CVE-2026-63942

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63942", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.022Z", "datePublished": "2026-07-19T14:55:37.717Z", "dateUpdated": "2026-10-19T20:17:58.246Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:29.875Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nparport: Fix race between port and client registration\n\nThe parport subsystem registers port devices before they are fully\ninitialised, resulting in a race condition where client drivers such\nas lp can attach to ports that are not completely initialised or even\nbeing torn down.\n\nWhen the port and client drivers are built as modules and loaded\naround the same time during boot, this occasionally results in a\ncrash. I was able to make this happen reliably in a VM with a\nPC-style parallel port by patching parport_pc to fail probing:\n\n> --- a/drivers/parport/parport_pc.c\n> +++ b/drivers/parport/parport_pc.c\n> @@ -2069,7 +2069,7 @@ static struct parport *__parport_pc_probe_port(unsigned long int base,\n> \tif (!p)\n> \t\tgoto out3;\n>\n> -\tbase_res = request_region(base, 3, p->name);\n> +\tbase_res = NULL;\n> \tif (!base_res)\n> \t\tgoto out4;\n>\n\nand then running:\n\n while true; do\n modprobe lp & modprobe parport_pc\n\twait\n\trmmod lp parport_pc\n done\n\nfor a few seconds.\n\nIn the long term I think port registration should be changed to put\nthe call to device_add() inside parport_announce_port(), but since the\nlatter currently cannot fail this will require changing all port\ndrivers.\n\nFor now, add a flag to indicate whether a port has been \"announced\"\nand only try to attach client drivers to ports when the flag is set."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through local kernel module registration paths (init_module/finit_module/modprobe or built-in initcalls during boot), not via network or physical port I/O. An attacker must locally orchestrate concurrent loading of parport client and port drivers.\nAC:L - The attacker controls both sides of the race by concurrently loading/unloading `lp` (or `ppdev`) and `parport_pc`; the fix author reproduced this reliably with a tight modprobe/rmmod loop. Success does not depend on uncontrollable timing or memory layout.\nPR:L - Triggering the race requires CAP_SYS_MODULE to load the relevant modules, which is obtainable by an unprivileged user in a user namespace on systems that permit it; it is not limited to irreducible init-namespace root.\nUI:N - Exploitation requires no victim interaction beyond the attacker's own module-load activity; boot-time crashes from parallel module loading also occur without user action.\nS:U - Impact is confined to kernel memory and availability within the same kernel security domain; there is no VM escape, sandbox breakout, or cross-authority boundary crossing.\nC:H - Client drivers can attach while a port is partially initialized (e.g., NULL `port->dev` causing `device_add` failure) or actively being torn down after probe failure, creating a use-after-free window on the `parport` structure that can expose kernel memory.\nI:H - The same race window permits client attachment to ports with uninitialized or freed `parport_operations`/private data, enabling calls through invalid function pointers and heap corruption primitives consistent with control-flow hijacking.\nA:H - Confirmed real-world kernel oops/panic during boot (Debian #1130365) with NULL instruction pointer, and the fix author demonstrated reliable crashes from the modprobe race loop."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/parport/share.c", "include/linux/parport.h"], "versions": [{"version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "f3378b0d7bd4605de89b083b2900788157a181cc", "status": "affected", "versionType": "git"}, {"version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "290f515c5e3b3900bc2fe24f179999fd08d23bfa", "status": "affected", "versionType": "git"}, {"version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "d16548be2ea5058227d79799e81dab61c9bca8ec", "status": "affected", "versionType": "git"}, {"version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "15b1723c1472e802f9f7e69ae4e64f7dbf588848", "status": "affected", "versionType": "git"}, {"version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "51026cff1f4f3b762a0b5a07c727bd59cef45320", "status": "affected", "versionType": "git"}, {"version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "74d6aae1df45d3414178986be743f946988fddf6", "status": "affected", "versionType": "git"}, {"version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "a1e81b58da0179531bedf0b9f2811f5f992d5c4b", "status": "affected", "versionType": "git"}, {"version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "ef15ccbb3e8640a723c42ad90eaf81d66ae02017", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/parport/share.c", "include/linux/parport.h"], "versions": [{"version": "4.2", "status": "affected"}, {"version": "0", "lessThan": "4.