Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1374
Vulnerability from certfr_avis - Published: 2026-10-23 - Updated: 2026-10-23
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian 13 trixie versions ant\u00e9rieures \u00e0 6.12.113-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-98190",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98190"
},
{
"name": "CVE-2026-98302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98302"
},
{
"name": "CVE-2026-89797",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89797"
},
{
"name": "CVE-2026-98311",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98311"
},
{
"name": "CVE-2026-97536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97536"
},
{
"name": "CVE-2026-98179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98179"
},
{
"name": "CVE-2026-93199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93199"
},
{
"name": "CVE-2026-98325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98325"
},
{
"name": "CVE-2026-98266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98266"
},
{
"name": "CVE-2026-98187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98187"
},
{
"name": "CVE-2026-97537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97537"
},
{
"name": "CVE-2026-98287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98287"
},
{
"name": "CVE-2026-98339",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98339"
},
{
"name": "CVE-2026-98260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98260"
},
{
"name": "CVE-2026-98239",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98239"
},
{
"name": "CVE-2026-98335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98335"
},
{
"name": "CVE-2026-98295",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98295"
},
{
"name": "CVE-2026-98214",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98214"
},
{
"name": "CVE-2026-97609",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97609"
},
{
"name": "CVE-2026-98272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98272"
},
{
"name": "CVE-2026-98430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98430"
},
{
"name": "CVE-2026-98283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98283"
},
{
"name": "CVE-2026-98306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98306"
},
{
"name": "CVE-2026-98336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98336"
},
{
"name": "CVE-2026-98217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98217"
},
{
"name": "CVE-2026-89972",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89972"
},
{
"name": "CVE-2026-98264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98264"
},
{
"name": "CVE-2026-93243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93243"
},
{
"name": "CVE-2026-97531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97531"
},
{
"name": "CVE-2026-81016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-81016"
},
{
"name": "CVE-2026-98426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98426"
},
{
"name": "CVE-2026-89838",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89838"
},
{
"name": "CVE-2026-89638",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89638"
},
{
"name": "CVE-2026-98365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98365"
},
{
"name": "CVE-2026-90013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90013"
},
{
"name": "CVE-2026-98262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98262"
},
{
"name": "CVE-2026-98257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98257"
},
{
"name": "CVE-2026-98207",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98207"
},
{
"name": "CVE-2026-97906",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97906"
},
{
"name": "CVE-2026-98359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98359"
},
{
"name": "CVE-2026-98173",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98173"
},
{
"name": "CVE-2026-98346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98346"
},
{
"name": "CVE-2026-98255",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98255"
},
{
"name": "CVE-2026-98326",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98326"
},
{
"name": "CVE-2026-89467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89467"
},
{
"name": "CVE-2026-98362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98362"
},
{
"name": "CVE-2026-98347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98347"
},
{
"name": "CVE-2026-89868",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89868"
},
{
"name": "CVE-2026-89840",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89840"
},
{
"name": "CVE-2026-89832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89832"
},
{
"name": "CVE-2026-98193",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98193"
},
{
"name": "CVE-2026-98377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98377"
},
{
"name": "CVE-2026-89527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89527"
},
{
"name": "CVE-2026-98378",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98378"
},
{
"name": "CVE-2026-89806",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89806"
},
{
"name": "CVE-2026-98161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98161"
},
{
"name": "CVE-2026-98345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98345"
},
{
"name": "CVE-2026-98253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98253"
},
{
"name": "CVE-2026-98354",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98354"
},
{
"name": "CVE-2026-98247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98247"
},
{
"name": "CVE-2026-98322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98322"
},
{
"name": "CVE-2026-98200",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98200"
},
{
"name": "CVE-2026-98429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98429"
},
{
"name": "CVE-2026-98263",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98263"
},
{
"name": "CVE-2026-97919",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97919"
},
{
"name": "CVE-2026-98230",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98230"
},
{
"name": "CVE-2026-98331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98331"
},
{
"name": "CVE-2026-98303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98303"
},
{
"name": "CVE-2026-98175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98175"
},
{
"name": "CVE-2026-98238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98238"
},
{
"name": "CVE-2026-97603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97603"
},
{
"name": "CVE-2026-98409",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98409"
},
{
"name": "CVE-2026-98231",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98231"
},
{
"name": "CVE-2026-98375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98375"
},
{
"name": "CVE-2026-98205",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98205"
},
{
"name": "CVE-2026-98269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98269"
},
{
"name": "CVE-2026-98320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98320"
},
{
"name": "CVE-2026-90029",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90029"
},
{
"name": "CVE-2026-98352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98352"
},
{
"name": "CVE-2026-99999",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99999"
},
{
"name": "CVE-2026-97594",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97594"
},
{
"name": "CVE-2026-98351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98351"
},
{
"name": "CVE-2026-98171",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98171"
},
{
"name": "CVE-2026-90023",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90023"
},
{
"name": "CVE-2026-98300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98300"
},
{
"name": "CVE-2026-80935",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80935"
},
{
"name": "CVE-2026-98329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98329"
},
{
"name": "CVE-2026-98252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98252"
},
{
"name": "CVE-2026-98312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98312"
},
{
"name": "CVE-2026-98316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98316"
},
{
"name": "CVE-2026-98291",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98291"
},
{
"name": "CVE-2026-89956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89956"
},
{
"name": "CVE-2026-98421",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98421"
},
{
"name": "CVE-2026-98222",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98222"
},
{
"name": "CVE-2026-98314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98314"
},
{
"name": "CVE-2026-89859",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89859"
},
{
"name": "CVE-2026-98227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98227"
},
{
"name": "CVE-2026-98342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98342"
},
{
"name": "CVE-2026-98182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98182"
},
{
"name": "CVE-2026-98245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98245"
},
{
"name": "CVE-2026-98432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98432"
},
{
"name": "CVE-2026-97534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97534"
},
{
"name": "CVE-2026-98403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98403"
},
{
"name": "CVE-2026-98383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98383"
},
{
"name": "CVE-2026-98360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98360"
},
{
"name": "CVE-2026-89503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89503"
},
{
"name": "CVE-2026-98358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98358"
},
{
"name": "CVE-2026-97918",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97918"
},
{
"name": "CVE-2026-98172",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98172"
},
{
"name": "CVE-2026-97532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97532"
},
{
"name": "CVE-2026-98210",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98210"
},
{
"name": "CVE-2026-98366",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98366"
},
{
"name": "CVE-2026-98410",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98410"
},
{
"name": "CVE-2026-98186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98186"
},
{
"name": "CVE-2026-80937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80937"
},
{
"name": "CVE-2026-98174",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98174"
},
{
"name": "CVE-2026-98290",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98290"
},
{
"name": "CVE-2026-90030",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90030"
},
{
"name": "CVE-2026-98184",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98184"
},
{
"name": "CVE-2026-97528",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97528"
},
{
"name": "CVE-2026-97549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97549"
},
{
"name": "CVE-2026-90146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90146"
},
{
"name": "CVE-2026-98206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98206"
},
{
"name": "CVE-2026-98428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98428"
},
{
"name": "CVE-2026-97619",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97619"
},
{
"name": "CVE-2026-97935",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97935"
},
{
"name": "CVE-2026-98386",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98386"
},
{
"name": "CVE-2026-98185",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98185"
},
{
"name": "CVE-2026-98369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98369"
},
{
"name": "CVE-2026-97597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97597"
},
{
"name": "CVE-2026-52988",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52988"
},
{
"name": "CVE-2026-98168",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98168"
},
{
"name": "CVE-2026-98348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98348"
},
{
"name": "CVE-2026-98202",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98202"
},
{
"name": "CVE-2026-98251",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98251"
},
{
"name": "CVE-2026-98406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98406"
},
{
"name": "CVE-2026-97558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97558"
},
{
"name": "CVE-2026-98270",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98270"
},
{
"name": "CVE-2026-98189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98189"
},
{
"name": "CVE-2026-97559",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97559"
},
{
"name": "CVE-2026-89437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89437"
},
{
"name": "CVE-2026-98201",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98201"
},
{
"name": "CVE-2026-98265",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98265"
},
{
"name": "CVE-2026-93179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93179"
},
{
"name": "CVE-2026-89827",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89827"
},
{
"name": "CVE-2026-97950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97950"
},
{
"name": "CVE-2026-80980",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80980"
},
{
"name": "CVE-2026-98198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98198"
},
{
"name": "CVE-2026-72463",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72463"
},
{
"name": "CVE-2026-98233",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98233"
},
{
"name": "CVE-2026-98416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98416"
},
{
"name": "CVE-2026-98261",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98261"
},
{
"name": "CVE-2026-93285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93285"
},
{
"name": "CVE-2026-97901",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97901"
},
{
"name": "CVE-2026-89441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89441"
},
{
"name": "CVE-2026-98423",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98423"
},
{
"name": "CVE-2026-98169",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98169"
},
{
"name": "CVE-2026-98327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98327"
},
{
"name": "CVE-2025-40158",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40158"
},
{
"name": "CVE-2026-98271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98271"
},
{
"name": "CVE-2026-98344",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98344"
},
{
"name": "CVE-2026-98422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98422"
},
{
"name": "CVE-2026-98411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98411"
