CVE-2026-68343

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68343", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.384Z", "datePublished": "2026-08-10T12:03:19.939Z", "dateUpdated": "2026-10-19T21:09:05.575Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:33:43.025Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate DFS referral PathConsumed\n\nparse_dfs_referrals() validates that the response contains the fixed\nreferral entry array and, on for-next, the per-referral string offsets.\nHowever, the response also contains a PathConsumed value that is later\nused for DFS path parsing.\n\nIf a malformed response provides a PathConsumed value larger than the\nsearch name, later DFS parsing can advance beyond the end of the path.\n\nValidate PathConsumed against the search name length before storing it in\nthe parsed referral."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The tainted PathConsumed value comes directly from a GET_DFS_REFERRAL response received over TCP/445 from the SMB server, so a malicious or MITM-positioned server on the network fully controls the input to the vulnerable code.\nAC:L - The server simply sets an oversized PathConsumed (up to 65535, and it can also clear the SMB1 UNICODE flag to select the completely unvalidated branch); the resulting out-of-bounds walk past the path buffer is deterministic and needs no race or memory-layout luck.\nPR:N - The attacker is the remote server (or a MITM on an unsigned connection) and needs no account or privilege on the victim client; the client parses the referral response as part of establishing the connection.\nUI:N - DFS referral walks are performed automatically by autofs/systemd automounts, fstab mounts at boot and reconnect-driven remounts, so a forged referral can be delivered without any user action.\nS:U - The out-of-bounds access stays within the kernel's own memory and mount context on the client; no VM, IOMMU or sandbox boundary is crossed.\nC:H - prepath = full_path + path_consumed points past the end of the heap path string, and cifs_build_devname() strlen()s and copies from there, splicing adjacent kernel heap contents (up to ~64KB away) into the constructed UNC/prefixpath that is then observable via the mount source and /proc/mounts.\nI:N - The defect is purely an out-of-bounds read; all subsequent allocations and copies are sized from the same over-read string, so no kernel memory is written or corrupted.\nA:H - With PathConsumed up to 65535 the pointer can run far past a small slab object into an unmapped or guarded page, so strlen() on it oopses the mounting task (and panics on panic_on_oops systems)."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/misc.c"], "versions": [{"version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "lessThan": "bfebe5110fd135d86d65a0a346e14c106b02028b", "status": "affected", "versionType": "git"}, {"version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "lessThan": "5b439f39f33ec15d319ced3b025e122346fba987", "status": "affected", "versionType": "git"}, {"version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "lessThan": "285bd4a5f3f156aa5869843b47a1b1380b774241", "status": "affected", "versionType": "git"}, {"version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "lessThan": "2fdd6d196c656b376cc251e1e9ff110b3ed522e1", "status": "affected", "versionType": "git"}, {"version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "lessThan": "9f88a99ed511651b2dc2177d6854b2d1b8322e75", "status": "affected", "versionType": "git"}, {"version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "lessThan": "f6f5ee2aa33b350c671721b965251c42cebb962e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/smb/client/misc.c"], "versions": [{"version": "4.11", "status": "affected"}, {"version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bfebe5110fd135d86d65a0a346e14c106b02028b"}, {"url": "https://git.kernel.org/stable/c/5b439f39f33ec15d319ced3b025e122346fba987"}, {"url": "https://git.kernel.org/stable/c/285bd4a5f3f156aa5869843b47a1b1380b774241"}, {"url": "https://git.kernel.org/stable/c/2fdd6d196c656b376cc251e1e9ff110b3ed522e1"}, {"url": "https://git.kernel.org/stable/c/9f88a99ed511651b2dc2177d6854b2d1b8322e75"}, {"url": "https://git.kernel.org/stable/c/f6f5ee2aa33b350c671721b965251c42cebb962e"}], "title": "smb: client: validate DFS referral PathConsumed", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68343", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:47:19.145050Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T21:09:05.575Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68343", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:47:19.145050Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:47:19.711Z"}}], "cna": {"title": "smb: client: validate DFS referral PathConsumed", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.1, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The tainted PathConsumed value comes directly from a GET_DFS_REFERRAL response received over TCP/445 from the SMB server, so a malicious or MITM-positioned server on the network fully controls the input to the vulnerable code.