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f3378b0d7bd4605de89b083b2900788157a181cc"}, {"url": "https://git.kernel.org/stable/c/290f515c5e3b3900bc2fe24f179999fd08d23bfa"}, {"url": "https://git.kernel.org/stable/c/d16548be2ea5058227d79799e81dab61c9bca8ec"}, {"url": "https://git.kernel.org/stable/c/15b1723c1472e802f9f7e69ae4e64f7dbf588848"}, {"url": "https://git.kernel.org/stable/c/51026cff1f4f3b762a0b5a07c727bd59cef45320"}, {"url": "https://git.kernel.org/stable/c/74d6aae1df45d3414178986be743f946988fddf6"}, {"url": "https://git.kernel.org/stable/c/a1e81b58da0179531bedf0b9f2811f5f992d5c4b"}, {"url": "https://git.kernel.org/stable/c/ef15ccbb3e8640a723c42ad90eaf81d66ae02017"}], "title": "parport: Fix race between port and client registration", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63942", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:33:55.831357Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:17:58.246Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63942", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:33:55.831357Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:33:56.452Z"}}], "cna": {"title": "parport: Fix race between port and client registration", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through local kernel module registration paths (init_module/finit_module/modprobe or built-in initcalls during boot), not via network or physical port I/O. An attacker must locally orchestrate concurrent loading of parport client and port drivers.\nAC:L - The attacker controls both sides of the race by concurrently loading/unloading `lp` (or `ppdev`) and `parport_pc`; the fix author reproduced this reliably with a tight modprobe/rmmod loop. Success does not depend on uncontrollable timing or memory layout.\nPR:L - Triggering the race requires CAP_SYS_MODULE to load the relevant modules, which is obtainable by an unprivileged user in a user namespace on systems that permit it; it is not limited to irreducible init-namespace root.\nUI:N - Exploitation requires no victim interaction beyond the attacker's own module-load activity; boot-time crashes from parallel module loading also occur without user action.\nS:U - Impact is confined to kernel memory and availability within the same kernel security domain; there is no VM escape, sandbox breakout, or cross-authority boundary crossing.\nC:H - Client drivers can attach while a port is partially initialized (e.g., NULL `port->dev` causing `device_add` failure) or actively being torn down after probe failure, creating a use-after-free window on the `parport` structure that can expose kernel memory.\nI:H - The same race window permits client attachment to ports with uninitialized or freed `parport_operations`/private data, enabling calls through invalid function pointers and heap corruption primitives consistent with control-flow hijacking.\nA:H - Confirmed real-world kernel oops/panic during boot (Debian #1130365) with NULL instruction pointer, and the fix author demonstrated reliable crashes from the modprobe race loop."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "f3378b0d7bd4605de89b083b2900788157a181cc", "versionType": "git"}, {"status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "290f515c5e3b3900bc2fe24f179999fd08d23bfa", "versionType": "git"}, {"status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "d16548be2ea5058227d79799e81dab61c9bca8ec", "versionType": "git"}, {"status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "15b1723c1472e802f9f7e69ae4e64f7dbf588848", "versionType": "git"}, {"status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "51026cff1f4f3b762a0b5a07c727bd59cef45320", "versionType": "git"}, {"status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "74d6aae1df45d3414178986be743f946988fddf6", "versionType": "git"}, {"status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "a1e81b58da0179531bedf0b9f2811f5f992d5c4b", "versionType": "git"}, {"status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "lessThan": "ef15ccbb3e8640a723c42ad90eaf81d66ae02017", "versionType": "git"}], "programFiles": ["drivers/parport/share.c", "include/linux/parport.