},
{
"name": "CVE-2026-93196",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93196"
},
{
"name": "CVE-2026-98340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98340"
},
{
"name": "CVE-2026-98309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98309"
},
{
"name": "CVE-2026-98196",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98196"
},
{
"name": "CVE-2026-98191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98191"
},
{
"name": "CVE-2026-98373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98373"
},
{
"name": "CVE-2026-89500",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89500"
},
{
"name": "CVE-2026-98235",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98235"
},
{
"name": "CVE-2026-97933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97933"
},
{
"name": "CVE-2026-98334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98334"
},
{
"name": "CVE-2026-98379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98379"
},
{
"name": "CVE-2026-97529",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97529"
},
{
"name": "CVE-2026-98241",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98241"
},
{
"name": "CVE-2026-98343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98343"
},
{
"name": "CVE-2026-98425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98425"
},
{
"name": "CVE-2026-98412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98412"
},
{
"name": "CVE-2026-98308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98308"
},
{
"name": "CVE-2026-90002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90002"
},
{
"name": "CVE-2026-97566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97566"
},
{
"name": "CVE-2026-98298",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98298"
},
{
"name": "CVE-2026-98167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98167"
},
{
"name": "CVE-2026-98276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98276"
},
{
"name": "CVE-2026-98236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98236"
},
{
"name": "CVE-2026-89912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89912"
},
{
"name": "CVE-2026-98199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98199"
},
{
"name": "CVE-2026-98381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98381"
},
{
"name": "CVE-2026-98282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98282"
},
{
"name": "CVE-2026-98211",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98211"
},
{
"name": "CVE-2026-98229",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98229"
},
{
"name": "CVE-2026-98307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98307"
},
{
"name": "CVE-2026-98368",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98368"
},
{
"name": "CVE-2026-98234",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98234"
},
{
"name": "CVE-2026-98204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98204"
},
{
"name": "CVE-2026-97567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97567"
},
{
"name": "CVE-2026-98380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98380"
},
{
"name": "CVE-2026-98370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98370"
},
{
"name": "CVE-2026-98323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98323"
},
{
"name": "CVE-2026-98203",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98203"
},
{
"name": "CVE-2026-98384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98384"
},
{
"name": "CVE-2026-98297",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98297"
},
{
"name": "CVE-2026-98367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98367"
},
{
"name": "CVE-2026-89766",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89766"
},
{
"name": "CVE-2026-98215",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98215"
},
{
"name": "CVE-2026-98337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98337"
},
{
"name": "CVE-2026-97934",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97934"
},
{
"name": "CVE-2026-98413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98413"
},
{
"name": "CVE-2026-98197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98197"
},
{
"name": "CVE-2026-90016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90016"
},
{
"name": "CVE-2026-89445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89445"
},
{
"name": "CVE-2026-74347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74347"
},
{
"name": "CVE-2026-93244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93244"
},
{
"name": "CVE-2026-98237",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98237"
},
{
"name": "CVE-2026-89633",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89633"
},
{
"name": "CVE-2026-98221",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98221"
},
{
"name": "CVE-2026-98363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98363"
},
{
"name": "CVE-2026-97571",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97571"
},
{
"name": "CVE-2026-97535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97535"
},
{
"name": "CVE-2026-98170",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98170"
},
{
"name": "CVE-2026-98301",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98301"
},
{
"name": "CVE-2026-98213",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98213"
},
{
"name": "CVE-2026-98419",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98419"
},
{
"name": "CVE-2026-98299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98299"
},
{
"name": "CVE-2026-89795",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89795"
},
{
"name": "CVE-2026-98293",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98293"
},
{
"name": "CVE-2026-98417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98417"
},
{
"name": "CVE-2026-98232",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98232"
},
{
"name": "CVE-2026-72315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-72315"
},
{
"name": "CVE-2026-93231",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93231"
},
{
"name": "CVE-2026-98192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98192"
},
{
"name": "CVE-2026-80939",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80939"
},
{
"name": "CVE-2026-97949",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97949"
},
{
"name": "CVE-2026-98101",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98101"
},
{
"name": "CVE-2026-97620",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97620"
},
{
"name": "CVE-2026-98212",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98212"
},
{
"name": "CVE-2026-97939",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97939"
},
{
"name": "CVE-2026-98407",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98407"
},
{
"name": "CVE-2026-89921",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89921"
},
{
"name": "CVE-2026-98246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98246"
},
{
"name": "CVE-2026-98374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98374"
},
{
"name": "CVE-2026-89452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89452"
},
{
"name": "CVE-2026-98209",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98209"
},
{
"name": "CVE-2026-97527",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97527"
},
{
"name": "CVE-2026-98275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98275"
},
{
"name": "CVE-2026-98195",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98195"
},
{
"name": "CVE-2026-89520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89520"
},
{
"name": "CVE-2026-98267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98267"
},
{
"name": "CVE-2026-98181",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98181"
},
{
"name": "CVE-2026-98349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98349"
},
{
"name": "CVE-2026-97530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97530"
},
{
"name": "CVE-2026-98188",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98188"
},
{
"name": "CVE-2026-98382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98382"
},
{
"name": "CVE-2026-97618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97618"
},
{
"name": "CVE-2026-98328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98328"
},
{
"name": "CVE-2026-98357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98357"
},
{
"name": "CVE-2026-98319",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98319"
},
{
"name": "CVE-2026-89837",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89837"
},
{
"name": "CVE-2025-38204",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38204"
},
{
"name": "CVE-2026-98249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98249"
},
{
"name": "CVE-2026-98216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98216"
},
{
"name": "CVE-2026-98218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98218"
},
{
"name": "CVE-2026-98248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98248"
},
{
"name": "CVE-2026-89996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89996"
},
{
"name": "CVE-2026-97615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97615"
},
{
"name": "CVE-2026-98194",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98194"
},
{
"name": "CVE-2026-98208",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98208"
},
{
"name": "CVE-2026-97574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97574"
},
{
"name": "CVE-2026-89971",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89971"
},
{
"name": "CVE-2026-97938",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97938"
},
{
"name": "CVE-2026-93200",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93200"
},
{
"name": "CVE-2026-98254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98254"
}
],
"initial_release_date": "2026-10-23T00:00:00",
"last_revision_date": "2026-10-23T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1374",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-23T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-10-16",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00482",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00482.html"
}
]
}
CVE-2026-98345 (GCVE-0-2026-98345)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
wifi: cfg80211: check IP header size in cfg80211_classify8021d()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: check IP header size in cfg80211_classify8021d()
A frame that looks like IP can be transmitted, but be too short, so
the DS field is read incorrectly:
BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027
cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027
ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180
__ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304
ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538
...
packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108
Use skb_header_pointer() like the MPLS case.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 , < 18d5547327c202cda33ad2bbd203220c2c62c8a7
(git)
Affected: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 , < 3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734 (git) Affected: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 , < c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7 (git) Affected: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 , < 12c0abd4d1c1b04a7663d04ba85268bc9ad9c017 (git) Affected: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 , < f33ad4e2f846e55cf4637419268f093ac9f1a765 (git) Affected: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 , < a2cdb4a675ca04c4ac8cc962848082d8ce065008 (git) Affected: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 , < 65893c8d28f239c7ddad5a83683be193a9133e9b (git) Affected: e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 , < 48b2c5c628b09cf36cbeca53e0432fc2a7518be7 (git) |
|
| Linux | Linux |
Affected:
2.6.31
Unaffected: 0 , < 2.6.31 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18d5547327c202cda33ad2bbd203220c2c62c8a7",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "12c0abd4d1c1b04a7663d04ba85268bc9ad9c017",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "f33ad4e2f846e55cf4637419268f093ac9f1a765",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "a2cdb4a675ca04c4ac8cc962848082d8ce065008",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "65893c8d28f239c7ddad5a83683be193a9133e9b",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
},
{
"lessThan": "48b2c5c628b09cf36cbeca53e0432fc2a7518be7",
"status": "affected",
"version": "e31a16d6f64ef0e324c6f54d5112703c3f13a9c4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: check IP header size in cfg80211_classify8021d()\n\nA frame that looks like IP can be transmitted, but be too short, so\nthe DS field is read incorrectly:\n\n BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027\n cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027\n ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180\n __ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304\n ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538\n ...\n packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108\n\nUse skb_header_pointer() like the MPLS case."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:34.719Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18d5547327c202cda33ad2bbd203220c2c62c8a7"
},
{
"url": "https://git.kernel.org/stable/c/3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734"
},
{
"url": "https://git.kernel.org/stable/c/c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7"
},
{
"url": "https://git.kernel.org/stable/c/12c0abd4d1c1b04a7663d04ba85268bc9ad9c017"
},
{
"url": "https://git.kernel.org/stable/c/f33ad4e2f846e55cf4637419268f093ac9f1a765"
},
{
"url": "https://git.kernel.org/stable/c/a2cdb4a675ca04c4ac8cc962848082d8ce065008"
},
{
"url": "https://git.kernel.org/stable/c/65893c8d28f239c7ddad5a83683be193a9133e9b"
},
{
"url": "https://git.kernel.org/stable/c/48b2c5c628b09cf36cbeca53e0432fc2a7518be7"
}
],
"title": "wifi: cfg80211: check IP header size in cfg80211_classify8021d()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98345",
"datePublished": "2026-10-06T08:46:34.719Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-06T08:46:34.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98346 (GCVE-0-2026-98346)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
wifi: cfg80211: don't get the radio mask for netdev-less wdevs
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: don't get the radio mask for netdev-less wdevs
cfg80211_calculate_bi_data() calls rdev_get_radio_mask() with
wdev->netdev, which can be NULL and then crashes in mac80211.