\nAC:L - The server simply sets an oversized PathConsumed (up to 65535, and it can also clear the SMB1 UNICODE flag to select the completely unvalidated branch); the resulting out-of-bounds walk past the path buffer is deterministic and needs no race or memory-layout luck.\nPR:N - The attacker is the remote server (or a MITM on an unsigned connection) and needs no account or privilege on the victim client; the client parses the referral response as part of establishing the connection.\nUI:N - DFS referral walks are performed automatically by autofs/systemd automounts, fstab mounts at boot and reconnect-driven remounts, so a forged referral can be delivered without any user action.\nS:U - The out-of-bounds access stays within the kernel's own memory and mount context on the client; no VM, IOMMU or sandbox boundary is crossed.\nC:H - prepath = full_path + path_consumed points past the end of the heap path string, and cifs_build_devname() strlen()s and copies from there, splicing adjacent kernel heap contents (up to ~64KB away) into the constructed UNC/prefixpath that is then observable via the mount source and /proc/mounts.\nI:N - The defect is purely an out-of-bounds read; all subsequent allocations and copies are sized from the same over-read string, so no kernel memory is written or corrupted.\nA:H - With PathConsumed up to 65535 the pointer can run far past a small slab object into an unmapped or guarded page, so strlen() on it oopses the mounting task (and panics on panic_on_oops systems)."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "lessThan": "bfebe5110fd135d86d65a0a346e14c106b02028b", "versionType": "git"}, {"status": "affected", "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "lessThan": "5b439f39f33ec15d319ced3b025e122346fba987", "versionType": "git"}, {"status": "affected", "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "lessThan": "285bd4a5f3f156aa5869843b47a1b1380b774241", "versionType": "git"}, {"status": "affected", "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "lessThan": "2fdd6d196c656b376cc251e1e9ff110b3ed522e1", "versionType": "git"}, {"status": "affected", "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "lessThan": "9f88a99ed511651b2dc2177d6854b2d1b8322e75", "versionType": "git"}, {"status": "affected", "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "lessThan": "f6f5ee2aa33b350c671721b965251c42cebb962e", "versionType": "git"}], "programFiles": ["fs/smb/client/misc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"status": "unaffected", "version": "0", "lessThan": "4.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/smb/client/misc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/bfebe5110fd135d86d65a0a346e14c106b02028b"}, {"url": "https://git.kernel.org/stable/c/5b439f39f33ec15d319ced3b025e122346fba987"}, {"url": "https://git.kernel.org/stable/c/285bd4a5f3f156aa5869843b47a1b1380b774241"}, {"url": "https://git.kernel.org/stable/c/2fdd6d196c656b376cc251e1e9ff110b3ed522e1"}, {"url": "https://git.kernel.org/stable/c/9f88a99ed511651b2dc2177d6854b2d1b8322e75"}, {"url": "https://git.kernel.org/stable/c/f6f5ee2aa33b350c671721b965251c42cebb962e"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate DFS referral PathConsumed\n\nparse_dfs_referrals() validates that the response contains the fixed\nreferral entry array and, on for-next, the per-referral string offsets.\nHowever, the response also contains a PathConsumed value that is later\nused for DFS path parsing.\n\nIf a malformed response provides a PathConsumed value larger than the\nsearch name, later DFS parsing can advance beyond the end of the path.\n\nValidate PathConsumed against the search name length before storing it in\nthe parsed referral."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.148", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.101", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.42", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.6", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:33:43.025Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68343", "state": "PUBLISHED", "dateUpdated": "2026-10-19T21:09:05.575Z", "dateReserved": "2026-07-30T09:28:09.384Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-10T12:03:19.939Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/smb/client/misc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bfebe5110fd135d86d65a0a346e14c106b02028b", "status": "affected", "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "