CVE-2026-31705

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31705", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.132Z", "datePublished": "2026-05-01T13:56:03.896Z", "dateUpdated": "2026-10-15T01:18:03.133Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:39.919Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment\n\nsmb2_get_ea() applies 4-byte alignment padding via memset() after\nwriting each EA entry. The bounds check on buf_free_len is performed\nbefore the value memcpy, but the alignment memset fires unconditionally\nafterward with no check on remaining space.\n\nWhen the EA value exactly fills the remaining buffer (buf_free_len == 0\nafter value subtraction), the alignment memset writes 1-3 NUL bytes\npast the buf_free_len boundary. In compound requests where the response\nbuffer is shared across commands, the first command (e.g., READ) can\nconsume most of the buffer, leaving a tight remainder for the QUERY_INFO\nEA response. The alignment memset then overwrites past the physical\nkvmalloc allocation into adjacent kernel heap memory.\n\nAdd a bounds check before the alignment memset to ensure buf_free_len\ncan accommodate the padding bytes.\n\nThis is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix\npotencial OOB in get_file_all_info() for compound requests\") and\ncommit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound\nrequests\"), both of which added bounds checks before unconditional\nwrites in QUERY_INFO response handlers."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - ksmbd processes SMB2 requests over TCP, typically port 445, and the vulnerable `SMB2_QUERY_INFO` EA path is reachable through network packets from a remote SMB client.\nAC:L - The attacker can craft the compound response-buffer exhaustion and EA length/alignment conditions through SMB requests and controlled xattr sizes; there is no race or external condition beyond attacker control.\nPR:N - Although `SMB2_QUERY_INFO` is after session and tree setup, ksmbd supports guest/anonymous sessions and guest-accessible shares, so a reasonable deployment can expose this path without authenticated credentials.\nUI:N - No victim action is required after the server is running and exposing the share; the attacker sends SMB requests directly.\nS:U - The corruption occurs inside the kernel SMB server and impacts the same kernel/host security authority, without crossing a VM, IOMMU, or sandbox boundary.\nC:H - This is kernel heap memory corruption from an out-of-bounds write; in the highest defensible case it can be leveraged toward kernel code execution or primitives that expose arbitrary kernel data.\nI:H - The bug is an out-of-bounds write of attacker-reached data into adjacent kernel heap memory, which is high integrity impact under the kernel scoring guidance.\nA:H - The out-of-bounds heap write can corrupt kernel memory and crash or panic the system, and it can be triggered remotely and repeatedly through SMB."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/smb2pdu.c"], "versions": [{"version": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77", "lessThan": "ddbbc8b2a09dd2cfed90871313e3691ae1db08a2", "status": "affected", "versionType": "git"}, {"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "lessThan": "ffbce350c6fd1e99116ea57383b9031717e36d3b", "status": "affected", "versionType": "git"}, {"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "lessThan": "98f3de6ef4efbd899348d333f0902dc4ff14380c", "status": "affected", "versionType": "git"}, {"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "lessThan": "790304c02bf9bd7b8171feda4294d6e62d32ae8f", "status": "affected", "versionType": "git"}, {"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "lessThan": "922d48fe8c19f388ffa2f709f33acaae4e408de2", "status": "affected", "versionType": "git"}, {"version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "lessThan": "30010c952077a1c89ecdd71fc4d574c75a8f5617", "status": "affected", "versionType": "git"}, {"version": "f2283680a80571ca82d710bc6ecd8f8beac67d63", "status": "affected", "versionType": "git"}, {"version": "6.1.71", "lessThan": "6.1.175", "status": "affected", "versionType": "semver"}, {"version": "5.15.145", "lessThan": "5.16", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/smb2pdu.c"], "versions": [{"version": "6.6", "status": "affected"}, {"version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.84", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.25", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.2", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.71", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.84"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.25"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.145"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ddbbc8b2a09dd2cfed90871313e3691ae1db08a2"}, {"url": "https://git.kernel.org/stable/c/ffbce350c6fd1e99116ea57383b9031717e36d3b"}, {"url": "https://git.kernel.org/stable/c/98f3de6ef4efbd899348d333f0902dc4ff14380c"}, {"url": "https://git.kernel.org/stable/c/790304c02bf9bd7b8171feda4294d6e62d32ae8f"}, {"url": "https://git.kernel.org/stable/c/922d48fe8c19f388ffa2f709f33acaae4e408de2"}, {"url": "https://git.kernel.org/stable/c/30010c952077a1c89ecdd71fc4d574c75a8f5617"}], "title": "ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:18:03.133Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/smb2pdu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ddbbc8b2a09dd2cfed90871313e3691ae1db08a2", "status": "affected", "version": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77", "versionType": "git"}, {"lessThan": "ffbce350c6fd1e99116ea57383b9031717e36d3b", "status": "affected", "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "versionType": "git"}, {"lessThan": "98f3de6ef4efbd899348d333f0902dc4ff14380c", "status": "affected", "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "versionType": "git"}, {"lessThan": "790304c02bf9bd7b8171feda4294d6e62d32ae8f", "status": "affected", "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "versionType": "git"}, {"lessThan": "922d48fe8c19f388ffa2f709f33acaae4e408de2", "status": "affected", "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "versionType": "git"}, {"lessThan": "30010c952077a1c89ecdd71fc4d574c75a8f5617", "status": "affected", "version": "e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d", "versionType": "git"}, {"status": "affected", "version": "f2283680a80571ca82d710bc6ecd8f8beac67d63", "versionType": "git"}, {"lessThan": "6.1.175", "status": "affected", "version": "6.1.71", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.145", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/smb2pdu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.6"}, {"lessThan": "6.