CVE-2026-46317

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46317", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.112Z", "datePublished": "2026-06-09T11:52:30.333Z", "dateUpdated": "2026-10-19T19:36:57.837Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:13.022Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Reassign nested_mmus array behind mmu_lock\n\nkvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the\nMMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which\ncan run at any time. kvm_vcpu_init_nested() reallocates the array and frees\nthe old buffer while holding only kvm->arch.config_lock, so such a walker\ncan reference the freed array.\n\nAllocate the new array outside of mmu_lock, as the allocation can sleep.\nUnder the lock, copy the existing entries, fix up the back pointers and\nreassign the array. Free the old buffer after dropping the lock, as\nkvfree() can sleep as well."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through KVM ioctls on /dev/kvm (KVM_CREATE_VCPU and KVM_ARM_VCPU_INIT), which drive kvm_vcpu_init_nested() while the MMU notifier path runs in the host kernel; this is a local syscall/ioctl attack surface, not a network protocol.\nAC:L - Exploitation is a race between KVM_ARM_VCPU_INIT reallocating nested_mmus and MMU notifier unmaps, and the attacker controls both sides by concurrently creating/initializing vCPUs and manipulating guest memory regions to trigger kvm_unmap_gfn_range().\nPR:L - The attacker needs access to /dev/kvm with nested virtualization enabled (KVM_ARM_VCPU_HAS_EL2), which a cloud tenant with nested-virt-capable AArch64 instances can obtain without host init-namespace root; this is not unauthenticated network access but is below full host administrator.\nUI:N - No victim interaction is required; the race can be driven entirely by the attacker's own KVM and memory-management ioctls from userspace.\nS:C - Successful exploitation corrupts host kernel memory from within a guest VM's KVM context, crossing the VM-to-hypervisor isolation boundary and enabling host kernel compromise (VM escape) on AArch64 cloud servers running nested virtualization.\nC:H - The freed nested_mmus array is a use-after-free; concurrent walkers under mmu_lock dereference kvm_s2_mmu structures and their page-table pointers, enabling arbitrary kernel memory disclosure.\nI:H - UAF on kvm_s2_mmu objects that contain kvm_pgtable pointers and stage-2 page-table state can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a benign crash.\nA:H - Concurrent access to the freed nested_mmus buffer during kvm_nested_s2_unmap() or related MMU walks can cause kernel oopses, panics, or hangs on the host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/nested.c"], "versions": [{"version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "lessThan": "918450ad6010df6ecd2efde12a1409e011da22d6", "status": "affected", "versionType": "git"}, {"version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "lessThan": "4424dbcb06d68e34e51c019a5781a7dc00731971", "status": "affected", "versionType": "git"}, {"version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "lessThan": "70543358fa08e0f7cebc3447c3b70fe97ad7aaa8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/kvm/nested.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/918450ad6010df6ecd2efde12a1409e011da22d6"}, {"url": "https://git.kernel.org/stable/c/4424dbcb06d68e34e51c019a5781a7dc00731971"}, {"url": "https://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8"}], "title": "KVM: arm64: Reassign nested_mmus array behind mmu_lock", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46317", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:21:55.763760Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:36:57.837Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46317", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:21:55.763760Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:21:56.323Z"}}], "cna": {"title": "KVM: arm64: Reassign nested_mmus array behind mmu_lock", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through KVM ioctls on /dev/kvm (KVM_CREATE_VCPU and KVM_ARM_VCPU_INIT), which drive kvm_vcpu_init_nested() while the MMU notifier path runs in the host kernel; this is a local syscall/ioctl attack surface, not a network protocol.\nAC:L - Exploitation is a race between KVM_ARM_VCPU_INIT reallocating nested_mmus and MMU notifier unmaps, and the attacker controls both sides by concurrently creating/initializing vCPUs and manipulating guest memory regions to trigger kvm_unmap_gfn_range().\nPR:L - The attacker needs access to /dev/kvm with nested virtualization enabled (KVM_ARM_VCPU_HAS_EL2), which a cloud tenant with nested-virt-capable AArch64 instances can obtain without host init-namespace root; this is not unauthenticated network access but is below full host administrator.\nUI:N - No victim interaction is required; the race can be driven entirely by the attacker's own KVM and memory-management ioctls from userspace.\nS:C - Successful exploitation corrupts host kernel memory from within a guest VM's KVM context, crossing the VM-to-hypervisor isolation boundary and enabling host kernel compromise (VM escape) on AArch64 cloud servers running nested virtualization.\nC:H - The freed nested_mmus array is a use-after-free; concurrent walkers under mmu_lock dereference kvm_s2_mmu structures and their page-table pointers, enabling arbitrary kernel memory disclosure.\nI:H - UAF on kvm_s2_mmu objects that contain kvm_pgtable pointers and stage-2 page-table state can be leveraged for arbitrary kernel writes and control-flow hijacking, not merely a benign crash.\nA:H - Concurrent access to the freed nested_mmus buffer during kvm_nested_s2_unmap() or related MMU walks can cause kernel oopses, panics, or hangs on the host."