CVE-2026-63796

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63796", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.012Z", "datePublished": "2026-07-19T12:02:04.634Z", "dateUpdated": "2026-10-19T20:07:47.316Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:51:01.192Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reject oversized group bitmap descriptors\n\nocfs2_validate_gd_parent() only bounds bg_bits against the parent\nallocator's chain geometry. A malicious descriptor can still claim a\nbg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in\nthe group descriptor block, so later bitmap scans and bit updates can run\npast bg_bitmap.\n\nAdd a physical-cap check based on ocfs2_group_bitmap_size() for the parent\nallocator type and reject descriptors whose bg_size or bg_bits exceed that\ncapacity. Keep the existing chain geometry check so both the on-disk\nbitmap layout and the allocator metadata must agree before the descriptor\nis used.\n\nValidation reproduced this kernel report:\nKASAN use-after-free in _find_next_bit+0x7f/0xc0\nRead of size 8\nCall trace:\n dump_stack_lvl+0x66/0xa0 (?:?)\n print_report+0xd0/0x630 (?:?)\n _find_next_bit+0x7f/0xc0 (?:?)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n __virt_addr_valid+0x188/0x2f0 (?:?)\n kasan_report+0xe4/0x120 (?:?)\n ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375)\n ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457)\n ocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86)\n ocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786)\n ocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886)\n get_page_from_freelist+0x70e/0x2370 (?:?)\n lock_release+0xc6/0x290 (?:?)\n do_raw_spin_unlock+0x9a/0x100 (?:?)\n kasan_unpoison+0x27/0x60 (?:?)\n __bfs+0x147/0x240 (?:?)\n get_page_from_freelist+0x83d/0x2370 (?:?)\n ocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96)\n sched_domains_numa_masks_clear+0x70/0xd0 (?:?)\n check_irq_usage+0xe8/0xb70 (?:?)\n __ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497)\n check_path+0x24/0x50 (?:?)\n rcu_is_watching+0x20/0x50 (?:?)\n check_prev_add+0xfd/0xd00 (?:?)\n ocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?)\n __folio_batch_add_and_move+0x1f5/0x3d0 (?:?)\n ocfs2_add_inode_data+0xd9/0x120 (fs/ocfs2/suballoc.c:?)\n filemap_add_folio+0x105/0x1f0 (?:?)\n ocfs2_write_begin_nolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043)\n ocfs2_read_inode_block+0xb5/0x110 (fs/ocfs2/suballoc.c:?)\n down_write+0xf5/0x180 (?:?)\n ocfs2_write_begin+0x180/0x240 (fs/ocfs2/suballoc.c:?)\n __mark_inode_dirty+0x758/0x9a0 (?:?)\n inode_to_bdi+0x41/0x90 (?:?)\n balance_dirty_pages_ratelimited_flags+0xf8/0x1d0 (?:?)\n generic_perform_write+0x252/0x440 (?:?)\n mnt_put_write_access_file+0x16/0x70 (?:?)\n file_update_time_flags+0xe4/0x200 (?:?)\n ocfs2_file_write_iter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?)\n lock_acquire+0x184/0x2f0 (?:?)\n ksys_write+0xd2/0x170 (?:?)\n apparmor_file_permission+0xf5/0x310 (?:?)\n read_zero+0x8d/0x140 (?:?)\n lock_is_held_type+0x8f/0x100 (?:?)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - OCFS2 registers `ocfs2_export_ops` and is commonly deployed on shared cluster storage exported via NFS; a remote NFS client write reaches `ocfs2_file_write_iter` \u2192 cluster allocation \u2192 the vulnerable bitmap scan without local shell access on the server.\nAC:L - Once a crafted group descriptor with oversized `bg_size`/`bg_bits` is on disk, a single file write reliably drives `ocfs2_find_max_contig_free_bits()` past `bg_bitmap`; the fix commit reproduced this deterministically under KASAN with no race or layout-dependent conditions.\nPR:L - Exploitation requires only write access to a file on the mounted OCFS2 volume (local unprivileged user) or equivalent NFS write credentials; mounting requires `CAP_SYS_ADMIN` but metadata planting on shared SAN/iSCSI LUNs is separate from the trigger privilege.\nUI:N - In the highest-impact scenario\u2014malicious group-descriptor metadata pre-placed on shared cluster storage already mounted in production\u2014the attacker triggers the bug with their own write and no additional victim action (mount, open, or click) is required at exploit time.\nS:U - The bug corrupts kernel heap memory during in-kernel filesystem allocation on the same host/NFS server; impact stays within the kernel\u2019s security authority and does not inherently cross VM, container, or IOMMU boundaries.\nC:H - Oversized `bg_bits` causes `_find_next_bit()` to read past the physical `bg_bitmap` region; the fix commit documents a KASAN use-after-free/out-of-bounds read, which is an arbitrary kernel memory read primitive under attacker-influenced scan bounds.