versionType": "git"}, {"lessThan": "5b439f39f33ec15d319ced3b025e122346fba987", "status": "affected", "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "versionType": "git"}, {"lessThan": "285bd4a5f3f156aa5869843b47a1b1380b774241", "status": "affected", "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "versionType": "git"}, {"lessThan": "2fdd6d196c656b376cc251e1e9ff110b3ed522e1", "status": "affected", "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "versionType": "git"}, {"lessThan": "9f88a99ed511651b2dc2177d6854b2d1b8322e75", "status": "affected", "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "versionType": "git"}, {"lessThan": "f6f5ee2aa33b350c671721b965251c42cebb962e", "status": "affected", "version": "4ecce920e13ace16a5ba45efe8909946c28fb2ad", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/smb/client/misc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: validate DFS referral PathConsumed\n\nparse_dfs_referrals() validates that the response contains the fixed\nreferral entry array and, on for-next, the per-referral string offsets.\nHowever, the response also contains a PathConsumed value that is later\nused for DFS path parsing.\n\nIf a malformed response provides a PathConsumed value larger than the\nsearch name, later DFS parsing can advance beyond the end of the path.\n\nValidate PathConsumed against the search name length before storing it in\nthe parsed referral."}], "id": "CVE-2026-68343", "lastModified": "2026-10-19T22:17:14.077", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68343", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:47:19.145050Z", "version": "2.0.3"}}]}, "published": "2026-08-10T13:20:24.830", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/285bd4a5f3f156aa5869843b47a1b1380b774241"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2fdd6d196c656b376cc251e1e9ff110b3ed522e1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b439f39f33ec15d319ced3b025e122346fba987"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9f88a99ed511651b2dc2177d6854b2d1b8322e75"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bfebe5110fd135d86d65a0a346e14c106b02028b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f6f5ee2aa33b350c671721b965251c42cebb962e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: Linux kernel: SMB client out-of-bounds read via malformed DFS referral", "id": "2513373", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513373"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsmb: client: validate DFS referral PathConsumed\nparse_dfs_referrals() validates that the response contains the fixed\nreferral entry array and, on for-next, the per-referral string offsets.\nHowever, the response also contains a PathConsumed value that is later\nused for DFS path parsing.\nIf a malformed response provides a PathConsumed value larger than the\nsearch name, later DFS parsing can advance beyond the end of the path.\nValidate PathConsumed against the search name length before storing it in\nthe parsed referral.", "A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote attacker could send a specially crafted SMB response containing a malformed Distributed File System (DFS) referral. This could cause the PathConsumed value to exceed the search name length, leading to an out-of-bounds read during DFS path parsing. This vulnerability may result in information disclosure or a denial of service."], "name": "CVE-2026-68343", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:03:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68343\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68343\nhttps://git.kernel.org/stable/c/285bd4a5f3f156aa5869843b47a1b1380b774241\nhttps://git.kernel.org/stable/c/2fdd6d196c656b376cc251e1e9ff110b3ed522e1\nhttps://git.kernel.org/stable/c/5b439f39f33ec15d319ced3b025e122346fba987\nhttps://git.kernel.org/stable/c/9f88a99ed511651b2dc2177d6854b2d1b8322e75\nhttps://git.kernel.org/stable/c/f6f5ee2aa33b350c671721b965251c42cebb962e"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ecce920e13ace16a5ba45efe8909946c28fb2ad,5b439f39f33ec15d319ced3b025e122346fba987)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ecce920e13ace16a5ba45efe8909946c28fb2ad,285bd4a5f3f156aa5869843b47a1b1380b774241)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ecce920e13ace16a5ba45efe8909946c28fb2ad,2fdd6d196c656b376cc251e1e9ff110b3ed522e1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ecce920e13ace16a5ba45efe8909946c28fb2ad,9f88a99ed511651b2dc2177d6854b2d1b8322e75)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ecce920e13ace16a5ba45efe8909946c28fb2ad,f6f5ee2aa33b350c671721b965251c42cebb962e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T16:00:04.016459+00:00", "updated": "2026-10-20T13:15:14.205394+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}