CVE-2026-68447

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68447", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.395Z", "datePublished": "2026-08-12T00:51:42.433Z", "dateUpdated": "2026-10-21T12:44:11.622Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:44:11.622Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size\n\nCRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size\nfrom hardware without bounding it to the allocated BO region. If the HW\nfield is larger than the queue's control stack allocation, memcpy reads\npast the BO into adjacent GTT memory and can leak kernel data to userspace.\n\nStore the page-aligned control stack BO size in mqd_manager and clamp\ncheckpoint copies and reported checkpoint sizes to\nmin(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound\nfor multi-XCC v9.4.3 checkpoint layout.\n\n(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through the AMDKFD_IOC_CRIU_OP ioctl on the local /dev/kfd character device; no network or remote path exists to amdkfd CRIU checkpoint handling.\nAC:L - kfd_criu_restore_queue() copies the entire user-supplied MQD blob verbatim into the kernel MQD, so the attacker directly chooses cp_hqd_cntl_stack_size and a subsequent checkpoint deterministically triggers the over-read; queues are evicted under p->mutex, so no race must be won.\nPR:L - The attacker needs access to /dev/kfd (render group) plus CAP_CHECKPOINT_RESTORE or CAP_SYS_ADMIN; CAP_CHECKPOINT_RESTORE is a delegated, non-root capability routinely granted to CRIU tooling and container checkpoint services, so this is a limited privilege rather than full administrative control.\nUI:N - The attacker performs the CRIU restore and checkpoint ioctls entirely on its own process; no action by any other user or victim is required.\nS:U - The out-of-bounds read and the resulting disclosure stay within the kernel's own security authority on the host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - memcpy reads up to an attacker-chosen 32-bit length past the small MQD/control-stack BO into adjacent kernel GTT (vmap'd host memory) or VRAM, and criu_checkpoint_queues_device() copies the whole buffer to userspace, disclosing large amounts of unrelated kernel/GPU memory.\nI:N - The destination buffer is kzalloc'd using the same inflated size, so nothing is written out of bounds; the defect is purely an over-read with no kernel memory modification.\nA:H - With a large attacker-supplied cp_hqd_cntl_stack_size the memcpy walks far past the end of the small kmap'd BO (roughly 0x8000 bytes) into unmapped virtual addresses or beyond the VRAM BAR mapping, producing a kernel oops and killing the driver."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"], "versions": [{"version": "3a9822d7bd623be9000cef8101ecf8479fa53f2c", "lessThan": "1218c6dcec80f886372635e82f3229d5babc37d3", "status": "affected", "versionType": "git"}, {"version": "3a9822d7bd623be9000cef8101ecf8479fa53f2c", "lessThan": "a0d87beb2660a5098b2b0ecdc1e96810a9074ea9", "status": "affected", "versionType": "git"}, {"version": "3a9822d7bd623be9000cef8101ecf8479fa53f2c", "lessThan": "426ffae6ecc7ec77d32bf8be065c21a1b881b084", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1218c6dcec80f886372635e82f3229d5babc37d3"}, {"url": "https://git.kernel.org/stable/c/a0d87beb2660a5098b2b0ecdc1e96810a9074ea9"}, {"url": "https://git.kernel.org/stable/c/426ffae6ecc7ec77d32bf8be065c21a1b881b084"}], "title": "drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68447", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:49:08.161278Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T21:09:10.800Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68447", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:49:08.161278Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:49:08.892Z"}}], "cna": {"title": "drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached only through the AMDKFD_IOC_CRIU_OP ioctl on the local /dev/kfd character device; no network or remote path exists to amdkfd CRIU checkpoint handling.\nAC:L - kfd_criu_restore_queue() copies the entire user-supplied MQD blob verbatim into the kernel MQD, so the attacker directly chooses cp_hqd_cntl_stack_size and a subsequent checkpoint deterministically triggers the over-read; queues are evicted under p->mutex, so no race must be won.\nPR:L - The attacker needs access to /dev/kfd (render group) plus CAP_CHECKPOINT_RESTORE or CAP_SYS_ADMIN; CAP_CHECKPOINT_RESTORE is a delegated, non-root capability routinely granted to CRIU tooling and container checkpoint services, so this is a limited privilege rather than full administrative control.\nUI:N - The attacker performs the CRIU restore and checkpoint ioctls entirely on its own process; no action by any other user or victim is required.\nS:U - The out-of-bounds read and the resulting disclosure stay within the kernel's own security authority on the host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - memcpy reads up to an attacker-chosen 32-bit length past the small MQD/control-stack BO into adjacent kernel GTT (vmap'd host memory) or VRAM, and criu_checkpoint_queues_device() copies the whole buffer to userspace, disclosing large amounts of unrelated kernel/GPU memory.\nI:N - The destination buffer is kzalloc'd using the same inflated size, so nothing is written out of bounds; the defect is purely an over-read with no kernel memory modification.\nA:H - With a large attacker-supplied cp_hqd_cntl_stack_size the memcpy walks far past the end of the small kmap'd BO (roughly 0x8000 bytes) into unmapped virtual addresses or beyond the VRAM BAR mapping, producing a kernel oops and killing the driver."