\nI:H - The same inflated `bg_bits` drives `ocfs2_set_bit()` during `ocfs2_block_group_set_bits()`, enabling out-of-bounds writes in the group-descriptor buffer page that can be leveraged for heap corruption and control-flow hijacking.\nA:H - The reproduced KASAN fault in `_find_next_bit()` during cluster allocation on write demonstrates kernel memory corruption that causes oops/panic-level availability loss on affected nodes."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ocfs2/suballoc.c"], "versions": [{"version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "336340a0f8a141df8a4eb21a5a86f8ffb87769f6", "status": "affected", "versionType": "git"}, {"version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "296c6a42b1174395935ca4cfe8f393e37b698d54", "status": "affected", "versionType": "git"}, {"version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e", "status": "affected", "versionType": "git"}, {"version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "c5a125eadba05ba421c4b55e68da22b4a40d32b4", "status": "affected", "versionType": "git"}, {"version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "8f9903b0cdbb3155a8899410330b4b4d583a7a5c", "status": "affected", "versionType": "git"}, {"version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "4cd57ebee395041099fcdfcabb00749ce38d8b27", "status": "affected", "versionType": "git"}, {"version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "99c21e7263248c3f084756bfae08163cc5d6c62f", "status": "affected", "versionType": "git"}, {"version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "9bd541e09dffff27e5bec0f9f45b0228173a5375", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ocfs2/suballoc.c"], "versions": [{"version": "2.6.16", "status": "affected"}, {"version": "0", "lessThan": "2.6.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.260", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.211", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.177", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.144", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.38", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.3", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "5.10.260"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "5.15.211"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.1.177"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.6.144"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.12.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "6.18.38"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "7.1.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/336340a0f8a141df8a4eb21a5a86f8ffb87769f6"}, {"url": "https://git.kernel.org/stable/c/296c6a42b1174395935ca4cfe8f393e37b698d54"}, {"url": "https://git.kernel.org/stable/c/d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e"}, {"url": "https://git.kernel.org/stable/c/c5a125eadba05ba421c4b55e68da22b4a40d32b4"}, {"url": "https://git.kernel.org/stable/c/8f9903b0cdbb3155a8899410330b4b4d583a7a5c"}, {"url": "https://git.kernel.org/stable/c/4cd57ebee395041099fcdfcabb00749ce38d8b27"}, {"url": "https://git.kernel.org/stable/c/99c21e7263248c3f084756bfae08163cc5d6c62f"}, {"url": "https://git.kernel.org/stable/c/9bd541e09dffff27e5bec0f9f45b0228173a5375"}], "title": "ocfs2: reject oversized group bitmap descriptors", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63796", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:30:38.017553Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:07:47.316Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63796", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:30:38.017553Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:30:38.601Z"}}], "cna": {"title": "ocfs2: reject oversized group bitmap descriptors", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - OCFS2 registers `ocfs2_export_ops` and is commonly deployed on shared cluster storage exported via NFS; a remote NFS client write reaches `ocfs2_file_write_iter` \u2192 cluster allocation \u2192 the vulnerable bitmap scan without local shell access on the server.\nAC:L - Once a crafted group descriptor with oversized `bg_size`/`bg_bits` is on disk, a single file write reliably drives `ocfs2_find_max_contig_free_bits()` past `bg_bitmap`; the fix commit reproduced this deterministically under KASAN with no race or layout-dependent conditions.\nPR:L - Exploitation requires only write access to a file on the mounted OCFS2 volume (local unprivileged user) or equivalent NFS write credentials; mounting requires `CAP_SYS_ADMIN` but metadata planting on shared SAN/iSCSI LUNs is separate from the trigger privilege.