To avoid that, invert the order of checks since wdev->netdev
is always valid for beaconing interfaces.
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
abb4cfe3661aa05426916b21164f88ca5a405a3a , < 5b313159c970e945ee125ca87fad0d96ed913e55
(git)
Affected: abb4cfe3661aa05426916b21164f88ca5a405a3a , < 693d777846d525b8b218bad97a1befa5d9bd4334 (git) Affected: abb4cfe3661aa05426916b21164f88ca5a405a3a , < 7166da84a7fe3553f9065782fd80299a37b150e5 (git) Affected: abb4cfe3661aa05426916b21164f88ca5a405a3a , < a7783e585360ee05dfe21d3173dbbe985c94f29e (git) |
|
| Linux | Linux |
Affected:
6.11
Unaffected: 0 , < 6.11 (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5b313159c970e945ee125ca87fad0d96ed913e55",
"status": "affected",
"version": "abb4cfe3661aa05426916b21164f88ca5a405a3a",
"versionType": "git"
},
{
"lessThan": "693d777846d525b8b218bad97a1befa5d9bd4334",
"status": "affected",
"version": "abb4cfe3661aa05426916b21164f88ca5a405a3a",
"versionType": "git"
},
{
"lessThan": "7166da84a7fe3553f9065782fd80299a37b150e5",
"status": "affected",
"version": "abb4cfe3661aa05426916b21164f88ca5a405a3a",
"versionType": "git"
},
{
"lessThan": "a7783e585360ee05dfe21d3173dbbe985c94f29e",
"status": "affected",
"version": "abb4cfe3661aa05426916b21164f88ca5a405a3a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: don\u0027t get the radio mask for netdev-less wdevs\n\ncfg80211_calculate_bi_data() calls rdev_get_radio_mask() with\nwdev-\u003enetdev, which can be NULL and then crashes in mac80211.\n\nTo avoid that, invert the order of checks since wdev-\u003enetdev\nis always valid for beaconing interfaces."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:35.409Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5b313159c970e945ee125ca87fad0d96ed913e55"
},
{
"url": "https://git.kernel.org/stable/c/693d777846d525b8b218bad97a1befa5d9bd4334"
},
{
"url": "https://git.kernel.org/stable/c/7166da84a7fe3553f9065782fd80299a37b150e5"
},
{
"url": "https://git.kernel.org/stable/c/a7783e585360ee05dfe21d3173dbbe985c94f29e"
}
],
"title": "wifi: cfg80211: don\u0027t get the radio mask for netdev-less wdevs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98346",
"datePublished": "2026-10-06T08:46:35.409Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-06T08:46:35.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98347 (GCVE-0-2026-98347)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
IB/IPoIB: Avoid restoring OPER_UP after multicast flush
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/IPoIB: Avoid restoring OPER_UP after multicast flush
ipoib_ib_dev_flush_light() temporarily clears IPOIB_FLAG_OPER_UP to
prevent multicast joins while ipoib_mcast_dev_flush() is running, and
restores the flag afterwards if it was previously set.
This restore races with ipoib_ib_dev_down(). If the interface is brought
down while the flush is in progress, ipoib_ib_dev_down() clears
IPOIB_FLAG_OPER_UP, but the flush path may set it again after the device
has already gone down.
Since commit 894021a75291 ("IB/ipoib: Make the carrier_on_task race
aware"), ipoib_mcast_carrier_on_task() relies on IPOIB_FLAG_OPER_UP
being cleared to terminate its rtnl_trylock() retry loop. If the flag is
left set after shutdown, the workqueue retries forever, causing teardown
to deadlock when ipoib_ndo_uninit() waits in destroy_workqueue() while
holding RTNL.
Instead of overloading IPOIB_FLAG_OPER_UP to block multicast joins
during a light flush, introduce a dedicated IPOIB_FLAG_MCAST_FLUSH flag.
Use it together with IPOIB_FLAG_OPER_UP to determine whether multicast
joins are allowed, avoiding the race with device shutdown.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
344bacca8cd811809fc33a249f2738ab757d327f , < f973769fb7cb33ba0d4a64b7dcfee0cabaead938
(git)
Affected: 344bacca8cd811809fc33a249f2738ab757d327f , < b72f38929f4b5aa83161fd3b22a7327207e51ec5 (git) Affected: 344bacca8cd811809fc33a249f2738ab757d327f , < 1b11e4b55b41d9e69a8e8d07622614202e2eaca9 (git) Affected: 344bacca8cd811809fc33a249f2738ab757d327f , < 326f7d34bd7e64de535566b65c0533b640df5a81 (git) Affected: 344bacca8cd811809fc33a249f2738ab757d327f , < 5ad925d45f28464a5e043c9620880bb6a030da89 (git) Affected: 344bacca8cd811809fc33a249f2738ab757d327f , < 188b334a6db36a8e0bfaaf59bc4020639a0f3aad (git) Affected: 344bacca8cd811809fc33a249f2738ab757d327f , < 1ff3add37c329704ec46181b4ae4f00f9f16ce6f (git) Affected: 344bacca8cd811809fc33a249f2738ab757d327f , < 9a141d3dc869d18b2eab35e999f4790a9b84e40f (git) Affected: a289c65ca49d2680a3d797e633e57a45573d1df2 (git) Affected: b81459c78935e4579a577b2366c5f8878d3c7fee (git) Affected: 8a9d8dc9ce83a90bfbbe69181acc4cf1beff46f5 (git) Affected: dfe809702a11bd7fb91c882fb55620e39ce22109 (git) Affected: 87160fb51bc343793cc8f5f031a87f1a35aecb82 (git) Affected: 749fd55dd210f9676f0d445a6efaaa3bec65174a (git) Affected: 3.2.84 , < 3.3 (semver) Affected: 3.10.105 , < 3.11 (semver) Affected: 3.12.65 , < 3.13 (semver) Affected: 3.16.39 , < 3.17 (semver) Affected: 4.4.24 , < 4.5 (semver) Affected: 4.7.7 , < 4.8 (semver) |
|
| Linux | Linux |
Affected:
4.8
Unaffected: 0 , < 4.8 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/ipoib/ipoib.h",
"drivers/infiniband/ulp/ipoib/ipoib_ib.c",
"drivers/infiniband/ulp/ipoib/ipoib_multicast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f973769fb7cb33ba0d4a64b7dcfee0cabaead938",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "b72f38929f4b5aa83161fd3b22a7327207e51ec5",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "1b11e4b55b41d9e69a8e8d07622614202e2eaca9",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "326f7d34bd7e64de535566b65c0533b640df5a81",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "5ad925d45f28464a5e043c9620880bb6a030da89",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "188b334a6db36a8e0bfaaf59bc4020639a0f3aad",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "1ff3add37c329704ec46181b4ae4f00f9f16ce6f",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"lessThan": "9a141d3dc869d18b2eab35e999f4790a9b84e40f",
"status": "affected",
"version": "344bacca8cd811809fc33a249f2738ab757d327f",
"versionType": "git"
},
{
"status": "affected",
"version": "a289c65ca49d2680a3d797e633e57a45573d1df2",
"versionType": "git"
},
{
"status": "affected",
"version": "b81459c78935e4579a577b2366c5f8878d3c7fee",
"versionType": "git"
},
{
"status": "affected",
"version": "8a9d8dc9ce83a90bfbbe69181acc4cf1beff46f5",
"versionType": "git"
},
{
"status": "affected",
"version": "dfe809702a11bd7fb91c882fb55620e39ce22109",
"versionType": "git"
},
{
"status": "affected",
"version": "87160fb51bc343793cc8f5f031a87f1a35aecb82",
"versionType": "git"
},
{
"status": "affected",
"version": "749fd55dd210f9676f0d445a6efaaa3bec65174a",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.84",
"versionType": "semver"
},
{
"lessThan": "3.11",
"status": "affected",
"version": "3.10.105",
"versionType": "semver"
},
{
"lessThan": "3.13",
"status": "affected",
"version": "3.12.65",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.39",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.24",
"versionType": "semver"
},
{
"lessThan": "4.8",
"status": "affected",
"version": "4.7.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/ipoib/ipoib.h",
"drivers/infiniband/ulp/ipoib/ipoib_ib.c",
"drivers/infiniband/ulp/ipoib/ipoib_multicast.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.105",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.12.65",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.7.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/IPoIB: Avoid restoring OPER_UP after multicast flush\n\nipoib_ib_dev_flush_light() temporarily clears IPOIB_FLAG_OPER_UP to\nprevent multicast joins while ipoib_mcast_dev_flush() is running, and\nrestores the flag afterwards if it was previously set.\n\nThis restore races with ipoib_ib_dev_down(). If the interface is brought\ndown while the flush is in progress, ipoib_ib_dev_down() clears\nIPOIB_FLAG_OPER_UP, but the flush path may set it again after the device\nhas already gone down.\n\nSince commit 894021a75291 (\"IB/ipoib: Make the carrier_on_task race\naware\"), ipoib_mcast_carrier_on_task() relies on IPOIB_FLAG_OPER_UP\nbeing cleared to terminate its rtnl_trylock() retry loop. If the flag is\nleft set after shutdown, the workqueue retries forever, causing teardown\nto deadlock when ipoib_ndo_uninit() waits in destroy_workqueue() while\nholding RTNL.\n\nInstead of overloading IPOIB_FLAG_OPER_UP to block multicast joins\nduring a light flush, introduce a dedicated IPOIB_FLAG_MCAST_FLUSH flag.\nUse it together with IPOIB_FLAG_OPER_UP to determine whether multicast\njoins are allowed, avoiding the race with device shutdown."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:36.136Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f973769fb7cb33ba0d4a64b7dcfee0cabaead938"
},
{
"url": "https://git.kernel.org/stable/c/b72f38929f4b5aa83161fd3b22a7327207e51ec5"
},
{
"url": "https://git.kernel.org/stable/c/1b11e4b55b41d9e69a8e8d07622614202e2eaca9"
},
{
"url": "https://git.kernel.org/stable/c/326f7d34bd7e64de535566b65c0533b640df5a81"
},
{
"url": "https://git.kernel.org/stable/c/5ad925d45f28464a5e043c9620880bb6a030da89"
},
{
"url": "https://git.kernel.org/stable/c/188b334a6db36a8e0bfaaf59bc4020639a0f3aad"
},
{
"url": "https://git.kernel.org/stable/c/1ff3add37c329704ec46181b4ae4f00f9f16ce6f"
},
{
"url": "https://git.kernel.org/stable/c/9a141d3dc869d18b2eab35e999f4790a9b84e40f"
}
],
"title": "IB/IPoIB: Avoid restoring OPER_UP after multicast flush",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98347",
"datePublished": "2026-10-06T08:46:36.136Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-06T08:46:36.136Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98348 (GCVE-0-2026-98348)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
wifi: libipw: reject too-short association responses
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: libipw: reject too-short association responses
libipw_handle_assoc_resp() reads the capability, status and aid fields
of the 30-byte association response prefix and then computes the
information element length as
stats->len - sizeof(*frame)
stats->len is a u16 and sizeof() has type size_t, so the subtraction is
evaluated as size_t and wraps instead of going negative. Truncating
that to the u16 length parameter of libipw_parse_info_param() turns a
frame shorter than the fixed fields into a length near 64 KiB, and the
parser then reads past the receive buffer.