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3a9822d7bd623be9000cef8101ecf8479fa53f2c", "lessThan": "1218c6dcec80f886372635e82f3229d5babc37d3", "versionType": "git"}, {"status": "affected", "version": "3a9822d7bd623be9000cef8101ecf8479fa53f2c", "lessThan": "a0d87beb2660a5098b2b0ecdc1e96810a9074ea9", "versionType": "git"}, {"status": "affected", "version": "3a9822d7bd623be9000cef8101ecf8479fa53f2c", "lessThan": "426ffae6ecc7ec77d32bf8be065c21a1b881b084", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"status": "unaffected", "version": "0", "lessThan": "5.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1218c6dcec80f886372635e82f3229d5babc37d3"}, {"url": "https://git.kernel.org/stable/c/a0d87beb2660a5098b2b0ecdc1e96810a9074ea9"}, {"url": "https://git.kernel.org/stable/c/426ffae6ecc7ec77d32bf8be065c21a1b881b084"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size\n\nCRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size\nfrom hardware without bounding it to the allocated BO region. If the HW\nfield is larger than the queue's control stack allocation, memcpy reads\npast the BO into adjacent GTT memory and can leak kernel data to userspace.\n\nStore the page-aligned control stack BO size in mqd_manager and clamp\ncheckpoint copies and reported checkpoint sizes to\nmin(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound\nfor multi-XCC v9.4.3 checkpoint layout.\n\n(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.6", "versionStartIncluding": "5.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.18"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:44:11.622Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68447", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:44:11.622Z", "dateReserved": "2026-07-30T09:28:09.395Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-12T00:51:42.433Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1218c6dcec80f886372635e82f3229d5babc37d3", "status": "affected", "version": "3a9822d7bd623be9000cef8101ecf8479fa53f2c", "versionType": "git"}, {"lessThan": "a0d87beb2660a5098b2b0ecdc1e96810a9074ea9", "status": "affected", "version": "3a9822d7bd623be9000cef8101ecf8479fa53f2c", "versionType": "git"}, {"lessThan": "426ffae6ecc7ec77d32bf8be065c21a1b881b084", "status": "affected", "version": "3a9822d7bd623be9000cef8101ecf8479fa53f2c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h", "drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size\n\nCRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size\nfrom hardware without bounding it to the allocated BO region. If the HW\nfield is larger than the queue's control stack allocation, memcpy reads\npast the BO into adjacent GTT memory and can leak kernel data to userspace.\n\nStore the page-aligned control stack BO size in mqd_manager and clamp\ncheckpoint copies and reported checkpoint sizes to\nmin(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound\nfor multi-XCC v9.4.3 checkpoint layout.\n\n(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)"}], "id": "CVE-2026-68447", "lastModified": "2026-10-21T13:19:31.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68447", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:49:08.161278Z", "version": "2.0.3"}}]}, "published": "2026-08-12T01:17:07.587", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1218c6dcec80f886372635e82f3229d5babc37d3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/426ffae6ecc7ec77d32bf8be065c21a1b881b084"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a0d87beb2660a5098b2b0ecdc1e96810a9074ea9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size", "id": "2514464", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514464"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size\nCRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size\nfrom hardware without bounding it to the allocated BO region. If the HW\nfield is larger than the queue's control stack allocation, memcpy reads\npast the BO into adjacent GTT memory and can leak kernel data to userspace.\nStore the page-aligned control stack BO size in mqd_manager and clamp\ncheckpoint copies and reported checkpoint sizes to\nmin(cp_hqd_cntl_stack_size, mm->ctl_stack_size). Apply the same bound\nfor multi-XCC v9.4.3 checkpoint layout.\n(cherry picked from commit 6c2abd0ec09e86c6323010673766f76050e28aa3)", "A flaw was found in the Linux kernel's drm/amdkfd component. The Checkpoint/Restore in Userspace (CRIU) checkpoint process, which saves and restores the state of a running application, incorrectly copies the Memory Queue Descriptor (MQD) control stack. This occurs because the copy operation does not properly limit the amount of data copied to the allocated buffer size. A local attacker could exploit this by causing the system to read beyond the intended memory region, potentially leading to the disclosure of sensitive kernel data to userspace."], "name": "CVE-2026-68447", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68447\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68447\nhttps://lore.kernel.org/linux-cve-announce/2026081223-CVE-2026-68447-6a24@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a0d87beb2660a5098b2b0ecdc1e96810a9074ea9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,426ffae6ecc7ec77d32bf8be065c21a1b881b084)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.1.6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-12T15:15:02.674355+00:00", "updated": "2026-08-14T01:00:05.198223+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}