\nUI:N - In the highest-impact scenario\u2014malicious group-descriptor metadata pre-placed on shared cluster storage already mounted in production\u2014the attacker triggers the bug with their own write and no additional victim action (mount, open, or click) is required at exploit time.\nS:U - The bug corrupts kernel heap memory during in-kernel filesystem allocation on the same host/NFS server; impact stays within the kernel\u2019s security authority and does not inherently cross VM, container, or IOMMU boundaries.\nC:H - Oversized `bg_bits` causes `_find_next_bit()` to read past the physical `bg_bitmap` region; the fix commit documents a KASAN use-after-free/out-of-bounds read, which is an arbitrary kernel memory read primitive under attacker-influenced scan bounds.\nI:H - The same inflated `bg_bits` drives `ocfs2_set_bit()` during `ocfs2_block_group_set_bits()`, enabling out-of-bounds writes in the group-descriptor buffer page that can be leveraged for heap corruption and control-flow hijacking.\nA:H - The reproduced KASAN fault in `_find_next_bit()` during cluster allocation on write demonstrates kernel memory corruption that causes oops/panic-level availability loss on affected nodes."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "336340a0f8a141df8a4eb21a5a86f8ffb87769f6", "versionType": "git"}, {"status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "296c6a42b1174395935ca4cfe8f393e37b698d54", "versionType": "git"}, {"status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e", "versionType": "git"}, {"status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "c5a125eadba05ba421c4b55e68da22b4a40d32b4", "versionType": "git"}, {"status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "8f9903b0cdbb3155a8899410330b4b4d583a7a5c", "versionType": "git"}, {"status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "4cd57ebee395041099fcdfcabb00749ce38d8b27", "versionType": "git"}, {"status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "99c21e7263248c3f084756bfae08163cc5d6c62f", "versionType": "git"}, {"status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "lessThan": "9bd541e09dffff27e5bec0f9f45b0228173a5375", "versionType": "git"}], "programFiles": ["fs/ocfs2/suballoc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.16"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.260", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.211", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.177", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.144", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.95", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.38", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.3", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ocfs2/suballoc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/336340a0f8a141df8a4eb21a5a86f8ffb87769f6"}, {"url": "https://git.kernel.org/stable/c/296c6a42b1174395935ca4cfe8f393e37b698d54"}, {"url": "https://git.kernel.org/stable/c/d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e"}, {"url": "https://git.kernel.org/stable/c/c5a125eadba05ba421c4b55e68da22b4a40d32b4"}, {"url": "https://git.kernel.org/stable/c/8f9903b0cdbb3155a8899410330b4b4d583a7a5c"}, {"url": "https://git.kernel.org/stable/c/4cd57ebee395041099fcdfcabb00749ce38d8b27"}, {"url": "https://git.kernel.org/stable/c/99c21e7263248c3f084756bfae08163cc5d6c62f"}, {"url": "https://git.kernel.org/stable/c/9bd541e09dffff27e5bec0f9f45b0228173a5375"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reject oversized group bitmap descriptors\n\nocfs2_validate_gd_parent() only bounds bg_bits against the parent\nallocator's chain geometry. A malicious descriptor can still claim a\nbg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in\nthe group descriptor block, so later bitmap scans and bit updates can run\npast bg_bitmap.\n\nAdd a physical-cap check based on ocfs2_group_bitmap_size() for the parent\nallocator type and reject descriptors whose bg_size or bg_bits exceed that\ncapacity. Keep the existing chain geometry check so both the on-disk\nbitmap layout and the allocator metadata must agree before the descriptor\nis used.\n\nValidation reproduced this kernel report:\nKASAN use-after-free in _find_next_bit+0x7f/0xc0\nRead of size 8\nCall trace:\n dump_stack_lvl+0x66/0xa0 (?:?)\n print_report+0xd0/0x630 (?:?)\n _find_next_bit+0x7f/0xc0 (?:?)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n __virt_addr_valid+0x188/0x2f0 (?:?)\n kasan_report+0xe4/0x120 (?:?)