Both the ipw2100 and ipw2200 management receive paths reach this
function having established only that the frame carries the generic
24-byte three-address header.
Reject the frame before any fixed field is touched.
Found by an AI-assisted review of length arithmetic in management frame
parsers. Verified with a KUnit case under Generic KASAN on arm64 under
QEMU; I do not have the hardware, so it is not tested on a real device.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
9e8571affd1c54b9638b4ff9844e47aae07310f6 , < 766268b429ae26d8ca599031fa962b0fe4673120
(git)
Affected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 , < d70bdb84cf1782039384c1ffa7a18b0303c286a7 (git) Affected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 , < 400b89217058fac672134a0d4092c8493dadb8ad (git) Affected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 , < 46aa75291056b6dc5faaf956dffdb3e9662477b0 (git) Affected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 , < e3025ecdb2057f866c09e059fc1466e81d6f243e (git) Affected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 , < 14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb (git) Affected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 , < af1b69be19c34e28c0ae54bee954b58cd076969a (git) Affected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 , < adb7118b7d2cfd7e8213c17d7d2829f353017754 (git) |
|
| Linux | Linux |
Affected:
2.6.15
Unaffected: 0 , < 2.6.15 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/ipw2x00/libipw_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "766268b429ae26d8ca599031fa962b0fe4673120",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "d70bdb84cf1782039384c1ffa7a18b0303c286a7",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "400b89217058fac672134a0d4092c8493dadb8ad",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "46aa75291056b6dc5faaf956dffdb3e9662477b0",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "e3025ecdb2057f866c09e059fc1466e81d6f243e",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "af1b69be19c34e28c0ae54bee954b58cd076969a",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
},
{
"lessThan": "adb7118b7d2cfd7e8213c17d7d2829f353017754",
"status": "affected",
"version": "9e8571affd1c54b9638b4ff9844e47aae07310f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/ipw2x00/libipw_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.15"
},
{
"lessThan": "2.6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "2.6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: reject too-short association responses\n\nlibipw_handle_assoc_resp() reads the capability, status and aid fields\nof the 30-byte association response prefix and then computes the\ninformation element length as\n\n\tstats-\u003elen - sizeof(*frame)\n\nstats-\u003elen is a u16 and sizeof() has type size_t, so the subtraction is\nevaluated as size_t and wraps instead of going negative. Truncating\nthat to the u16 length parameter of libipw_parse_info_param() turns a\nframe shorter than the fixed fields into a length near 64 KiB, and the\nparser then reads past the receive buffer.\n\nBoth the ipw2100 and ipw2200 management receive paths reach this\nfunction having established only that the frame carries the generic\n24-byte three-address header.\n\nReject the frame before any fixed field is touched.\n\nFound by an AI-assisted review of length arithmetic in management frame\nparsers. Verified with a KUnit case under Generic KASAN on arm64 under\nQEMU; I do not have the hardware, so it is not tested on a real device."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The malformed input is an 802.11 Association Response management frame received over the air. ipw2100 (isr_rx path) and ipw2200 (ipw_handle_mgmt_packet) send it through libipw_rx_mgt() into libipw_handle_assoc_resp(). The attacker must be within WiFi radio range.\nAC:L - The attacker only has to send an ASSOC_RESP frame of 24-29 bytes. The drivers check only for the 24-byte header, so stats-\u003elen - sizeof(*frame) (30) wraps to about 64K in the u16 length passed to libipw_parse_info_param(). No race or special state is involved.\nPR:N - libipw_rx_mgt() processes management frames before any 802.11 authentication or key exchange. An unauthenticated nearby transmitter can inject the frame.\nUI:N - The frame is processed in the receive path as soon as the interface is up. The victim does nothing.\nS:U - The out-of-bounds read stays inside the host kernel\u0027s own memory and crosses no virtualization or IOMMU boundary.\nC:L - libipw_parse_info_param() walks up to about 64KB of memory past the receive buffer. Those bytes only fill a local libipw_network on the stack, and through the QoS IE path the qos_data that goes to firmware. Nothing is returned to the attacker, so the disclosure is limited and indirect.\nI:N - The bug is read-only. Every copy from the parsed IEs is bounded (min() on ssid/rates, an exact-size check in libipw_read_qos_param_element) and lands in the fixed-size local network struct, so nothing is written out of bounds.\nA:H - Iterating about 64KB of information elements past a few-KB skb/DMA receive buffer can hit unmapped pages (or KASAN/KFENCE) and oops the kernel. Any station in range can resend the short frame repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:10.352Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/766268b429ae26d8ca599031fa962b0fe4673120"
},
{
"url": "https://git.kernel.org/stable/c/d70bdb84cf1782039384c1ffa7a18b0303c286a7"
},
{
"url": "https://git.kernel.org/stable/c/400b89217058fac672134a0d4092c8493dadb8ad"
},
{
"url": "https://git.kernel.org/stable/c/46aa75291056b6dc5faaf956dffdb3e9662477b0"
},
{
"url": "https://git.kernel.org/stable/c/e3025ecdb2057f866c09e059fc1466e81d6f243e"
},
{
"url": "https://git.kernel.org/stable/c/14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb"
},
{
"url": "https://git.kernel.org/stable/c/af1b69be19c34e28c0ae54bee954b58cd076969a"
},
{
"url": "https://git.kernel.org/stable/c/adb7118b7d2cfd7e8213c17d7d2829f353017754"
}
],
"title": "wifi: libipw: reject too-short association responses",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98348",
"datePublished": "2026-10-06T08:46:36.927Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-07T06:50:10.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98349 (GCVE-0-2026-98349)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
wifi: libipw: reject too-short beacon and probe responses
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: libipw: reject too-short beacon and probe responses
libipw_process_probe_response() and the libipw_network_init() call it
makes assume the frame contains the full 36-byte beacon and probe
response prefix, but the ipw2100 and ipw2200 receive paths only
establish that a management frame carries the generic 24-byte
three-address header.
libipw_network_init() then computes the information element length as
stats->len - sizeof(*beacon)
stats->len is a u16 and sizeof() has type size_t, so the subtraction is
evaluated as size_t and wraps instead of going negative. Truncating
that to the u16 length parameter of libipw_parse_info_param() yields
65524 for a 24-byte beacon, and the parser then walks the receive
buffer as if it held almost 64 KiB of information elements, reading
past the allocation.
Reject the frame before any fixed field is touched.
Found by an AI-assisted review of length arithmetic in management frame
parsers. Verified with a KUnit case under Generic KASAN on arm64 under
QEMU; I do not have the hardware, so it is not tested on a real device.
