`PutObjectExtractHandler`) allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default `minioadmin`, or any key with WRITE permission on a bucket) and a target bucket name. When `authTypeStreamingUnsignedTrailer` support was added, the new auth type was handled in `PutObjectHandler` and `PutObjectPartHandler` but was never added to `PutObjectExtractHandler`. The snowball auto-extract handler's `switch rAuthType` block has no case for `authTypeStreamingUnsignedTrailer`, so execution falls through with zero signature verification. The `isPutActionAllowed` call before the switch extracts the access key and checks IAM permissions, but does not verify the cryptographic signature. An attacker sends a PUT request with `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER`, `X-Amz-Meta-Snowball-Auto-Extract: true`, and an `Authorization` header containing a valid access key with a completely fabricated signature. The request is accepted and the tar payload is extracted into the bucket. Users of the open-source minio/minio project should upgrade to MinIO AIStor RELEASE.2026-04-11T03-20-12Z or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER at the reverse proxy or WAF layer. Clients can use STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit s3:PutObject grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key."}],"id":"CVE-2026-40344","lastModified":"2026-06-17T10:45:09.290","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40344","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T17:54:45.957595Z","version":"2.0.3"}}]},"published":"2026-04-22T01:16:05.430","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091"},{"source":"security-advisories@github.com","tags":["Issue Tracking"],"url":"https://github.com/minio/minio/pull/16484"},{"source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"],"url":"https://github.com/minio/minio/security/advisories/GHSA-9c4q-hq6p-c237"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"minio","vendor":"minio","versions":[{"status":"affected","version":">= RELEASE.2023-05-18T00-05-36Z, < RELEASE.2026-04-11T03-20-12Z"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:minio:minio:*:*:*:*:*:*:*:*","matchCriteriaId":"C63B131C-F150-4741-9A5B-181A55DE20B8","versionEndExcluding":"2026-04-11T03-20-12Z","versionStartIncluding":"2023-05-18t00-05-36z","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler (`PutObjectExtractHandler`) allows any user who knows a valid access key to write arbitrary objects to any bucket without knowing the secret key or providing a valid cryptographic signature. Any MinIO deployment is impacted. The attack requires only a valid access key (the well-known default `minioadmin`, or any key with WRITE permission on a bucket) and a target bucket name. When `authTypeStreamingUnsignedTrailer` support was added, the new auth type was handled in `PutObjectHandler` and `PutObjectPartHandler` but was never added to `PutObjectExtractHandler`. The snowball auto-extract handler's `switch rAuthType` block has no case for `authTypeStreamingUnsignedTrailer`, so execution falls through with zero signature verification. The `isPutActionAllowed` call before the switch extracts the access key and checks IAM permissions, but does not verify the cryptographic signature. An attacker sends a PUT request with `X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER`, `X-Amz-Meta-Snowball-Auto-Extract: true`, and an `Authorization` header containing a valid access key with a completely fabricated signature. The request is accepted and the tar payload is extracted into the bucket. Users of the open-source minio/minio project should upgrade to MinIO AIStor RELEASE.2026-04-11T03-20-12Z or later. If upgrading is not immediately possible, block unsigned-trailer requests at the load balancer. Reject any request containing X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER at the reverse proxy or WAF layer. Clients can use STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER (the signed variant) instead. Alternatively, restrict WRITE permissions. Limit s3:PutObject grants to trusted principals. While this reduces the attack surface, it does not eliminate the vulnerability since any user with WRITE permission can exploit it with only their access key."},{"lang":"es","value":"MinIO es un sistema de almacenamiento de objetos de alto rendimiento. A partir de RELEASE.2023-05-18T00-05-36Z y antes de RELEASE.2026-04-11T03-20-12Z, una vulnerabilidad de omisión de autenticación en el gestor de autoextracción Snowball de MinIO (’PutObjectExtractHandler’) permite a cualquier usuario que conozca una clave de acceso válida escribir objetos arbitrarios en cualquier bucket sin conocer la clave secreta o proporcionar una firma criptográfica válida. Cualquier despliegue de MinIO está afectado. El ataque requiere solo una clave de acceso válida (el valor predeterminado conocido ’minioadmin’, o cualquier clave con permiso de ESCRITURA en un bucket) y un nombre de bucket de destino. Cuando se añadió el soporte para ’authTypeStreamingUnsignedTrailer’, el nuevo tipo de autenticación se manejó en ’PutObjectHandler’ y ’PutObjectPartHandler’ pero nunca se añadió a ’PutObjectExtractHandler’. El bloque ’switch rAuthType’ del gestor de autoextracción snowball no tiene un caso para ’authTypeStreamingUnsignedTrailer’, por lo que la ejecución continúa sin verificación de firma. La llamada ’isPutActionAllowed’ antes del switch extrae la clave de acceso y verifica los permisos de IAM, pero no verifica la firma criptográfica. Un atacante envía una solicitud PUT con ’X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER’, ’X-Amz-Meta-Snowball-Auto-Extract: true’, y un