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"status": "unaffected", "version": "0", "lessThan": "4.2", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.259", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.93", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.35", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.12", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/parport/share.c", "include/linux/parport.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f3378b0d7bd4605de89b083b2900788157a181cc"}, {"url": "https://git.kernel.org/stable/c/290f515c5e3b3900bc2fe24f179999fd08d23bfa"}, {"url": "https://git.kernel.org/stable/c/d16548be2ea5058227d79799e81dab61c9bca8ec"}, {"url": "https://git.kernel.org/stable/c/15b1723c1472e802f9f7e69ae4e64f7dbf588848"}, {"url": "https://git.kernel.org/stable/c/51026cff1f4f3b762a0b5a07c727bd59cef45320"}, {"url": "https://git.kernel.org/stable/c/74d6aae1df45d3414178986be743f946988fddf6"}, {"url": "https://git.kernel.org/stable/c/a1e81b58da0179531bedf0b9f2811f5f992d5c4b"}, {"url": "https://git.kernel.org/stable/c/ef15ccbb3e8640a723c42ad90eaf81d66ae02017"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nparport: Fix race between port and client registration\n\nThe parport subsystem registers port devices before they are fully\ninitialised, resulting in a race condition where client drivers such\nas lp can attach to ports that are not completely initialised or even\nbeing torn down.\n\nWhen the port and client drivers are built as modules and loaded\naround the same time during boot, this occasionally results in a\ncrash. I was able to make this happen reliably in a VM with a\nPC-style parallel port by patching parport_pc to fail probing:\n\n> --- a/drivers/parport/parport_pc.c\n> +++ b/drivers/parport/parport_pc.c\n> @@ -2069,7 +2069,7 @@ static struct parport *__parport_pc_probe_port(unsigned long int base,\n> \tif (!p)\n> \t\tgoto out3;\n>\n> -\tbase_res = request_region(base, 3, p->name);\n> +\tbase_res = NULL;\n> \tif (!base_res)\n> \t\tgoto out4;\n>\n\nand then running:\n\n while true; do\n modprobe lp & modprobe parport_pc\n\twait\n\trmmod lp parport_pc\n done\n\nfor a few seconds.\n\nIn the long term I think port registration should be changed to put\nthe call to device_add() inside parport_announce_port(), but since the\nlatter currently cannot fail this will require changing all port\ndrivers.\n\nFor now, add a flag to indicate whether a port has been \"announced\"\nand only try to attach client drivers to ports when the flag is set."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.259", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.210", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.176", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.143", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.93", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.35", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.12", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "4.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:29.875Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63942", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:17:58.246Z", "dateReserved": "2026-07-19T07:54:57.022Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:55:37.717Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/parport/share.c", "include/linux/parport.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f3378b0d7bd4605de89b083b2900788157a181cc", "status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "versionType": "git"}, {"lessThan": "290f515c5e3b3900bc2fe24f179999fd08d23bfa", "status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "versionType": "git"}, {"lessThan": "d16548be2ea5058227d79799e81dab61c9bca8ec", "status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "versionType": "git"}, {"lessThan": "15b1723c1472e802f9f7e69ae4e64f7dbf588848", "status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "versionType": "git"}, {"lessThan": "51026cff1f4f3b762a0b5a07c727bd59cef45320", "status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "versionType": "git"}, {"lessThan": "74d6aae1df45d3414178986be743f946988fddf6", "status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "versionType": "git"}, {"lessThan": "a1e81b58da0179531bedf0b9f2811f5f992d5c4b", "status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "versionType": "git"}, {"lessThan": "ef15ccbb3e8640a723c42ad90eaf81d66ae02017", "status": "affected", "version": "6fa45a22689722dac9f0e90c0931d4b34b334ede", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/parport/share.c", "include/linux/parport.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"lessThan": "4.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9C21CCE-47FD-40BA-8A95-0D9E2F98FCA6", "versionEndExcluding": "5.10.259", "versionStartIncluding": "4.