CVE-2026-68201

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68201", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.374Z", "datePublished": "2026-08-10T12:00:20.280Z", "dateUpdated": "2026-10-19T20:58:56.946Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:00:44.787Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: drain a slave's callback before its master detaches it\n\nsnd_timer_close_locked() drains the closing instance's own in-flight\ncallback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a\nmaster instance is closed, remove_slave_links() clears each slave's\n->timer; the slave's own close then reads timer == NULL and takes the\nbranch that skips the drain entirely (snd_timer_stop_slave() also no-ops\non a NULL timer). So a slave whose callback is still running when the\nmaster is closed is freed underneath the live callback, leading to\nuse-after-free.\n\nDrain the slaves too before remove_slave_links() severs them.\nsnd_timer_stop() has already taken this instance off the active list, so\nno new slave callback can be queued. Take the slaves off the ack list so\na pending one can't fire either, then wait for any that is already in\nflight."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through the local ALSA timer character device /dev/snd/timer (open, SNDRV_TIMER_IOCTL_SELECT/START/CREATE/TRIGGER, close) \u2014 no remote or network path exists into sound/core/timer.c.\nAC:L - The attacker owns both sides of the race: it creates the master/slave instances, drives callback delivery itself via the userspace-driven timer's SNDRV_TIMER_IOCTL_TRIGGER ioctl, and chooses the close ordering, and can widen the window with many slaves and queued events, so the UAF is reliably reproducible.\nPR:L - No capable() or CAP_* check exists on any part of the path; any local user with access to /dev/snd/timer (normal for desktop/Android audio-group users and sandboxed apps) can create utimers and open master and slave instances.\nUI:N - A single unprivileged process performs all steps \u2014 open, select, start, trigger and close \u2014 with no action from any other user or victim process required.\nS:U - The corruption is confined to the kernel's own heap and the ALSA timer subsystem; no VM, IOMMU or other security-authority boundary is crossed.\nC:H - The freed snd_timer_instance/snd_timer_user objects can be reclaimed by attacker-sprayed data, and the still-running callback reads and later exposes freed-slab contents through the timer read queue, enabling disclosure of arbitrary kernel heap data.\nI:H - The in-flight callback writes attacker-influenced tread records into the already-freed tqueue and performs list and waitqueue updates on freed memory, giving a controllable use-after-free write usable for heap corruption and control-flow hijack.\nA:H - The use-after-free corrupts slab memory and list pointers, readily producing an oops, list_del corruption BUG or panic that takes down the whole system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/core/timer.c"], "versions": [{"version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "cd461bcfcdf8d6b6b5365941c1d3859f8bc77aa0", "status": "affected", "versionType": "git"}, {"version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "426c0ff1c433d6030610ad4f9375746dfe931caa", "status": "affected", "versionType": "git"}, {"version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "2b298997786876b225cff2446e11a0fa6f602f6d", "status": "affected", "versionType": "git"}, {"version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "bdefe1346a8e6b8dc8593406dc2617e985fcbcab", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/core/timer.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cd461bcfcdf8d6b6b5365941c1d3859f8bc77aa0"}, {"url": "https://git.kernel.org/stable/c/426c0ff1c433d6030610ad4f9375746dfe931caa"}, {"url": "https://git.kernel.org/stable/c/2b298997786876b225cff2446e11a0fa6f602f6d"}, {"url": "https://git.kernel.org/stable/c/bdefe1346a8e6b8dc8593406dc2617e985fcbcab"}], "title": "ALSA: timer: drain a slave's callback before its master detaches it", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68201", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:45:48.460607Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:58:56.946Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68201", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:45:48.460607Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:45:49.018Z"}}], "cna": {"title": "ALSA: timer: drain a slave's callback before its master detaches it", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through the local ALSA timer character device /dev/snd/timer (open, SNDRV_TIMER_IOCTL_SELECT/START/CREATE/TRIGGER, close) \u2014 no remote or network path exists into sound/core/timer.c.\nAC:L - The attacker owns both sides of the race: it creates the master/slave instances, drives callback delivery itself via the userspace-driven timer's SNDRV_TIMER_IOCTL_TRIGGER ioctl, and chooses the close ordering, and can widen the window with many slaves and queued events, so the UAF is reliably reproducible.\nPR:L - No capable() or CAP_* check exists on any part of the path; any local user with access to /dev/snd/timer (normal for desktop/Android audio-group users and sandboxed apps) can create utimers and open master and slave instances.\nUI:N - A single unprivileged process performs all steps \u2014 open, select, start, trigger and close \u2014 with no action from any other user or victim process required.\nS:U - The corruption is confined to the kernel's own heap and the ALSA timer subsystem; no VM, IOMMU or other security-authority boundary is crossed.\nC:H - The freed snd_timer_instance/snd_timer_user objects can be reclaimed by attacker-sprayed data, and the still-running callback reads and later exposes freed-slab contents through the timer read queue, enabling disclosure of arbitrary kernel heap data.\nI:H - The in-flight callback writes attacker-influenced tread records into the already-freed tqueue and performs list and waitqueue updates on freed memory, giving a controllable use-after-free write usable for heap corruption and control-flow hijack.\nA:H - The use-after-free corrupts slab memory and list pointers, readily producing an oops, list_del corruption BUG or panic that takes down the whole system."