\n ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375)\n ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457)\n ocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86)\n ocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786)\n ocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886)\n get_page_from_freelist+0x70e/0x2370 (?:?)\n lock_release+0xc6/0x290 (?:?)\n do_raw_spin_unlock+0x9a/0x100 (?:?)\n kasan_unpoison+0x27/0x60 (?:?)\n __bfs+0x147/0x240 (?:?)\n get_page_from_freelist+0x83d/0x2370 (?:?)\n ocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96)\n sched_domains_numa_masks_clear+0x70/0xd0 (?:?)\n check_irq_usage+0xe8/0xb70 (?:?)\n __ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497)\n check_path+0x24/0x50 (?:?)\n rcu_is_watching+0x20/0x50 (?:?)\n check_prev_add+0xfd/0xd00 (?:?)\n ocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?)\n __folio_batch_add_and_move+0x1f5/0x3d0 (?:?)\n ocfs2_add_inode_data+0xd9/0x120 (fs/ocfs2/suballoc.c:?)\n filemap_add_folio+0x105/0x1f0 (?:?)\n ocfs2_write_begin_nolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043)\n ocfs2_read_inode_block+0xb5/0x110 (fs/ocfs2/suballoc.c:?)\n down_write+0xf5/0x180 (?:?)\n ocfs2_write_begin+0x180/0x240 (fs/ocfs2/suballoc.c:?)\n __mark_inode_dirty+0x758/0x9a0 (?:?)\n inode_to_bdi+0x41/0x90 (?:?)\n balance_dirty_pages_ratelimited_flags+0xf8/0x1d0 (?:?)\n generic_perform_write+0x252/0x440 (?:?)\n mnt_put_write_access_file+0x16/0x70 (?:?)\n file_update_time_flags+0xe4/0x200 (?:?)\n ocfs2_file_write_iter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?)\n lock_acquire+0x184/0x2f0 (?:?)\n ksys_write+0xd2/0x170 (?:?)\n apparmor_file_permission+0xf5/0x310 (?:?)\n read_zero+0x8d/0x140 (?:?)\n lock_is_held_type+0x8f/0x100 (?:?)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.260", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.211", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.177", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.144", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.95", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.38", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.3", "versionStartIncluding": "2.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "2.6.16"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:51:01.192Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63796", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:07:47.316Z", "dateReserved": "2026-07-19T07:54:57.012Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T12:02:04.634Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ocfs2/suballoc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "336340a0f8a141df8a4eb21a5a86f8ffb87769f6", "status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "versionType": "git"}, {"lessThan": "296c6a42b1174395935ca4cfe8f393e37b698d54", "status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "versionType": "git"}, {"lessThan": "d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e", "status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "versionType": "git"}, {"lessThan": "c5a125eadba05ba421c4b55e68da22b4a40d32b4", "status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "versionType": "git"}, {"lessThan": "8f9903b0cdbb3155a8899410330b4b4d583a7a5c", "status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "versionType": "git"}, {"lessThan": "4cd57ebee395041099fcdfcabb00749ce38d8b27", "status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "versionType": "git"}, {"lessThan": "99c21e7263248c3f084756bfae08163cc5d6c62f", "status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "versionType": "git"}, {"lessThan": "9bd541e09dffff27e5bec0f9f45b0228173a5375", "status": "affected", "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ocfs2/suballoc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.16"}, {"lessThan": "2.6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.260", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.211", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.177", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.144", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.95", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.38", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "524F7CF4-3630-49FE-B714-8F1D8D7A6185", "versionEndExcluding": "5.10.260", "versionStartIncluding": "2.6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D71C101E-388C-4A46-BD99-49049F7C5CFF", "versionEndExcluding": "5.15.211", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "333C9E30-7FD4-46A2-94EF-C1AA1F3EE28B", "versionEndExcluding": "6.1.177", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C8AD3BC8-C843-423C-B9DB-CB52F67F578E", "versionEndExcluding": "6.6.144", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E206B86-E0E3-4394-A93F-39F2D50A8AA8", "versionEndExcluding": "6.12.95", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA591B28-5D62-449E-BDBE-3C9391BF070A", "versionEndExcluding": "6.18.38", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E", "versionEndExcluding": "7.1.3", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reject