Severity
7.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b453872c35cfcbdbf5a794737817f7d4e7b1b579 , < cee6f141b3bebe62eb0363fd147acb52023935f0
(git)
Affected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 , < 23afeb5d2bdfd34c8a0a661876291a4fa9978293 (git) Affected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 , < 89959ff00a978f3172726d3d5f861ee6f1aae26d (git) Affected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 , < 14ae269c1306053ddf1ccf37c4bd66e085a652d1 (git) Affected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 , < ff756e6647722b7d225d882f7bdb186d8eee318e (git) Affected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 , < 2c87bbc00dc93149d1dc4f803ad92d92e4ef3758 (git) Affected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 , < 19959fb60228f6dccc40d55507f8b1a751c2dc89 (git) Affected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 , < 5ce5721e8cbe3e80db8f43851cc2a2a92485ef4b (git) |
|
| Linux | Linux |
Affected:
2.6.14
Unaffected: 0 , < 2.6.14 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/ipw2x00/libipw_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cee6f141b3bebe62eb0363fd147acb52023935f0",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "23afeb5d2bdfd34c8a0a661876291a4fa9978293",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "89959ff00a978f3172726d3d5f861ee6f1aae26d",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "14ae269c1306053ddf1ccf37c4bd66e085a652d1",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "ff756e6647722b7d225d882f7bdb186d8eee318e",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "2c87bbc00dc93149d1dc4f803ad92d92e4ef3758",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "19959fb60228f6dccc40d55507f8b1a751c2dc89",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
},
{
"lessThan": "5ce5721e8cbe3e80db8f43851cc2a2a92485ef4b",
"status": "affected",
"version": "b453872c35cfcbdbf5a794737817f7d4e7b1b579",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/ipw2x00/libipw_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"lessThan": "2.6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "2.6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: reject too-short beacon and probe responses\n\nlibipw_process_probe_response() and the libipw_network_init() call it\nmakes assume the frame contains the full 36-byte beacon and probe\nresponse prefix, but the ipw2100 and ipw2200 receive paths only\nestablish that a management frame carries the generic 24-byte\nthree-address header.\n\nlibipw_network_init() then computes the information element length as\n\n\tstats-\u003elen - sizeof(*beacon)\n\nstats-\u003elen is a u16 and sizeof() has type size_t, so the subtraction is\nevaluated as size_t and wraps instead of going negative. Truncating\nthat to the u16 length parameter of libipw_parse_info_param() yields\n65524 for a 24-byte beacon, and the parser then walks the receive\nbuffer as if it held almost 64 KiB of information elements, reading\npast the allocation.\n\nReject the frame before any fixed field is touched.\n\nFound by an AI-assisted review of length arithmetic in management frame\nparsers. Verified with a KUnit case under Generic KASAN on arm64 under\nQEMU; I do not have the hardware, so it is not tested on a real device."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The malformed input is a beacon or probe response sent over the air. The ipw2100 isr_rx and ipw2200 ipw_rx paths only check for a 24-byte header before libipw_rx_mgt() passes the frame to libipw_process_probe_response(). This is an 802.11 management frame, so the attacker must be within radio range.\nAC:L - Any beacon or probe response shorter than the 36-byte libipw_probe_response prefix triggers the bug every time. In libipw_network_init(), stats-\u003elen - sizeof(*beacon) wraps to about 65524 when truncated to u16. The attacker can send such frames repeatedly, and periodic automatic scans make the driver process probe responses.\nPR:N - Beacons and probe responses are parsed before any association or authentication, so the sender needs no credentials or relationship with the victim station.\nUI:N - The driver processes management frames on its own once the interface is up, and periodic background scans process probe responses. No user action is needed.\nS:U - The out-of-bounds read happens in the kernel\u0027s libipw receive path, and its impact stays within the kernel\u0027s own security authority.\nC:L - libipw_parse_info_param() reads up to about 64 KiB of adjacent heap past the RX skb. It copies only capped pieces (SSID, rates, WPA/RSN IEs) into the stored libipw_network, which shows up in scan results. The remote sender cannot read this back, and the leaked contents are not under its control.\nI:N - This is a read-only overrun. Every copy in libipw_parse_info_param() is bounded by the destination size (min() on ssid_len, rates_len, wpa_ie_len, rsn_ie_len), so no kernel memory is written out of bounds.\nA:H - An unauthenticated sender can repeat the frame, and each one makes the parser read about 64 KiB past a roughly 3 KB RX buffer at a different heap position. That can reach unmapped memory and oops in the RX path, and it fires KASAN or KFENCE reports. Either one takes the system down."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:11.508Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cee6f141b3bebe62eb0363fd147acb52023935f0"
},
{
"url": "https://git.kernel.org/stable/c/23afeb5d2bdfd34c8a0a661876291a4fa9978293"
},
{
"url": "https://git.kernel.org/stable/c/89959ff00a978f3172726d3d5f861ee6f1aae26d"
},
{
"url": "https://git.kernel.org/stable/c/14ae269c1306053ddf1ccf37c4bd66e085a652d1"
},
{
"url": "https://git.kernel.org/stable/c/ff756e6647722b7d225d882f7bdb186d8eee318e"
},
{
"url": "https://git.kernel.org/stable/c/2c87bbc00dc93149d1dc4f803ad92d92e4ef3758"
},
{
"url": "https://git.kernel.org/stable/c/19959fb60228f6dccc40d55507f8b1a751c2dc89"
},
{
"url": "https://git.kernel.org/stable/c/5ce5721e8cbe3e80db8f43851cc2a2a92485ef4b"
}
],
"title": "wifi: libipw: reject too-short beacon and probe responses",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98349",
"datePublished": "2026-10-06T08:46:37.713Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-07T06:50:11.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98351 (GCVE-0-2026-98351)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
wifi: virt_wifi: free skb when disconnected
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: virt_wifi: free skb when disconnected
When the simulated link is disconnected, virt_wifi_start_xmit() returns
NET_XMIT_DROP without freeing the skb. dev_hard_start_xmit() treats this
return value as consumed, so every packet sent while disconnected leaks its
skb.
Free the skb before returning the drop status.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c7cdba31ed8b87526db978976392802d3f93110c , < 38d3a5df85345f158f78b478b265ca906224454e
(git)
Affected: c7cdba31ed8b87526db978976392802d3f93110c , < ee053ea35c759135460f03d1c574f4ed08de844a (git) Affected: c7cdba31ed8b87526db978976392802d3f93110c , < d177eca79e1106834bc423d3969a4a2e3987996a (git) Affected: c7cdba31ed8b87526db978976392802d3f93110c , < 36727a702cf8e3399e3da60d0856378f6afcfb34 (git) Affected: c7cdba31ed8b87526db978976392802d3f93110c , < 56469996c10a0240653fc00576b4d33bdfb4cc51 (git) Affected: c7cdba31ed8b87526db978976392802d3f93110c , < 4f266738af45675faa0e8afee08c6e780afa8b06 (git) Affected: c7cdba31ed8b87526db978976392802d3f93110c , < 46371442847a725cc0df3697fea2eba1dd54b82b (git) Affected: c7cdba31ed8b87526db978976392802d3f93110c , < f9edf7cf63b96d2b776fca8d258d3c5256e40c8e (git) |
|
| Linux | Linux |
Affected:
5.0
Unaffected: 0 , < 5.0 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/virtual/virt_wifi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "38d3a5df85345f158f78b478b265ca906224454e",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "ee053ea35c759135460f03d1c574f4ed08de844a",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "d177eca79e1106834bc423d3969a4a2e3987996a",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "36727a702cf8e3399e3da60d0856378f6afcfb34",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "56469996c10a0240653fc00576b4d33bdfb4cc51",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "4f266738af45675faa0e8afee08c6e780afa8b06",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "46371442847a725cc0df3697fea2eba1dd54b82b",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
},
{
"lessThan": "f9edf7cf63b96d2b776fca8d258d3c5256e40c8e",
"status": "affected",
"version": "c7cdba31ed8b87526db978976392802d3f93110c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/virtual/virt_wifi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: virt_wifi: free skb when disconnected\n\nWhen the simulated link is disconnected, virt_wifi_start_xmit() returns\nNET_XMIT_DROP without freeing the skb. dev_hard_start_xmit() treats this\nreturn value as consumed, so every packet sent while disconnected leaks its\nskb.\n\nFree the skb before returning the drop status."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:39.335Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/38d3a5df85345f158f78b478b265ca906224454e"
},
{
"url": "https://git.kernel.org/stable/c/ee053ea35c759135460f03d1c574f4ed08de844a"
},
{
"url": "https://git.kernel.org/stable/c/d177eca79e1106834bc423d3969a4a2e3987996a"
},
{
"url": "https://git.kernel.org/stable/c/36727a702cf8e3399e3da60d0856378f6afcfb34"
},
{
"url": "https://git.kernel.org/stable/c/56469996c10a0240653fc00576b4d33bdfb4cc51"
},
{
"url": "https://git.kernel.org/stable/c/4f266738af45675faa0e8afee08c6e780afa8b06"
},
{
"url": "https://git.kernel.org/stable/c/46371442847a725cc0df3697fea2eba1dd54b82b"
},
{
"url": "https://git.kernel.org/stable/c/f9edf7cf63b96d2b776fca8d258d3c5256e40c8e"
}
],
"title": "wifi: virt_wifi: free skb when disconnected",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98351",
"datePublished": "2026-10-06T08:46:39.335Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-06T08:46:39.335Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98352 (GCVE-0-2026-98352)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
The client borrows shared CQ credits in the ADDR_RESOLVED handler via
ib_cq_pool_get(), before the peer is connected. create_cm() can return
-ERESTARTSYS from wait_event_interruptible_timeout() without destroying
the CM ID. The init_conns() and stop-and-destroy paths then call
destroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards
rdma_destroy_id().
