CVE-2026-64223

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64223", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.770Z", "datePublished": "2026-07-24T15:23:08.629Z", "dateUpdated": "2026-10-19T20:28:15.888Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:40:10.599Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: consume only present negotiated TTLM maps\n\nieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements\nagainst the number of link-map entries indicated by link_map_presence.\nieee80211_parse_neg_ttlm() must consume the same layout.\n\nThe parser advanced its cursor for every TID, including TIDs whose\npresence bit is clear and therefore have no map bytes in the element.\nA sparse map can then make a later present TID read past the validated\nelement.\n\nThe bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by\nvalid_links before being applied to driver state, so a peer cannot\nturn the read into a policy change. Under KUnit + KASAN with an\nexact-sized element allocation the OOB read is reported as a\nslab-out-of-bounds; whether the same trigger fires under the\nproduction RX path depends on surrounding allocator state.\n\nAdvance the cursor only when the current TID has a map present."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - A malicious or spoofed Wi-Fi 7 MLO peer can trigger the parser using an over-the-air Protected EHT TTLM request, requiring radio-network adjacency.\nAC:L - A crafted sparse link_map_presence deterministically causes the invalid cursor advancement and OOB read; no race or condition outside the attacker\u2019s control is required to reach the flaw.\nPR:N - The attacker needs no local account, capability, or target-system privilege; an associated malicious AP/MLD peer can supply the frame.\nUI:N - Once the station is connected to the malicious or compromised AP, the crafted management frame is processed automatically without user action.\nS:U - The vulnerable parser and resulting impacts remain within the host kernel\u2019s existing security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Sparse maps cause multiple one- or two-byte reads beyond the validated element into surrounding kernel allocation state. Applying the required higher-severity choice for an OOB kernel read, potential disclosure of adjacent kernel memory is scored High.\nI:N - All writes remain within the bounded neg_ttlm arrays, and parsed link values are checked against valid_links before driver-state application; there is no OOB write or control-flow corruption primitive.\nA:H - An exact-sized allocation produces a KASAN slab-out-of-bounds report, which can panic sanitizer-enabled kernels, and the peer can repeatedly send the trigger. Although production behavior depends on RX-buffer allocation state, the required higher-severity choice supports High."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/mlme.c"], "versions": [{"version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2", "lessThan": "f7d395dc5008168ac5b9c1ac2791e59a6078cca1", "status": "affected", "versionType": "git"}, {"version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2", "lessThan": "2dd9304727c7041df0a599595910bdbe02ad03c5", "status": "affected", "versionType": "git"}, {"version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2", "lessThan": "2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f", "status": "affected", "versionType": "git"}, {"version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2", "lessThan": "a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/mlme.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.92", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.92"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f7d395dc5008168ac5b9c1ac2791e59a6078cca1"}, {"url": "https://git.kernel.org/stable/c/2dd9304727c7041df0a599595910bdbe02ad03c5"}, {"url": "https://git.kernel.org/stable/c/2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f"}, {"url": "https://git.kernel.org/stable/c/a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea"}], "title": "wifi: mac80211: consume only present negotiated TTLM maps", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64223", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:37:41.970755Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:28:15.888Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64223", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:37:41.970755Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:37:43.049Z"}}], "cna": {"title": "wifi: mac80211: consume only present negotiated TTLM maps", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - A malicious or spoofed Wi-Fi 7 MLO peer can trigger the parser using an over-the-air Protected EHT TTLM request, requiring radio-network adjacency.\nAC:L - A crafted sparse link_map_presence deterministically causes the invalid cursor advancement and OOB read; no race or condition outside the attacker\u2019s control is required to reach the flaw.\nPR:N - The attacker needs no local account, capability, or target-system privilege; an associated malicious AP/MLD peer can supply the frame.\nUI:N - Once the station is connected to the malicious or compromised AP, the crafted management frame is processed automatically without user action.\nS:U - The vulnerable parser and resulting impacts remain within the host kernel\u2019s existing security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Sparse maps cause multiple one- or two-byte reads beyond the validated element into surrounding kernel allocation state. Applying the required higher-severity choice for an OOB kernel read, potential disclosure of adjacent kernel memory is scored High.\nI:N - All writes remain within the bounded neg_ttlm arrays, and parsed link values are checked against valid_links before driver-state application; there is no OOB write or control-flow corruption primitive.\nA:H - An exact-sized allocation produces a KASAN slab-out-of-bounds report, which can panic sanitizer-enabled kernels, and the peer can repeatedly send the trigger. Although production behavior depends on RX-buffer allocation state, the required higher-severity choice supports High."