CVE-2026-43099

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43099", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.984Z", "datePublished": "2026-05-06T07:40:29.567Z", "dateUpdated": "2026-10-15T01:19:07.639Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:54.285Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: fix null-ptr-deref in icmp_build_probe()\n\nipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the\nIPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing\nthis error pointer to dev_hold() will cause a kernel crash with\nnull-ptr-deref.\n\nInstead, silently discard the request. RFC 8335 does not appear to\ndefine a specific response for the case where an IPv6 interface\nidentifier is syntactically valid but the implementation cannot perform\nthe lookup at runtime, and silently dropping the request may safer than\nmisreporting \"No Such Interface\"."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable path is reached by an inbound IPv4 ICMP Extended Echo request processed by the kernel network stack. A remote host can send such ICMP packets to a target that has RFC 8335 probe replies enabled.\nAC:L - In the vulnerable deployment, a single well-formed ICMP probe with an IPv6 address identifier deterministically reaches the bad `dev_hold()` call. There is no race, heap shaping, or attacker-uncontrolled timing requirement.\nPR:N - The packet is processed before any authentication and does not require a local account or kernel capability from the attacker. The sysctl is a target configuration gate, not an attacker privilege requirement.\nUI:N - No victim user action is needed after the target is configured to answer ICMP probes. The attacker only sends a network packet.\nS:U - The impact is within the same kernel/network stack security authority. It does not cross a VM, sandbox, or hardware isolation boundary.\nC:N - The bug is an ERR_PTR/NULL-style dereference in `dev_hold()`, causing an oops rather than an information disclosure primitive. I found no evidence of attacker-controlled memory read.\nI:N - The invalid pointer is dereferenced for a reference count operation and is not a controllable write to a valid attacker-chosen object. This is a crash-only condition, not memory corruption enabling integrity modification.\nA:H - The invalid pointer dereference can crash the kernel, causing a high-impact denial of service. It is remotely repeatable against affected and configured systems."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/icmp.c"], "versions": [{"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "0f21bc261e60f0c696c58841c4873ff77ed83673", "status": "affected", "versionType": "git"}, {"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "dc5db4db19766a61ad65d81d1f55b1c1e51ba78d", "status": "affected", "versionType": "git"}, {"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "47a8bf52156ac7e7a581eca31c1f964ba4258d4d", "status": "affected", "versionType": "git"}, {"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "6be325206850a0891896d38bcf83a09d8b54ec48", "status": "affected", "versionType": "git"}, {"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "f91b3ed9e7fa82a70511b5f6901c88379acf2964", "status": "affected", "versionType": "git"}, {"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "5b9911582d441f72fe6ccb15ffe3303bbc07f6f5", "status": "affected", "versionType": "git"}, {"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "lessThan": "fde29fd9349327acc50d19a0b5f3d5a6c964dfd8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/icmp.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0f21bc261e60f0c696c58841c4873ff77ed83673"}, {"url": "https://git.kernel.org/stable/c/dc5db4db19766a61ad65d81d1f55b1c1e51ba78d"}, {"url": "https://git.kernel.org/stable/c/47a8bf52156ac7e7a581eca31c1f964ba4258d4d"}, {"url": "https://git.kernel.org/stable/c/6be325206850a0891896d38bcf83a09d8b54ec48"}, {"url": "https://git.kernel.org/stable/c/f91b3ed9e7fa82a70511b5f6901c88379acf2964"}, {"url": "https://git.kernel.org/stable/c/5b9911582d441f72fe6ccb15ffe3303bbc07f6f5"}, {"url": "https://git.kernel.org/stable/c/fde29fd9349327acc50d19a0b5f3d5a6c964dfd8"}], "title": "ipv4: icmp: fix null-ptr-deref in