CMA serializes the handler against rdma_destroy_id() with handler_mutex,
but that does not order the GET against destroy_con_cq_qp(). If
ADDR_RESOLVED has already passed the DESTROYING check, it can take
con_mutex, GET credits, and then lose the con to kfree. Device
unregister later hits WARN_ON(cq->cqe_used) in ib_cq_pool_cleanup().
Set a per-connection flag under con_mutex before CQ/QP teardown so a
racing ADDR_RESOLVED cannot borrow credits after teardown has begun.
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
3b89e92c2a95a39c38a3808f4528e502a39bd94d , < a82cca40139d9fcae8208901856bd5bb4051f097
(git)
Affected: 3b89e92c2a95a39c38a3808f4528e502a39bd94d , < 74c4ed55e61f1b65ddbebc5b635d136461a1c3da (git) Affected: 3b89e92c2a95a39c38a3808f4528e502a39bd94d , < 6f8020fe7465f49e234a576c04e415e9d08c7878 (git) Affected: 3b89e92c2a95a39c38a3808f4528e502a39bd94d , < 31024e158b45358370a0a14ed96589e6aa62d6cb (git) Affected: 3b89e92c2a95a39c38a3808f4528e502a39bd94d , < 8f253d5893f991742464b9e7203c43fc08d0aa11 (git) Affected: 3b89e92c2a95a39c38a3808f4528e502a39bd94d , < bf88ac4867050112a6c819c8d1a7209bf48ef427 (git) Affected: 3b89e92c2a95a39c38a3808f4528e502a39bd94d , < 2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda (git) |
|
| Linux | Linux |
Affected:
5.13
Unaffected: 0 , < 5.13 (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/rtrs/rtrs-clt.c",
"drivers/infiniband/ulp/rtrs/rtrs-clt.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a82cca40139d9fcae8208901856bd5bb4051f097",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
},
{
"lessThan": "74c4ed55e61f1b65ddbebc5b635d136461a1c3da",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
},
{
"lessThan": "6f8020fe7465f49e234a576c04e415e9d08c7878",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
},
{
"lessThan": "31024e158b45358370a0a14ed96589e6aa62d6cb",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
},
{
"lessThan": "8f253d5893f991742464b9e7203c43fc08d0aa11",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
},
{
"lessThan": "bf88ac4867050112a6c819c8d1a7209bf48ef427",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
},
{
"lessThan": "2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda",
"status": "affected",
"version": "3b89e92c2a95a39c38a3808f4528e502a39bd94d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/rtrs/rtrs-clt.c",
"drivers/infiniband/ulp/rtrs/rtrs-clt.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted\n\nThe client borrows shared CQ credits in the ADDR_RESOLVED handler via\nib_cq_pool_get(), before the peer is connected. create_cm() can return\n-ERESTARTSYS from wait_event_interruptible_timeout() without destroying\nthe CM ID. The init_conns() and stop-and-destroy paths then call\ndestroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards\nrdma_destroy_id().\n\nCMA serializes the handler against rdma_destroy_id() with handler_mutex,\nbut that does not order the GET against destroy_con_cq_qp(). If\nADDR_RESOLVED has already passed the DESTROYING check, it can take\ncon_mutex, GET credits, and then lose the con to kfree. Device\nunregister later hits WARN_ON(cq-\u003ecqe_used) in ib_cq_pool_cleanup().\n\nSet a per-connection flag under con_mutex before CQ/QP teardown so a\nracing ADDR_RESOLVED cannot borrow credits after teardown has begun."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:40.151Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a82cca40139d9fcae8208901856bd5bb4051f097"
},
{
"url": "https://git.kernel.org/stable/c/74c4ed55e61f1b65ddbebc5b635d136461a1c3da"
},
{
"url": "https://git.kernel.org/stable/c/6f8020fe7465f49e234a576c04e415e9d08c7878"
},
{
"url": "https://git.kernel.org/stable/c/31024e158b45358370a0a14ed96589e6aa62d6cb"
},
{
"url": "https://git.kernel.org/stable/c/8f253d5893f991742464b9e7203c43fc08d0aa11"
},
{
"url": "https://git.kernel.org/stable/c/bf88ac4867050112a6c819c8d1a7209bf48ef427"
},
{
"url": "https://git.kernel.org/stable/c/2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda"
}
],
"title": "RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98352",
"datePublished": "2026-10-06T08:46:40.151Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-06T08:46:40.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98354 (GCVE-0-2026-98354)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
RDMA/mad: Fix receive buffer leak when PKey enforcement fails
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mad: Fix receive buffer leak when PKey enforcement fails
ib_mad_complete_recv() initializes mad_recv_wc->rmpp_list and then runs
ib_mad_enforce_security() before linking recv_buf onto that list. On
failure it calls ib_free_recv_mad(), which only walks rmpp_list and frees
the ib_mad_private of every buffer found there. As the list is still
empty at that point, nothing is freed at all.
The caller cannot clean up either: ib_mad_recv_done() sets recv to NULL
right after ib_mad_complete_recv() returns, assuming the MAD layer took
ownership of the buffer. Every MAD that fails the PKey check therefore
leaks one ib_mad_private (about 300 bytes per IB port MAD, ~2K for OPA),
and a remote node can trigger this repeatedly by sending MADs with a
wrong PKey.
Link recv_buf onto rmpp_list right after the list is initialized, so the
error path has something to free.
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
47a2b338fe63200d716d2e24131cdb49f17c77da , < 4617c9a856188674dddb0ca66979746d07688579
(git)
Affected: 47a2b338fe63200d716d2e24131cdb49f17c77da , < 8e2036fb47a5b152d53eadbd35abf311bd34cc7f (git) Affected: 47a2b338fe63200d716d2e24131cdb49f17c77da , < bad289e42f512646a988f278f536d21547df73f1 (git) Affected: 47a2b338fe63200d716d2e24131cdb49f17c77da , < 752b30e9d339008e5ce7eed412e9446078916129 (git) Affected: 47a2b338fe63200d716d2e24131cdb49f17c77da , < 39c4ea72a40503e102ae07e6776005f96ca078a6 (git) Affected: 47a2b338fe63200d716d2e24131cdb49f17c77da , < 5091e25ec503f7fc02723ca435226467b68caac7 (git) Affected: 47a2b338fe63200d716d2e24131cdb49f17c77da , < c0d8df85db146d6275e226cb950023be69dd6c77 (git) Affected: 47a2b338fe63200d716d2e24131cdb49f17c77da , < 3476c28c9addfa253f505e6bd87f1f5598b961d0 (git) |
|
| Linux | Linux |
Affected:
4.13
Unaffected: 0 , < 4.13 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/mad.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4617c9a856188674dddb0ca66979746d07688579",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "8e2036fb47a5b152d53eadbd35abf311bd34cc7f",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "bad289e42f512646a988f278f536d21547df73f1",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "752b30e9d339008e5ce7eed412e9446078916129",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "39c4ea72a40503e102ae07e6776005f96ca078a6",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "5091e25ec503f7fc02723ca435226467b68caac7",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "c0d8df85db146d6275e226cb950023be69dd6c77",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
},
{
"lessThan": "3476c28c9addfa253f505e6bd87f1f5598b961d0",
"status": "affected",
"version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/mad.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mad: Fix receive buffer leak when PKey enforcement fails\n\nib_mad_complete_recv() initializes mad_recv_wc-\u003ermpp_list and then runs\nib_mad_enforce_security() before linking recv_buf onto that list. On\nfailure it calls ib_free_recv_mad(), which only walks rmpp_list and frees\nthe ib_mad_private of every buffer found there. As the list is still\nempty at that point, nothing is freed at all.\n\nThe caller cannot clean up either: ib_mad_recv_done() sets recv to NULL\nright after ib_mad_complete_recv() returns, assuming the MAD layer took\nownership of the buffer. Every MAD that fails the PKey check therefore\nleaks one ib_mad_private (about 300 bytes per IB port MAD, ~2K for OPA),\nand a remote node can trigger this repeatedly by sending MADs with a\nwrong PKey.\n\nLink recv_buf onto rmpp_list right after the list is initialized, so the\nerror path has something to free."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:41.768Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4617c9a856188674dddb0ca66979746d07688579"
},
{
"url": "https://git.kernel.org/stable/c/8e2036fb47a5b152d53eadbd35abf311bd34cc7f"
},
{
"url": "https://git.kernel.org/stable/c/bad289e42f512646a988f278f536d21547df73f1"
},
{
"url": "https://git.kernel.org/stable/c/752b30e9d339008e5ce7eed412e9446078916129"
},
{
"url": "https://git.kernel.org/stable/c/39c4ea72a40503e102ae07e6776005f96ca078a6"
},
{
"url": "https://git.kernel.org/stable/c/5091e25ec503f7fc02723ca435226467b68caac7"
},
{
"url": "https://git.kernel.org/stable/c/c0d8df85db146d6275e226cb950023be69dd6c77"
},
{
"url": "https://git.kernel.org/stable/c/3476c28c9addfa253f505e6bd87f1f5598b961d0"
}
],
"title": "RDMA/mad: Fix receive buffer leak when PKey enforcement fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98354",
"datePublished": "2026-10-06T08:46:41.768Z",
"dateReserved": "2026-09-25T10:25:14.343Z",
"dateUpdated": "2026-10-06T08:46:41.768Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98357 (GCVE-0-2026-98357)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
EPSS
VEX
Title
IB/isert: wait for deferred control PDU completions before releasing the connection
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/isert: wait for deferred control PDU completions before releasing the connection
isert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and
ISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns. The work
item then runs isert_completion_put() -> isert_put_cmd(), which reads
isert_conn->conn and takes conn->cmd_lock.