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63", "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nparport: Fix race between port and client registration\n\nThe parport subsystem registers port devices before they are fully\ninitialised, resulting in a race condition where client drivers such\nas lp can attach to ports that are not completely initialised or even\nbeing torn down.\n\nWhen the port and client drivers are built as modules and loaded\naround the same time during boot, this occasionally results in a\ncrash. I was able to make this happen reliably in a VM with a\nPC-style parallel port by patching parport_pc to fail probing:\n\n> --- a/drivers/parport/parport_pc.c\n> +++ b/drivers/parport/parport_pc.c\n> @@ -2069,7 +2069,7 @@ static struct parport *__parport_pc_probe_port(unsigned long int base,\n> \tif (!p)\n> \t\tgoto out3;\n>\n> -\tbase_res = request_region(base, 3, p->name);\n> +\tbase_res = NULL;\n> \tif (!base_res)\n> \t\tgoto out4;\n>\n\nand then running:\n\n while true; do\n modprobe lp & modprobe parport_pc\n\twait\n\trmmod lp parport_pc\n done\n\nfor a few seconds.\n\nIn the long term I think port registration should be changed to put\nthe call to device_add() inside parport_announce_port(), but since the\nlatter currently cannot fail this will require changing all port\ndrivers.\n\nFor now, add a flag to indicate whether a port has been \"announced\"\nand only try to attach client drivers to ports when the flag is set."}], "id": "CVE-2026-63942", "lastModified": "2026-10-26T13:35:00.073", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63942", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:33:55.831357Z", "version": "2.0.3"}}]}, "published": "2026-07-19T16:17:12.747", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/15b1723c1472e802f9f7e69ae4e64f7dbf588848"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/290f515c5e3b3900bc2fe24f179999fd08d23bfa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/51026cff1f4f3b762a0b5a07c727bd59cef45320"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/74d6aae1df45d3414178986be743f946988fddf6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a1e81b58da0179531bedf0b9f2811f5f992d5c4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d16548be2ea5058227d79799e81dab61c9bca8ec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ef15ccbb3e8640a723c42ad90eaf81d66ae02017"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f3378b0d7bd4605de89b083b2900788157a181cc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: parport: Fix race between port and client registration", "id": "2502323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502323"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's parallel port (parport) subsystem. This vulnerability is caused by a race condition where parallel port devices are registered before they are fully initialized. This allows client drivers to interact with uninitialized or unstable ports, which can lead to a system crash. A local attacker could exploit this by repeatedly loading and unloading parallel port modules, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-63942", "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63942\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63942\nhttps://lore.kernel.org/linux-cve-announce/2026071953-CVE-2026-63942-2771@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6fa45a22689722dac9f0e90c0931d4b34b334ede,f3378b0d7bd4605de89b083b2900788157a181cc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6fa45a22689722dac9f0e90c0931d4b34b334ede,290f515c5e3b3900bc2fe24f179999fd08d23bfa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6fa45a22689722dac9f0e90c0931d4b34b334ede,d16548be2ea5058227d79799e81dab61c9bca8ec)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6fa45a22689722dac9f0e90c0931d4b34b334ede,15b1723c1472e802f9f7e69ae4e64f7dbf588848)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6fa45a22689722dac9f0e90c0931d4b34b334ede,51026cff1f4f3b762a0b5a07c727bd59cef45320)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6fa45a22689722dac9f0e90c0931d4b34b334ede,74d6aae1df45d3414178986be743f946988fddf6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6fa45a22689722dac9f0e90c0931d4b34b334ede,a1e81b58da0179531bedf0b9f2811f5f992d5c4b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6fa45a22689722dac9f0e90c0931d4b34b334ede,ef15ccbb3e8640a723c42ad90eaf81d66ae02017)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.259,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T09:00:03.295213+00:00", "updated": "2026-10-20T09:15:12.780864+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}