CVE-2026-53198

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53198", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.391Z", "datePublished": "2026-06-25T08:39:07.650Z", "dateUpdated": "2026-10-15T01:22:39.317Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:34:01.831Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL\n\nA deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on\nconn->async_requests via setup_async_work(), with cancel_fn =\nsmb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock.\n\nWhen the request is cancelled, the worker frees the file_lock with\nlocks_free_lock() and takes the cancelled early-exit, which \"goto out\"s and never\nreaches release_async_work() -- the only site that unlinks the work from\nconn->async_requests and clears cancel_fn/cancel_argv. The work therefore stays\nmatchable on async_requests with a live cancel_fn pointing at the freed file_lock,\nuntil connection teardown finally runs release_async_work().\n\nsmb2_cancel() fires cancel_fn unconditionally with no state guard, so a second\nSMB2_CANCEL for the same AsyncId, arriving in that window, re-runs\nsmb2_remove_blocked_lock() on the freed file_lock -- a slab use-after-free:\n\n BUG: KASAN: slab-use-after-free in __locks_delete_block\n __locks_delete_block\n locks_delete_block\n ksmbd_vfs_posix_lock_unblock\n smb2_remove_blocked_lock\n smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn\n handle_ksmbd_work\n Allocated by ...: locks_alloc_lock <- smb2_lock\n Freed by ...: locks_free_lock <- smb2_lock (cancelled branch)\n ... cache file_lock_cache of size 192\n\nReproduced on mainline with KASAN by an authenticated SMB client.\n\nSkip a work whose state is already KSMBD_WORK_CANCELLED so its cancel callback\ncannot be fired a second time."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - ksmbd is an in-kernel SMB server reachable over the network via SMB2/SMB3 requests, typically on TCP port 445. The vulnerable path is driven by SMB2_LOCK and repeated SMB2_CANCEL messages from a remote SMB client.\nAC:L - The attacker can create the deferred byte-range lock by holding a conflicting lock and then sending repeated SMB2_CANCEL requests for the same AsyncId. The race/window is attacker-driven and repeatable, so there are no meaningful conditions outside attacker control.\nPR:L - The SMB2_LOCK path requires a valid SMB2 session, tree connection, and open file handle, and the fix commit states it was reproduced by an authenticated SMB client. No kernel or administrative privilege is required, only ordinary SMB access.\nUI:N - No victim user action is required after the attacker has SMB access. The attacker sends the lock and cancel requests directly to the server.\nS:U - The vulnerability corrupts memory within the same kernel security authority that processes the SMB request. It does not cross a separate sandbox, hypervisor, or device security boundary.\nC:H - This is a slab use-after-free of struct file_lock from file_lock_cache, and the stale callback reuses the freed object in generic file-locking code. Under the required high-severity assumption for UAFs, this can support kernel memory disclosure.\nI:H - The stale file_lock is passed into list and waitqueue manipulation paths such as locks_delete_block and locks_wake_up, giving a plausible kernel memory corruption primitive after heap reuse. Under the required high-severity assumption for UAFs, integrity impact is high.\nA:H - The commit includes a KASAN slab-use-after-free report in the ksmbd worker path, and re-triggering the bug can crash or destabilize the kernel. Kernel oops/panic availability impact is high."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/smb2pdu.c"], "versions": [{"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "b7063c7426ea5a4d15e01b60538718765392f49d", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "89ae9df09d2c1fb4a4eb495c113a7ce1dca34147", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "14d2eee0193ac3cd1bf3d014373449f0b8d35d6d", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694", "status": "affected", "versionType": "git"}, {"version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "lessThan": "f580d27e8928828693df44ba2db0fffdbe11dfea", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/server/smb2pdu.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.94", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.36", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b7063c7426ea5a4d15e01b60538718765392f49d"}, {"url": "https://git.kernel.org/stable/c/0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd"}, {"url": "https://git.kernel.org/stable/c/89ae9df09d2c1fb4a4eb495c113a7ce1dca34147"}, {"url": "https://git.kernel.org/stable/c/14d2eee0193ac3cd1bf3d014373449f0b8d35d6d"}, {"url": "https://git.kernel.org/stable/c/2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694"}, {"url": "https://git.kernel.org/stable/c/f580d27e8928828693df44ba2db0fffdbe11dfea"}], "title": "ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:22:39.317Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/server/smb2pdu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b7063c7426ea5a4d15e01b60538718765392f49d", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "89ae9df09d2c1fb4a4eb495c113a7ce1dca34147", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "14d2eee0193ac3cd1bf3d014373449f0b8d35d6d", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}, {"lessThan": "f580d27e8928828693df44ba2db0fffdbe11dfea", "status": "affected", "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/server/smb2pdu.