oversized group bitmap descriptors\n\nocfs2_validate_gd_parent() only bounds bg_bits against the parent\nallocator's chain geometry. A malicious descriptor can still claim a\nbg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in\nthe group descriptor block, so later bitmap scans and bit updates can run\npast bg_bitmap.\n\nAdd a physical-cap check based on ocfs2_group_bitmap_size() for the parent\nallocator type and reject descriptors whose bg_size or bg_bits exceed that\ncapacity. Keep the existing chain geometry check so both the on-disk\nbitmap layout and the allocator metadata must agree before the descriptor\nis used.\n\nValidation reproduced this kernel report:\nKASAN use-after-free in _find_next_bit+0x7f/0xc0\nRead of size 8\nCall trace:\n dump_stack_lvl+0x66/0xa0 (?:?)\n print_report+0xd0/0x630 (?:?)\n _find_next_bit+0x7f/0xc0 (?:?)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n __virt_addr_valid+0x188/0x2f0 (?:?)\n kasan_report+0xe4/0x120 (?:?)\n ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375)\n ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457)\n ocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86)\n ocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786)\n ocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886)\n get_page_from_freelist+0x70e/0x2370 (?:?)\n lock_release+0xc6/0x290 (?:?)\n do_raw_spin_unlock+0x9a/0x100 (?:?)\n kasan_unpoison+0x27/0x60 (?:?)\n __bfs+0x147/0x240 (?:?)\n get_page_from_freelist+0x83d/0x2370 (?:?)\n ocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96)\n sched_domains_numa_masks_clear+0x70/0xd0 (?:?)\n check_irq_usage+0xe8/0xb70 (?:?)\n __ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497)\n check_path+0x24/0x50 (?:?)\n rcu_is_watching+0x20/0x50 (?:?)\n check_prev_add+0xfd/0xd00 (?:?)\n ocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?)\n __folio_batch_add_and_move+0x1f5/0x3d0 (?:?)\n ocfs2_add_inode_data+0xd9/0x120 (fs/ocfs2/suballoc.c:?)\n filemap_add_folio+0x105/0x1f0 (?:?)\n ocfs2_write_begin_nolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043)\n ocfs2_read_inode_block+0xb5/0x110 (fs/ocfs2/suballoc.c:?)\n down_write+0xf5/0x180 (?:?)\n ocfs2_write_begin+0x180/0x240 (fs/ocfs2/suballoc.c:?)\n __mark_inode_dirty+0x758/0x9a0 (?:?)\n inode_to_bdi+0x41/0x90 (?:?)\n balance_dirty_pages_ratelimited_flags+0xf8/0x1d0 (?:?)\n generic_perform_write+0x252/0x440 (?:?)\n mnt_put_write_access_file+0x16/0x70 (?:?)\n file_update_time_flags+0xe4/0x200 (?:?)\n ocfs2_file_write_iter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?)\n lock_acquire+0x184/0x2f0 (?:?)\n ksys_write+0xd2/0x170 (?:?)\n apparmor_file_permission+0xf5/0x310 (?:?)\n read_zero+0x8d/0x140 (?:?)\n lock_is_held_type+0x8f/0x100 (?:?)"}], "id": "CVE-2026-63796", "lastModified": "2026-10-19T20:19:20.113", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63796", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:30:38.017553Z", "version": "2.0.3"}}]}, "published": "2026-07-19T12:16:52.033", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/296c6a42b1174395935ca4cfe8f393e37b698d54"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/336340a0f8a141df8a4eb21a5a86f8ffb87769f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4cd57ebee395041099fcdfcabb00749ce38d8b27"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8f9903b0cdbb3155a8899410330b4b4d583a7a5c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/99c21e7263248c3f084756bfae08163cc5d6c62f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9bd541e09dffff27e5bec0f9f45b0228173a5375"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c5a125eadba05ba421c4b55e68da22b4a40d32b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: ocfs2: reject oversized group bitmap descriptors", "id": "2502205", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502205"}, "csaw": false, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nocfs2: reject oversized group bitmap descriptors\nocfs2_validate_gd_parent() only bounds bg_bits against the parent\nallocator's chain geometry. A malicious descriptor can still claim a\nbg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in\nthe group descriptor block, so later bitmap scans and bit updates can run\npast bg_bitmap.