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2", "lessThan": "f7d395dc5008168ac5b9c1ac2791e59a6078cca1", "versionType": "git"}, {"status": "affected", "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2", "lessThan": "2dd9304727c7041df0a599595910bdbe02ad03c5", "versionType": "git"}, {"status": "affected", "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2", "lessThan": "2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f", "versionType": "git"}, {"status": "affected", "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2", "lessThan": "a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea", "versionType": "git"}], "programFiles": ["net/mac80211/mlme.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.92", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.34", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.11", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/mac80211/mlme.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/f7d395dc5008168ac5b9c1ac2791e59a6078cca1"}, {"url": "https://git.kernel.org/stable/c/2dd9304727c7041df0a599595910bdbe02ad03c5"}, {"url": "https://git.kernel.org/stable/c/2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f"}, {"url": "https://git.kernel.org/stable/c/a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: consume only present negotiated TTLM maps\n\nieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements\nagainst the number of link-map entries indicated by link_map_presence.\nieee80211_parse_neg_ttlm() must consume the same layout.\n\nThe parser advanced its cursor for every TID, including TIDs whose\npresence bit is clear and therefore have no map bytes in the element.\nA sparse map can then make a later present TID read past the validated\nelement.\n\nThe bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by\nvalid_links before being applied to driver state, so a peer cannot\nturn the read into a policy change. Under KUnit + KASAN with an\nexact-sized element allocation the OOB read is reported as a\nslab-out-of-bounds; whether the same trigger fires under the\nproduction RX path depends on surrounding allocator state.\n\nAdvance the cursor only when the current TID has a map present."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.92", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "6.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:40:10.599Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64223", "state": "PUBLISHED", "dateUpdated": "2026-10-16T15:42:26.703Z", "dateReserved": "2026-07-19T15:36:31.770Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-24T15:23:08.629Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac80211/mlme.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f7d395dc5008168ac5b9c1ac2791e59a6078cca1", "status": "affected", "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2", "versionType": "git"}, {"lessThan": "2dd9304727c7041df0a599595910bdbe02ad03c5", "status": "affected", "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2", "versionType": "git"}, {"lessThan": "2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f", "status": "affected", "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2", "versionType": "git"}, {"lessThan": "a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea", "status": "affected", "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac80211/mlme.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.92", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DA2A75E-CE43-4FDB-A0D5-74277B51F5B2", "versionEndExcluding": "6.12.92", "versionStartIncluding": "6.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: consume only present negotiated TTLM maps\n\nieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements\nagainst the number of link-map entries indicated by link_map_presence.\nieee80211_parse_neg_ttlm() must consume the same layout.\n\nThe parser advanced its cursor for every TID, including TIDs whose\npresence bit is clear and therefore have no map bytes in the element.\nA sparse map can then make a later present TID read past the validated\nelement.\n\nThe bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by\nvalid_links before being applied to driver state, so a peer cannot\nturn the read into a policy change. Under KUnit + KASAN with an\nexact-sized element allocation the OOB read is reported as a\nslab-out-of-bounds; whether the same trigger fires under the\nproduction RX path depends on surrounding allocator state.\n\nAdvance the cursor only when the current TID has a map present."}], "id": "CVE-2026-64223", "lastModified": "2026-10-19T21:17:27.637", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64223", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:37:41.970755Z", "version": "2.0.3"}}]}, "published": "2026-07-24T16:16:50.197", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2dd9304727c7041df0a599595910bdbe02ad03c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f7d395dc5008168ac5b9c1ac2791e59a6078cca1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: wifi: mac80211: consume only present negotiated TTLM maps", "id": "2506807", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506807"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's mac80211 Wi-Fi driver. This vulnerability, an out-of-bounds read, occurs when parsing negotiated Time-To-Live Map (TTLM) elements. A remote attacker could craft a sparse map, causing the parser to read beyond the intended memory boundary. While direct policy changes are prevented, this issue can lead to memory corruption, potentially impacting system stability."], "name": "CVE-2026-64223", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64223\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64223\nhttps://lore.kernel.org/linux-cve-announce/2026072417-CVE-2026-64223-b945@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f500fbc6c655976c8062b1f1e55bd0b3095d6c2,f7d395dc5008168ac5b9c1ac2791e59a6078cca1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f500fbc6c655976c8062b1f1e55bd0b3095d6c2,2dd9304727c7041df0a599595910bdbe02ad03c5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f500fbc6c655976c8062b1f1e55bd0b3095d6c2,2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8f500fbc6c655976c8062b1f1e55bd0b3095d6c2,a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.92,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.34,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T00:00:10.601665+00:00", "updated": "2026-08-05T01:00:07.239520+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}