Nothing orders that work item against teardown. isert_wait_conn() queues
isert_release_work, which frees isert_conn, and iscsit_close_connection()
frees the iscsit_conn right after it returns, so the queued work can run
against freed memory.
Count the deferred control PDU completions per connection and let
isert_wait_conn() wait for them before the release work is queued.
ISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs
iscsit_logout_post_handler(), which ends up waiting for
conn->conn_wait_comp, and that completion is only sent by
iscsit_close_connection() after it has called iscsit_wait_conn().
Waiting for it here would deadlock. Its wait stays the existing
isert_wait4logout().
The splat below is from a kernel with tracing printk()s and an msleep(200)
injected into isert_do_control_comp() to widen the window:
BUG: KASAN: slab-use-after-free in isert_put_cmd+0x53d/0x620
Read of size 8 at addr ffff8881054f1038 by task kworker/u17:1/182
CPU: 0 UID: 0 PID: 182 Comm: kworker/u17:1 Tainted: G B 7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: isert_comp_wq isert_do_control_comp
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
print_report+0xd0/0x630
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? _raw_spin_unlock_irqrestore+0x3e/0x70
? isert_put_cmd+0x53d/0x620
kasan_report+0xce/0x100
? isert_put_cmd+0x53d/0x620
isert_put_cmd+0x53d/0x620
? isert_completion_put+0x305/0x330
? isert_do_control_comp+0x2ef/0x310
process_one_work+0x633/0x1030
? assign_work+0x11d/0x370
worker_thread+0x45b/0xd10
? __pfx_worker_thread+0x10/0x10
? __pfx_worker_thread+0x10/0x10
kthread+0x2c6/0x3b0
? recalc_sigpending+0x15c/0x1e0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x36e/0x5a0
? __pfx_ret_from_fork+0x10/0x10
? __switch_to+0x572/0xdd0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 48:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0x8f/0xa0
__kmalloc_cache_noprof+0x158/0x370
isert_cma_handler+0x1e3/0x2ae0
cma_cm_event_handler+0x3e/0x240
cma_ib_req_handler+0x17d9/0x4490
cm_process_work+0x41/0x330
cm_work_handler+0x5727/0xc160
process_one_work+0x633/0x1030
worker_thread+0x45b/0xd10
kthread+0x2c6/0x3b0
ret_from_fork+0x36e/0x5a0
ret_from_fork_asm+0x1a/0x30
Freed by task 184:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x43/0x70
kfree+0x121/0x380
iscsit_close_connection+0x7cf/0x1e60
iscsit_take_action_for_connection_exit+0x1b6/0x360
iscsi_target_tx_thread+0x472/0x690
kthread+0x2c6/0x3b0
ret_from_fork+0x36e/0x5a0
ret_from_fork_asm+0x1a/0x30
Severity
8.1 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
b8d26b3be8b33682cf163274ed07479a70554633 , < f5613acbe2e346d5c466ef0bd264fca936b69f82
(git)
Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < ccdb1523f12bc8a9646de65055d1aafed9e9bcc6 (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < 0e230917670c6e6fe3243abfa11299fcbe05b1f4 (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < 505b242d9351690d1385bbe508ab4666f60363ce (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < 7edb8a88d6c76237c8b4435765bee1009e26a50a (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < b96b8b3e41c308f606ffd10cfef1a7b9f97414cd (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < 7908fbc597a694bbd99bfb59ece73bc3daded68e (git) Affected: b8d26b3be8b33682cf163274ed07479a70554633 , < a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f (git) |
|
| Linux | Linux |
Affected:
3.10
Unaffected: 0 , < 3.10 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/isert/ib_isert.c",
"drivers/infiniband/ulp/isert/ib_isert.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f5613acbe2e346d5c466ef0bd264fca936b69f82",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "ccdb1523f12bc8a9646de65055d1aafed9e9bcc6",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "0e230917670c6e6fe3243abfa11299fcbe05b1f4",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "505b242d9351690d1385bbe508ab4666f60363ce",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "7edb8a88d6c76237c8b4435765bee1009e26a50a",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "b96b8b3e41c308f606ffd10cfef1a7b9f97414cd",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "7908fbc597a694bbd99bfb59ece73bc3daded68e",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/isert/ib_isert.c",
"drivers/infiniband/ulp/isert/ib_isert.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: wait for deferred control PDU completions before releasing the connection\n\nisert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and\nISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns. The work\nitem then runs isert_completion_put() -\u003e isert_put_cmd(), which reads\nisert_conn-\u003econn and takes conn-\u003ecmd_lock.\n\nNothing orders that work item against teardown. isert_wait_conn() queues\nisert_release_work, which frees isert_conn, and iscsit_close_connection()\nfrees the iscsit_conn right after it returns, so the queued work can run\nagainst freed memory.\n\nCount the deferred control PDU completions per connection and let\nisert_wait_conn() wait for them before the release work is queued.\n\nISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs\niscsit_logout_post_handler(), which ends up waiting for\nconn-\u003econn_wait_comp, and that completion is only sent by\niscsit_close_connection() after it has called iscsit_wait_conn().\nWaiting for it here would deadlock. Its wait stays the existing\nisert_wait4logout().\n\nThe splat below is from a kernel with tracing printk()s and an msleep(200)\ninjected into isert_do_control_comp() to widen the window:\n\n BUG: KASAN: slab-use-after-free in isert_put_cmd+0x53d/0x620\n Read of size 8 at addr ffff8881054f1038 by task kworker/u17:1/182\n\n CPU: 0 UID: 0 PID: 182 Comm: kworker/u17:1 Tainted: G B 7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy)\n Tainted: [B]=BAD_PAGE\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Workqueue: isert_comp_wq isert_do_control_comp\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x53/0x70\n print_report+0xd0/0x630\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? _raw_spin_unlock_irqrestore+0x3e/0x70\n ? isert_put_cmd+0x53d/0x620\n kasan_report+0xce/0x100\n ? isert_put_cmd+0x53d/0x620\n isert_put_cmd+0x53d/0x620\n ? isert_completion_put+0x305/0x330\n ? isert_do_control_comp+0x2ef/0x310\n process_one_work+0x633/0x1030\n ? assign_work+0x11d/0x370\n worker_thread+0x45b/0xd10\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2c6/0x3b0\n ? recalc_sigpending+0x15c/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x36e/0x5a0\n ? __pfx_ret_from_fork+0x10/0x10\n ? __switch_to+0x572/0xdd0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\n Allocated by task 48:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc_cache_noprof+0x158/0x370\n isert_cma_handler+0x1e3/0x2ae0\n cma_cm_event_handler+0x3e/0x240\n cma_ib_req_handler+0x17d9/0x4490\n cm_process_work+0x41/0x330\n cm_work_handler+0x5727/0xc160\n process_one_work+0x633/0x1030\n worker_thread+0x45b/0xd10\n kthread+0x2c6/0x3b0\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30\n\n Freed by task 184:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kfree+0x121/0x380\n iscsit_close_connection+0x7cf/0x1e60\n iscsit_take_action_for_connection_exit+0x1b6/0x360\n iscsi_target_tx_thread+0x472/0x690\n kthread+0x2c6/0x3b0\n ret_from_fork+0x36e/0x5a0\n ret_from_fork_asm+0x1a/0x30"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The iSER initiator triggers it remotely over RDMA (iWARP/RoCEv2 are IP-routable). Its iSCSI Text Request (or a TMF or a malformed PDU that draws a Reject) makes isert_send_done() queue isert_do_control_comp(); an RDMA CM disconnect from the same initiator then starts teardown via iscsit_close_connection().\nAC:H - The attacker sends both the request and the disconnect, but the free only wins if the already-queued isert_comp_wq work stays delayed through ib_drain_qp, isert_wait4cmds and the release work. The attacker can\u0027t control that scheduling; the reporter needed an injected msleep(200) to reproduce it.\nPR:N - The attacker only needs a full-feature iSCSI session, and LIO allows login with AuthMethod=None, where the initiator IQN is merely asserted. No credentials are checked before the Text/TMF/Reject paths that queue the deferred completion.\nUI:N - The initiator triggers the response PDU and the connection teardown entirely through its own iSCSI PDUs and RDMA CM disconnect; no action by a target administrator is needed.\nS:U - The use-after-free is in the target host\u0027s own kernel memory (isert_conn and iscsit_conn), so the impact stays within the same kernel security authority.\nC:H - isert_put_cmd() dereferences the freed isert_conn-\u003econn and reads the freed iscsit_conn and cmd structures. Reclaiming those slab objects lets attacker-shaped data steer kernel pointer reads.\nI:H - On the freed iscsit_conn, isert_put_cmd() takes spin_lock_bh(\u0026conn-\u003ecmd_lock), runs list_del_init(\u0026cmd-\u003ei_conn_node) and calls iscsit_release_cmd()/transport_generic_free_cmd(). These are writes and frees through freed memory, which can corrupt the heap.\nA:H - The isert_comp_wq worker hits a slab use-after-free in isert_put_cmd() (KASAN splat in the fix commit), which on production kernels can crash or oops the iSCSI target host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T06:50:12.677Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f5613acbe2e346d5c466ef0bd264fca936b69f82"
},
{
"url": "https://git.kernel.org/stable/c/ccdb1523f12bc8a9646de65055d1aafed9e9bcc6"
},
{
"url": "https://git.kernel.org/stable/c/0e230917670c6e6fe3243abfa11299fcbe05b1f4"
},
{
"url": "https://git.kernel.org/stable/c/505b242d9351690d1385bbe508ab4666f60363ce"
},
{
"url": "https://git.kernel.org/stable/c/7edb8a88d6c76237c8b4435765bee1009e26a50a"
},
{
"url": "https://git.kernel.org/stable/c/b96b8b3e41c308f606ffd10cfef1a7b9f97414cd"
},
{
"url": "https://git.kernel.org/stable/c/7908fbc597a694bbd99bfb59ece73bc3daded68e"
},
{
"url": "https://git.kernel.org/stable/c/a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f"
}
],
"title": "IB/isert: wait for deferred control PDU completions before releasing the connection",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98357",
"datePublished": "2026-10-06T08:46:44.216Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-07T06:50:12.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-98358 (GCVE-0-2026-98358)
Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-06 08:46
VLAI
EPSS
VEX
Title
IB/iser: reject a remote invalidation of an unregistered direction
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/iser: reject a remote invalidation of an unregistered direction
A write command whose data is sent entirely as immediate data is not
registered. iser_reg_mem_fastreg() takes the DMA key path and leaves
rdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has
already set dir[ISER_DIR_OUT].