icmp_build_probe()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:19:07.639Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/icmp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0f21bc261e60f0c696c58841c4873ff77ed83673", "status": "affected", "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "versionType": "git"}, {"lessThan": "dc5db4db19766a61ad65d81d1f55b1c1e51ba78d", "status": "affected", "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "versionType": "git"}, {"lessThan": "47a8bf52156ac7e7a581eca31c1f964ba4258d4d", "status": "affected", "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "versionType": "git"}, {"lessThan": "6be325206850a0891896d38bcf83a09d8b54ec48", "status": "affected", "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "versionType": "git"}, {"lessThan": "f91b3ed9e7fa82a70511b5f6901c88379acf2964", "status": "affected", "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "versionType": "git"}, {"lessThan": "5b9911582d441f72fe6ccb15ffe3303bbc07f6f5", "status": "affected", "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "versionType": "git"}, {"lessThan": "fde29fd9349327acc50d19a0b5f3d5a6c964dfd8", "status": "affected", "version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/icmp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.83", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1CA556B4-5EB8-4B96-AEEA-6BDC9CC8BF90", "versionEndExcluding": "6.6.136", "versionStartIncluding": "5.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: fix null-ptr-deref in icmp_build_probe()\n\nipv6_stub->ipv6_dev_find() may return ERR_PTR(-EAFNOSUPPORT) when the\nIPv6 stack is not active (CONFIG_IPV6=m and not loaded), and passing\nthis error pointer to dev_hold() will cause a kernel crash with\nnull-ptr-deref.\n\nInstead, silently discard the request. RFC 8335 does not appear to\ndefine a specific response for the case where an IPv6 interface\nidentifier is syntactically valid but the implementation cannot perform\nthe lookup at runtime, and silently dropping the request may safer than\nmisreporting \"No Such Interface\"."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nipv4: icmp: correcci\u00f3n de desreferencia de puntero nulo en icmp_build_probe()\n\nipv6_stub -> ipv6_dev_find() puede devolver ERR_PTR(-EAFNOSUPPORT) cuando la pila IPv6 no est\u00e1 activa (CONFIG_IPV6=m y no cargada), y pasar este puntero de error a dev_hold() causar\u00e1 un fallo del kernel con desreferencia de puntero nulo.\n\nEn su lugar, descartar silenciosamente la solicitud. RFC 8335 no parece definir una respuesta espec\u00edfica para el caso en que un identificador de interfaz IPv6 es sint\u00e1cticamente v\u00e1lido pero la implementaci\u00f3n no puede realizar la b\u00fasqueda en tiempo de ejecuci\u00f3n, y descartar silenciosamente la solicitud puede ser m\u00e1s seguro que informar err\u00f3neamente \u2019No Such Interface\u2019."}], "id": "CVE-2026-43099", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-05-06T10:16:23.400", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f21bc261e60f0c696c58841c4873ff77ed83673"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/47a8bf52156ac7e7a581eca31c1f964ba4258d4d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5b9911582d441f72fe6ccb15ffe3303bbc07f6f5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6be325206850a0891896d38bcf83a09d8b54ec48"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc5db4db19766a61ad65d81d1f55b1c1e51ba78d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f91b3ed9e7fa82a70511b5f6901c88379acf2964"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fde29fd9349327acc50d19a0b5f3d5a6c964dfd8"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ipv4: icmp: fix null-ptr-deref in icmp_build_probe()", "id": "2466997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466997"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-253", "details": ["A flaw was found in the Linux kernel, specifically within the IPv4 (Internet Protocol version 4) and ICMP (Internet Control Message Protocol) components. When the IPv6 (Internet Protocol version 6) stack is not active, a specific function (`ipv6_dev_find`) can return an error. If this error is then passed to another function (`dev_hold`), it leads to a null pointer dereference, causing the kernel to crash. This vulnerability could result in a Denial of Service (DoS) for the affected system."], "name": "CVE-2026-43099", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43099\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43099\nhttps://lore.kernel.org/linux-cve-announce/2026050620-CVE-2026-43099-96e4@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d329ea5bd8845f0b196bf41b18b6173340d6e0e4,47a8bf52156ac7e7a581eca31c1f964ba4258d4d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d329ea5bd8845f0b196bf41b18b6173340d6e0e4,6be325206850a0891896d38bcf83a09d8b54ec48)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d329ea5bd8845f0b196bf41b18b6173340d6e0e4,f91b3ed9e7fa82a70511b5f6901c88379acf2964)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d329ea5bd8845f0b196bf41b18b6173340d6e0e4,5b9911582d441f72fe6ccb15ffe3303bbc07f6f5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d329ea5bd8845f0b196bf41b18b6173340d6e0e4,fde29fd9349327acc50d19a0b5f3d5a6c964dfd8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.83,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.24,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.14,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T12:15:03.930876+00:00", "updated": "2026-05-11T18:45:25.676987+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}