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.84", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.25", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B98C9201-BF17-4E2C-84FF-75EE2AA94DC5", "versionEndExcluding": "5.16", "versionStartIncluding": "5.15.145", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "163E72B5-0F5D-49E2-AAEA-F11E02D730AD", "versionEndExcluding": "6.2", "versionStartIncluding": "6.1.71", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D1C8822E-08AF-49C3-8A31-F806E5FAE5E7", "versionEndExcluding": "6.6.136", "versionStartIncluding": "6.6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D4ECA0DE-AFF5-4688-B219-4CA2336CA5B7", "versionEndExcluding": "6.12.84", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C", "versionEndExcluding": "6.18.25", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8", "versionEndExcluding": "7.0.2", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment\n\nsmb2_get_ea() applies 4-byte alignment padding via memset() after\nwriting each EA entry. The bounds check on buf_free_len is performed\nbefore the value memcpy, but the alignment memset fires unconditionally\nafterward with no check on remaining space.\n\nWhen the EA value exactly fills the remaining buffer (buf_free_len == 0\nafter value subtraction), the alignment memset writes 1-3 NUL bytes\npast the buf_free_len boundary. In compound requests where the response\nbuffer is shared across commands, the first command (e.g., READ) can\nconsume most of the buffer, leaving a tight remainder for the QUERY_INFO\nEA response. The alignment memset then overwrites past the physical\nkvmalloc allocation into adjacent kernel heap memory.\n\nAdd a bounds check before the alignment memset to ensure buf_free_len\ncan accommodate the padding bytes.\n\nThis is the same bug pattern fixed by commit beef2634f81f (\"ksmbd: fix\npotencial OOB in get_file_all_info() for compound requests\") and\ncommit fda9522ed6af (\"ksmbd: fix OOB write in QUERY_INFO for compound\nrequests\"), both of which added bounds checks before unconditional\nwrites in QUERY_INFO response handlers."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nksmbd: correcci\u00f3n de escritura fuera de l\u00edmites en la alineaci\u00f3n de EA de smb2_get_ea()\n\nsmb2_get_ea() aplica relleno de alineaci\u00f3n de 4 bytes a trav\u00e9s de memset() despu\u00e9s de escribir cada entrada de EA. La comprobaci\u00f3n de l\u00edmites en buf_free_len se realiza antes del memcpy del valor, pero el memset de alineaci\u00f3n se activa incondicionalmente despu\u00e9s sin una comprobaci\u00f3n del espacio restante.\n\nCuando el valor de EA llena exactamente el b\u00fafer restante (buf_free_len == 0 despu\u00e9s de la resta del valor), el memset de alineaci\u00f3n escribe de 1 a 3 bytes NUL m\u00e1s all\u00e1 del l\u00edmite de buf_free_len. En solicitudes compuestas donde el b\u00fafer de respuesta se comparte entre comandos, el primer comando (p. ej., READ) puede consumir la mayor parte del b\u00fafer, dejando un resto ajustado para la respuesta de EA de QUERY_INFO. El memset de alineaci\u00f3n luego sobrescribe m\u00e1s all\u00e1 de la asignaci\u00f3n f\u00edsica de kvmalloc en la memoria adyacente del heap del kernel.\n\nA\u00f1adir una comprobaci\u00f3n de l\u00edmites antes del memset de alineaci\u00f3n para asegurar que buf_free_len pueda acomodar los bytes de relleno.\n\nEste es el mismo patr\u00f3n de error corregido por el commit beef2634f81f (\u2019ksmbd: fix potencial OOB in get_file_all_info() for compound requests\u2019) y el commit fda9522ed6af (\u2019ksmbd: fix OOB write in QUERY_INFO for compound requests\u2019), ambos de los cuales a\u00f1adieron comprobaciones de l\u00edmites antes de escrituras incondicionales en los manejadores de respuesta de QUERY_INFO."}], "id": "CVE-2026-31705", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-01T14:16:20.473", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/30010c952077a1c89ecdd71fc4d574c75a8f5617"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/790304c02bf9bd7b8171feda4294d6e62d32ae8f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/922d48fe8c19f388ffa2f709f33acaae4e408de2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/98f3de6ef4efbd899348d333f0902dc4ff14380c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ddbbc8b2a09dd2cfed90871313e3691ae1db08a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ffbce350c6fd1e99116ea57383b9031717e36d3b"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment", "id": "2464434", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464434"}, "csaw": false, "cwe": "CWE-787", "details": ["A flaw was found in the ksmbd component of the Linux kernel. This out-of-bounds write vulnerability occurs when processing Server Message Block (SMB) extended attribute (EA) information. Specifically, the `smb2_get_ea()` function performs an unconditional memory write for alignment padding without checking for sufficient buffer space. This can lead to overwriting adjacent kernel heap memory, potentially allowing a remote attacker to cause a denial of service or execute arbitrary code."], "name": "CVE-2026-31705", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31705\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31705\nhttps://lore.kernel.org/linux-cve-announce/2026050121-CVE-2026-31705-5bdc@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d,ffbce350c6fd1e99116ea57383b9031717e36d3b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d,98f3de6ef4efbd899348d333f0902dc4ff14380c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d,790304c02bf9bd7b8171feda4294d6e62d32ae8f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d,922d48fe8c19f388ffa2f709f33acaae4e408de2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e2b76ab8b5c9327ab2dae6da05d0752eb2f4771d,30010c952077a1c89ecdd71fc4d574c75a8f5617)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "f2283680a80571ca82d710bc6ecd8f8beac67d63"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "9f297df20d93411c0b4ddad7f88ba04a7cd36e77"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.84,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.25,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.2,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1-rc1,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T19:45:23.956176+00:00", "updated": "2026-05-03T09:30:16.069223+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}