encabezado ’Authorization’ que contiene una clave de acceso válida con una firma completamente fabricada. La solicitud es aceptada y la carga útil tar se extrae en el bucket. Los usuarios del proyecto de código abierto minio/minio deberían actualizar a MinIO AIStor RELEASE.2026-04-11T03-20-12Z o posterior. Si la actualización no es posible de inmediato, bloquee las solicitudes de tráiler sin firmar en el balanceador de carga. Rechace cualquier solicitud que contenga X-Amz-Content-Sha256: STREAMING-UNSIGNED-PAYLOAD-TRAILER en el proxy inverso o la capa WAF. Los clientes pueden usar STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER (la variante firmada) en su lugar. Alternativamente, restrinja los permisos de ESCRITURA. Limite las concesiones s3:PutObject a principales de confianza. Si bien esto reduce la superficie de ataque, no elimina la vulnerabilidad ya que cualquier usuario con permiso de ESCRITURA puede explotarla con solo su clave de acceso."}],"id":"CVE-2026-40344","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":4.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40344","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-22T17:54:45.957595Z","version":"2.0.3"}}]},"published":"2026-04-22T01:16:05.430","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/minio/minio/commit/76913a9fd5c6e5c2dbd4e8c7faf56ed9e9e24091"},{"source":"security-advisories@github.com","tags":["Issue Tracking"],"url":"https://github.com/minio/minio/pull/16484"},{"source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"],"url":"https://github.com/minio/minio/security/advisories/GHSA-9c4q-hq6p-c237"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40496.json b/data/2026/CVE-2026-40496.json index 8d974d6117..e3db08b9fb 100644 --- a/data/2026/CVE-2026-40496.json +++ b/data/2026/CVE-2026-40496.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"freescout","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.213"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*","matchCriteriaId":"EA97ED0A-4886-4583-9D20-47BE39C40B01","versionEndExcluding":"1.8.213","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using a weak and predictable formula: `md5(APP_KEY + attachment_id + size)`. Since attachment_id is sequential and size can be brute-forced in a small range, an unauthenticated attacker can forge valid tokens and download any private attachment without credentials. Version 1.8.213 fixes the issue."}],"id":"CVE-2026-40496","lastModified":"2026-06-17T10:45:22.987","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40496","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T13:50:26.236611Z","version":"2.0.3"}}]},"published":"2026-04-21T02:16:08.350","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/freescout-help-desk/freescout/commit/dbdf8f2260b43a21818255c70f0b61b9de9cd555"},{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2783-wxmm-wmwr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"},{"lang":"en","value":"CWE-340"}],"source":"security-advisories@github.com","type":"Secondary"}]} +{"affected":[{"affectedData":[{"product":"freescout","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.213"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*","matchCriteriaId":"EA97ED0A-4886-4583-9D20-47BE39C40B01","versionEndExcluding":"1.8.213","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, attachment download tokens are generated using a weak and predictable formula: `md5(APP_KEY + attachment_id + size)`. Since attachment_id is sequential and size can be brute-forced in a small range, an unauthenticated attacker can forge valid tokens and download any private attachment without credentials. Version 1.8.213 fixes the issue."},{"lang":"es","value":"FreeScout es un sistema de mesa de ayuda y buzón compartido autoalojado gratuito. Antes de la versión 1.8.213, los tokens de descarga de archivos adjuntos se generan utilizando una fórmula débil y predecible: “md5(APP_KEY + attachment_id + size)”. Dado que attachment_id es secuencial y size puede ser forzado por fuerza bruta en un rango pequeño, un atacante no autenticado puede falsificar tokens válidos y descargar cualquier archivo adjunto privado sin credenciales. La versión 1.8.213 corrige el problema."}],"id":"CVE-2026-40496","lastModified":"2026-11-11T23:10:00.263","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.8,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-40496","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-21T13:50:26.236611Z","version":"2.0.3"}}]},"published":"2026-04-21T02:16:08.350","references":[{"source":"security-advisories@github.com","tags":["Patch"],"url":"https://github.com/freescout-help-desk/freescout/commit/dbdf8f2260b43a21818255c70f0b61b9de9cd555"},{"source":"security-advisories@github.com","tags":["Release Notes"],"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.213"},{"source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-2783-wxmm-wmwr"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-330"},{"lang":"en","value":"CWE-340"}],"source":"security-advisories@github.com","type":"Secondary"}]} diff --git a/data/2026/CVE-2026-40497.json b/data/2026/CVE-2026-40497.json index b364908f49..d035aad49b 100644 --- a/data/2026/CVE-2026-40497.json +++ b/data/2026/CVE-2026-40497.json @@ -1 +1 @@ -{"affected":[{"affectedData":[{"product":"freescout","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.213"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:freescout:freescout:*:*:*:*:*:*:*:*","matchCriteriaId":"EA97ED0A-4886-4583-9D20-47BE39C40B01","versionEndExcluding":"1.8.213","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, FreeScout's `Helper::stripDangerousTags()` removes `