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.94", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.36", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BEE6A847-3BF9-4C9A-BD24-07B511BBBD5E", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9", "versionEndExcluding": "6.12.94", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3", "versionEndExcluding": "6.18.36", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E", "versionEndExcluding": "7.0.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL\n\nA deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on\nconn->async_requests via setup_async_work(), with cancel_fn =\nsmb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock.\n\nWhen the request is cancelled, the worker frees the file_lock with\nlocks_free_lock() and takes the cancelled early-exit, which \"goto out\"s and never\nreaches release_async_work() -- the only site that unlinks the work from\nconn->async_requests and clears cancel_fn/cancel_argv. The work therefore stays\nmatchable on async_requests with a live cancel_fn pointing at the freed file_lock,\nuntil connection teardown finally runs release_async_work().\n\nsmb2_cancel() fires cancel_fn unconditionally with no state guard, so a second\nSMB2_CANCEL for the same AsyncId, arriving in that window, re-runs\nsmb2_remove_blocked_lock() on the freed file_lock -- a slab use-after-free:\n\n BUG: KASAN: slab-use-after-free in __locks_delete_block\n __locks_delete_block\n locks_delete_block\n ksmbd_vfs_posix_lock_unblock\n smb2_remove_blocked_lock\n smb2_cancel <- 2nd SMB2_CANCEL fires cancel_fn\n handle_ksmbd_work\n Allocated by ...: locks_alloc_lock <- smb2_lock\n Freed by ...: locks_free_lock <- smb2_lock (cancelled branch)\n ... cache file_lock_cache of size 192\n\nReproduced on mainline with KASAN by an authenticated SMB client.\n\nSkip a work whose state is already KSMBD_WORK_CANCELLED so its cancel callback\ncannot be fired a second time."}], "id": "CVE-2026-53198", "lastModified": "2026-10-15T02:20:04.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-25T09:16:37.323", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/14d2eee0193ac3cd1bf3d014373449f0b8d35d6d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/89ae9df09d2c1fb4a4eb495c113a7ce1dca34147"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b7063c7426ea5a4d15e01b60538718765392f49d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f580d27e8928828693df44ba2db0fffdbe11dfea"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL", "id": "2492720", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492720"}, "csaw": false, "cwe": "CWE-1341", "details": ["A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel SMB server. An authenticated SMB client can trigger a use-after-free vulnerability by sending a double SMB2_CANCEL request for the same asynchronous operation. This can lead to memory corruption, potentially allowing an attacker to cause a denial of service or execute arbitrary code."], "name": "CVE-2026-53198", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53198\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53198\nhttps://lore.kernel.org/linux-cve-announce/2026062559-CVE-2026-53198-8bc8@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b7063c7426ea5a4d15e01b60538718765392f49d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,14d2eee0193ac3cd1bf3d014373449f0b8d35d6d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,89ae9df09d2c1fb4a4eb495c113a7ce1dca34147)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,14d2eee0193ac3cd1bf3d014373449f0b8d35d6d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f580d27e8928828693df44ba2db0fffdbe11dfea)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.1.176)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.6.143)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.94)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.36)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.0.13)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.94,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.36,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.13,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-25T11:00:11.393963+00:00", "updated": "2026-08-12T07:45:16.705598+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}