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "lessThan": "918450ad6010df6ecd2efde12a1409e011da22d6", "versionType": "git"}, {"status": "affected", "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "lessThan": "4424dbcb06d68e34e51c019a5781a7dc00731971", "versionType": "git"}, {"status": "affected", "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "lessThan": "70543358fa08e0f7cebc3447c3b70fe97ad7aaa8", "versionType": "git"}], "programFiles": ["arch/arm64/kvm/nested.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"status": "unaffected", "version": "0", "lessThan": "6.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.35", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.12", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/arm64/kvm/nested.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/918450ad6010df6ecd2efde12a1409e011da22d6"}, {"url": "https://git.kernel.org/stable/c/4424dbcb06d68e34e51c019a5781a7dc00731971"}, {"url": "https://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Reassign nested_mmus array behind mmu_lock\n\nkvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the\nMMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which\ncan run at any time. kvm_vcpu_init_nested() reallocates the array and frees\nthe old buffer while holding only kvm->arch.config_lock, so such a walker\ncan reference the freed array.\n\nAllocate the new array outside of mmu_lock, as the allocation can sleep.\nUnder the lock, copy the existing entries, fix up the back pointers and\nreassign the array. Free the old buffer after dropping the lock, as\nkvfree() can sleep as well."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "6.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:13.022Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46317", "state": "PUBLISHED", "dateUpdated": "2026-10-16T15:31:16.299Z", "dateReserved": "2026-05-13T15:03:33.112Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-06-09T11:52:30.333Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/arm64/kvm/nested.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "918450ad6010df6ecd2efde12a1409e011da22d6", "status": "affected", "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "versionType": "git"}, {"lessThan": "4424dbcb06d68e34e51c019a5781a7dc00731971", "status": "affected", "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "versionType": "git"}, {"lessThan": "70543358fa08e0f7cebc3447c3b70fe97ad7aaa8", "status": "affected", "version": "4f128f8e1aaac189f83d0f828bcdb2986d8d2e51", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/arm64/kvm/nested.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CB828803-5FA4-4A1C-A77D-0A10A2BAFDC6", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Reassign nested_mmus array behind mmu_lock\n\nkvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the\nMMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which\ncan run at any time. kvm_vcpu_init_nested() reallocates the array and frees\nthe old buffer while holding only kvm->arch.config_lock, so such a walker\ncan reference the freed array.\n\nAllocate the new array outside of mmu_lock, as the allocation can sleep.\nUnder the lock, copy the existing entries, fix up the back pointers and\nreassign the array. Free the old buffer after dropping the lock, as\nkvfree() can sleep as well."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nKVM: arm64: Reasignar el array nested_mmus detr\u00e1s de mmu_lock\n\nkvm->arch.nested_mmus[] es recorrido bajo kvm->mmu_lock, incluyendo desde la ruta del notificador de MMU (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), que puede ejecutarse en cualquier momento. kvm_vcpu_init_nested() reasigna el array y libera el b\u00fafer antiguo mientras mantiene solo kvm->arch.config_lock, por lo que dicho recorredor puede referenciar el array liberado.\n\nAsignar el nuevo array fuera de mmu_lock, ya que la asignaci\u00f3n puede dormir. Bajo el bloqueo, copiar las entradas existentes, corregir los punteros inversos y reasignar el array. Liberar el b\u00fafer antiguo despu\u00e9s de soltar el bloqueo, ya que kvfree() tambi\u00e9n puede dormir."}], "id": "CVE-2026-46317", "lastModified": "2026-10-19T20:18:42.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46317", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:21:55.763760Z", "version": "2.0.3"}}]}, "published": "2026-06-09T13:16:37.000", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4424dbcb06d68e34e51c019a5781a7dc00731971"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/70543358fa08e0f7cebc3447c3b70fe97ad7aaa8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/918450ad6010df6ecd2efde12a1409e011da22d6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock", "id": "2486976", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486976"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) for arm64 architectures. An issue in the reallocation of the `nested_mmus` array allows a process to access freed memory. This memory corruption vulnerability could enable a local attacker to escalate privileges or cause a denial of service."], "name": "CVE-2026-46317", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46317\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46317\nhttps://lore.kernel.org/linux-cve-announce/2026060938-CVE-2026-46317-e13c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4f128f8e1aaac189f83d0f828bcdb2986d8d2e51,918450ad6010df6ecd2efde12a1409e011da22d6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4f128f8e1aaac189f83d0f828bcdb2986d8d2e51,4424dbcb06d68e34e51c019a5781a7dc00731971)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4f128f8e1aaac189f83d0f828bcdb2986d8d2e51,70543358fa08e0f7cebc3447c3b70fe97ad7aaa8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc7,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-09T14:00:06.846528+00:00", "updated": "2026-10-23T02:00:16.731627+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}