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "cd461bcfcdf8d6b6b5365941c1d3859f8bc77aa0", "versionType": "git"}, {"status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "426c0ff1c433d6030610ad4f9375746dfe931caa", "versionType": "git"}, {"status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "2b298997786876b225cff2446e11a0fa6f602f6d", "versionType": "git"}, {"status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "lessThan": "bdefe1346a8e6b8dc8593406dc2617e985fcbcab", "versionType": "git"}], "programFiles": ["sound/core/timer.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/core/timer.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/cd461bcfcdf8d6b6b5365941c1d3859f8bc77aa0"}, {"url": "https://git.kernel.org/stable/c/426c0ff1c433d6030610ad4f9375746dfe931caa"}, {"url": "https://git.kernel.org/stable/c/2b298997786876b225cff2446e11a0fa6f602f6d"}, {"url": "https://git.kernel.org/stable/c/bdefe1346a8e6b8dc8593406dc2617e985fcbcab"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: drain a slave's callback before its master detaches it\n\nsnd_timer_close_locked() drains the closing instance's own in-flight\ncallback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a\nmaster instance is closed, remove_slave_links() clears each slave's\n->timer; the slave's own close then reads timer == NULL and takes the\nbranch that skips the drain entirely (snd_timer_stop_slave() also no-ops\non a NULL timer). So a slave whose callback is still running when the\nmaster is closed is freed underneath the live callback, leading to\nuse-after-free.\n\nDrain the slaves too before remove_slave_links() severs them.\nsnd_timer_stop() has already taken this instance off the active list, so\nno new slave callback can be queued. Take the slaves off the ack list so\na pending one can't fire either, then wait for any that is already in\nflight."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.101", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.42", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.6", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:00:44.787Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68201", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:58:56.946Z", "dateReserved": "2026-07-30T09:28:09.374Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-10T12:00:20.280Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/core/timer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cd461bcfcdf8d6b6b5365941c1d3859f8bc77aa0", "status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "versionType": "git"}, {"lessThan": "426c0ff1c433d6030610ad4f9375746dfe931caa", "status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "versionType": "git"}, {"lessThan": "2b298997786876b225cff2446e11a0fa6f602f6d", "status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "versionType": "git"}, {"lessThan": "bdefe1346a8e6b8dc8593406dc2617e985fcbcab", "status": "affected", "version": "37745918e0e7575bc40f38da93a99b9fa6406224", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/core/timer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: drain a slave's callback before its master detaches it\n\nsnd_timer_close_locked() drains the closing instance's own in-flight\ncallback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a\nmaster instance is closed, remove_slave_links() clears each slave's\n->timer; the slave's own close then reads timer == NULL and takes the\nbranch that skips the drain entirely (snd_timer_stop_slave() also no-ops\non a NULL timer). So a slave whose callback is still running when the\nmaster is closed is freed underneath the live callback, leading to\nuse-after-free.\n\nDrain the slaves too before remove_slave_links() severs them.\nsnd_timer_stop() has already taken this instance off the active list, so\nno new slave callback can be queued. Take the slaves off the ack list so\na pending one can't fire either, then wait for any that is already in\nflight."}], "id": "CVE-2026-68201", "lastModified": "2026-10-19T21:17:57.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68201", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:45:48.460607Z", "version": "2.0.3"}}]}, "published": "2026-08-10T13:20:07.647", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2b298997786876b225cff2446e11a0fa6f602f6d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/426c0ff1c433d6030610ad4f9375746dfe931caa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bdefe1346a8e6b8dc8593406dc2617e985fcbcab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cd461bcfcdf8d6b6b5365941c1d3859f8bc77aa0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: ALSA: timer: drain a slave's callback before its master detaches it", "id": "2513481", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513481"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the ALSA (Advanced Linux Sound Architecture) timer component of the Linux kernel. When a master timer instance is closed, it does not properly ensure that all associated slave timer callbacks have finished executing before detaching them. This oversight can lead to a use-after-free vulnerability, where a freed memory region is accessed, potentially causing system instability, crashes, or allowing an attacker to execute arbitrary code."], "name": "CVE-2026-68201", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68201\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68201\nhttps://lore.kernel.org/linux-cve-announce/2026081011-CVE-2026-68201-df47@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37745918e0e7575bc40f38da93a99b9fa6406224,cd461bcfcdf8d6b6b5365941c1d3859f8bc77aa0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37745918e0e7575bc40f38da93a99b9fa6406224,426c0ff1c433d6030610ad4f9375746dfe931caa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37745918e0e7575bc40f38da93a99b9fa6406224,2b298997786876b225cff2446e11a0fa6f602f6d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[37745918e0e7575bc40f38da93a99b9fa6406224,bdefe1346a8e6b8dc8593406dc2617e985fcbcab)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.101,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.42,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.6,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T14:30:04.127774+00:00", "updated": "2026-10-20T11:00:15.222680+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}