\nAdd a physical-cap check based on ocfs2_group_bitmap_size() for the parent\nallocator type and reject descriptors whose bg_size or bg_bits exceed that\ncapacity. Keep the existing chain geometry check so both the on-disk\nbitmap layout and the allocator metadata must agree before the descriptor\nis used.\nValidation reproduced this kernel report:\nKASAN use-after-free in _find_next_bit+0x7f/0xc0\nRead of size 8\nCall trace:\ndump_stack_lvl+0x66/0xa0 (?:?)\nprint_report+0xd0/0x630 (?:?)\n_find_next_bit+0x7f/0xc0 (?:?)\nsrso_alias_return_thunk+0x5/0xfbef5 (?:?)\n__virt_addr_valid+0x188/0x2f0 (?:?)\nkasan_report+0xe4/0x120 (?:?)\nocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375)\nocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457)\nocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86)\nocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786)\nocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886)\nget_page_from_freelist+0x70e/0x2370 (?:?)\nlock_release+0xc6/0x290 (?:?)\ndo_raw_spin_unlock+0x9a/0x100 (?:?)\nkasan_unpoison+0x27/0x60 (?:?)\n__bfs+0x147/0x240 (?:?)\nget_page_from_freelist+0x83d/0x2370 (?:?)\nocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96)\nsched_domains_numa_masks_clear+0x70/0xd0 (?:?)\ncheck_irq_usage+0xe8/0xb70 (?:?)\n__ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497)\ncheck_path+0x24/0x50 (?:?)\nrcu_is_watching+0x20/0x50 (?:?)\ncheck_prev_add+0xfd/0xd00 (?:?)\nocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?)\n__folio_batch_add_and_move+0x1f5/0x3d0 (?:?)\nocfs2_add_inode_data+0xd9/0x120 (fs/ocfs2/suballoc.c:?)\nfilemap_add_folio+0x105/0x1f0 (?:?)\nocfs2_write_begin_nolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043)\nocfs2_read_inode_block+0xb5/0x110 (fs/ocfs2/suballoc.c:?)\ndown_write+0xf5/0x180 (?:?)\nocfs2_write_begin+0x180/0x240 (fs/ocfs2/suballoc.c:?)\n__mark_inode_dirty+0x758/0x9a0 (?:?)\ninode_to_bdi+0x41/0x90 (?:?)\nbalance_dirty_pages_ratelimited_flags+0xf8/0x1d0 (?:?)\ngeneric_perform_write+0x252/0x440 (?:?)\nmnt_put_write_access_file+0x16/0x70 (?:?)\nfile_update_time_flags+0xe4/0x200 (?:?)\nocfs2_file_write_iter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?)\nlock_acquire+0x184/0x2f0 (?:?)\nksys_write+0xd2/0x170 (?:?)\napparmor_file_permission+0xf5/0x310 (?:?)\nread_zero+0x8d/0x140 (?:?)\nlock_is_held_type+0x8f/0x100 (?:?)", "A flaw was found in the Linux kernel's Oracle Cluster File System 2 (ocfs2). A local attacker could craft a malicious group bitmap descriptor that claims a size exceeding the physically allocated bitmap bytes. This improper input validation allows subsequent operations to read or write beyond the intended memory region, leading to a use-after-free vulnerability. This can result in a system crash (denial of service) or potentially lead to arbitrary code execution."], "name": "CVE-2026-63796", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63796\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63796\nhttps://lore.kernel.org/linux-cve-announce/2026071900-CVE-2026-63796-9a88@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ccd979bdbce9fba8412beb3f1de68a9d0171b12c,336340a0f8a141df8a4eb21a5a86f8ffb87769f6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ccd979bdbce9fba8412beb3f1de68a9d0171b12c,296c6a42b1174395935ca4cfe8f393e37b698d54)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ccd979bdbce9fba8412beb3f1de68a9d0171b12c,d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ccd979bdbce9fba8412beb3f1de68a9d0171b12c,c5a125eadba05ba421c4b55e68da22b4a40d32b4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ccd979bdbce9fba8412beb3f1de68a9d0171b12c,8f9903b0cdbb3155a8899410330b4b4d583a7a5c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ccd979bdbce9fba8412beb3f1de68a9d0171b12c,4cd57ebee395041099fcdfcabb00749ce38d8b27)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ccd979bdbce9fba8412beb3f1de68a9d0171b12c,99c21e7263248c3f084756bfae08163cc5d6c62f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ccd979bdbce9fba8412beb3f1de68a9d0171b12c,9bd541e09dffff27e5bec0f9f45b0228173a5375)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.260,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.211,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.177,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.144,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.95,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.38,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.3,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T12:00:05.501233+00:00", "updated": "2026-08-13T12:15:17.536390+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}