iser_check_remote_inv() looks at dir[] alone and hands the descriptor to
iser_inv_desc(), which reads desc->sig_protected. A target that answers
such a command with IB_WR_SEND_WITH_INV faults the initiator.
Leaving those commands unregistered is deliberate.
The same function already terminates the connection when a target sends
a remote invalidation the initiator did not ask for. A target that
invalidates a direction that was never registered is in the same class,
so give it the same answer.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: rxe_wq do_work
RIP: 0010:iser_task_rsp+0x6d6/0xec0
Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04
RSP: 0018:ffff88811b008db8 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848
RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020
RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0
R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800
R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
<IRQ>
__ib_process_cq+0xe1/0x390
ib_poll_handler+0x6e/0x200
irq_poll_softirq+0x1df/0x480
? clockevents_program_event+0x2ba/0x860
? __pfx_irq_poll_softirq+0x10/0x10
handle_softirqs+0x18e/0x590
? __pfx_handle_softirqs+0x10/0x10
? __hrtimer_rearm_deferred+0x156/0x450
do_softirq+0x3b/0x60
</IRQ>
<TASK>
__local_bh_enable_ip+0x61/0x70
__alloc_skb+0x732/0x890
? _raw_spin_lock_irqsave+0x85/0xe0
? __pfx___alloc_skb+0x10/0x10
? _raw_read_unlock_irqrestore+0x16/0x50
rxe_init_packet+0x16b/0x4f0
prepare_ack_packet+0xb8/0x830
rxe_receiver+0x499/0x9980
? __pfx_rxe_receiver+0x10/0x10
? rxe_completer+0x29e5/0x38c0
? hrtimer_start_range_ns_common+0x75f/0x1730
? hrtimer_start_range_ns+0xa6/0x2c0
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? __pfx_rxe_receiver+0x10/0x10
do_work+0x144/0x470
process_one_work+0x633/0x1030
? assign_work+0x11d/0x370
worker_thread+0x45b/0xd10
? __pfx_worker_thread+0x10/0x10
kthread+0x2c6/0x3b0
? recalc_sigpending+0x15c/0x1e0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x36e/0x5a0
? __pfx_ret_from_fork+0x10/0x10
? __switch_to+0x572/0xdd0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
59caaed7a72a0e3750dfb84636dae6b781559310 , < 198e4db9add54a50cce60a5d80b8f0ee5456b65a
(git)
Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < b9e37452915feaa8422af87dea5d0c16a7d1ff13 (git) Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < 19ddd4af7fce9200e70882f622011e9dd130f427 (git) Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < 9d145a2d8d6f8f2cc460b80df41870819048f2a0 (git) Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < b4d278c91209931199db9c0836dc2e21a7593dad (git) Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < 6ed3ebaff3345837f0528d85bd39ce573c7b9a41 (git) Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < ceecf3f9c322fc6937a66682942a26ad13a34a07 (git) Affected: 59caaed7a72a0e3750dfb84636dae6b781559310 , < d85f0f0a7c85756fc992c70d869706f19dac9259 (git) |
|
| Linux | Linux |
Affected:
4.5
Unaffected: 0 , < 4.5 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/iser/iser_initiator.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "198e4db9add54a50cce60a5d80b8f0ee5456b65a",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "b9e37452915feaa8422af87dea5d0c16a7d1ff13",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "19ddd4af7fce9200e70882f622011e9dd130f427",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "9d145a2d8d6f8f2cc460b80df41870819048f2a0",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "b4d278c91209931199db9c0836dc2e21a7593dad",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "6ed3ebaff3345837f0528d85bd39ce573c7b9a41",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "ceecf3f9c322fc6937a66682942a26ad13a34a07",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
},
{
"lessThan": "d85f0f0a7c85756fc992c70d869706f19dac9259",
"status": "affected",
"version": "59caaed7a72a0e3750dfb84636dae6b781559310",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/iser/iser_initiator.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.271",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.222",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.189",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.158",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.112",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.54",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.8",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc4",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/iser: reject a remote invalidation of an unregistered direction\n\nA write command whose data is sent entirely as immediate data is not\nregistered. iser_reg_mem_fastreg() takes the DMA key path and leaves\nrdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has\nalready set dir[ISER_DIR_OUT].\n\niser_check_remote_inv() looks at dir[] alone and hands the descriptor to\niser_inv_desc(), which reads desc-\u003esig_protected. A target that answers\nsuch a command with IB_WR_SEND_WITH_INV faults the initiator.\nLeaving those commands unregistered is deliberate.\n\nThe same function already terminates the connection when a target sends\na remote invalidation the initiator did not ask for. A target that\ninvalidates a direction that was never registered is in the same class,\nso give it the same answer.\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]\n CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy)\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Workqueue: rxe_wq do_work\n RIP: 0010:iser_task_rsp+0x6d6/0xec0\n Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 \u003c0f\u003e b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04\n RSP: 0018:ffff88811b008db8 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848\n RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020\n RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0\n R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800\n R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000\n FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0\n PKRU: 55555554\n Call Trace:\n \u003cIRQ\u003e\n __ib_process_cq+0xe1/0x390\n ib_poll_handler+0x6e/0x200\n irq_poll_softirq+0x1df/0x480\n ? clockevents_program_event+0x2ba/0x860\n ? __pfx_irq_poll_softirq+0x10/0x10\n handle_softirqs+0x18e/0x590\n ? __pfx_handle_softirqs+0x10/0x10\n ? __hrtimer_rearm_deferred+0x156/0x450\n do_softirq+0x3b/0x60\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0x61/0x70\n __alloc_skb+0x732/0x890\n ? _raw_spin_lock_irqsave+0x85/0xe0\n ? __pfx___alloc_skb+0x10/0x10\n ? _raw_read_unlock_irqrestore+0x16/0x50\n rxe_init_packet+0x16b/0x4f0\n prepare_ack_packet+0xb8/0x830\n rxe_receiver+0x499/0x9980\n ? __pfx_rxe_receiver+0x10/0x10\n ? rxe_completer+0x29e5/0x38c0\n ? hrtimer_start_range_ns_common+0x75f/0x1730\n ? hrtimer_start_range_ns+0xa6/0x2c0\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __pfx_rxe_receiver+0x10/0x10\n do_work+0x144/0x470\n process_one_work+0x633/0x1030\n ? assign_work+0x11d/0x370\n worker_thread+0x45b/0xd10\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x2c6/0x3b0\n ? recalc_sigpending+0x15c/0x1e0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x36e/0x5a0\n ? __pfx_ret_from_fork+0x10/0x10\n ? __switch_to+0x572/0xdd0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n Modules linked in:\n ---[ end trace 0000000000000000 ]---"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T08:46:45.128Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/198e4db9add54a50cce60a5d80b8f0ee5456b65a"
},
{
"url": "https://git.kernel.org/stable/c/b9e37452915feaa8422af87dea5d0c16a7d1ff13"
},
{
"url": "https://git.kernel.org/stable/c/19ddd4af7fce9200e70882f622011e9dd130f427"
},
{
"url": "https://git.kernel.org/stable/c/9d145a2d8d6f8f2cc460b80df41870819048f2a0"
},
{
"url": "https://git.kernel.org/stable/c/b4d278c91209931199db9c0836dc2e21a7593dad"
},
{
"url": "https://git.kernel.org/stable/c/6ed3ebaff3345837f0528d85bd39ce573c7b9a41"
},
{
"url": "https://git.kernel.org/stable/c/ceecf3f9c322fc6937a66682942a26ad13a34a07"
},
{
"url": "https://git.kernel.org/stable/c/d85f0f0a7c85756fc992c70d869706f19dac9259"
}
],
"title": "IB/iser: reject a remote invalidation of an unregistered direction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-98358",
"datePublished": "2026-10-06T08:46:45.128Z",
"dateReserved": "2026-09-25T10:25:14.344Z",
"dateUpdated": "2026-10-06T08:46:45.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…
Loading…