CVE-2026-72009

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72009", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.899Z", "datePublished": "2026-08-15T05:51:39.019Z", "dateUpdated": "2026-10-30T12:28:44.807Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:28:44.807Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI\n\nThe MIPI DSI and CSI domains share control bits for clock and reset, which\ncan lead to incorrect behavior if one domain disables the shared resource\nwhile the other is still active.\n\nTo fix the issue, introduce a shared MIPI PHY power domain to own the\ncommon resources and make DSI and CSI its subdomains. This ensures the\nshared bits are properly managed and not disabled while still in use."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local access on an i.MX93 system to trigger MIPI DSI/CSI power-domain transitions via DRM display ioctls and V4L2 camera streaming on /dev/dri/* and /dev/video*; there is no network, Bluetooth, or physical USB attack path to this pmdomain driver.\nAC:L - On affected imx93 boards with both DSI and CSI enabled, an attacker can reliably reproduce the fault by starting a CSI capture (keeping the CSI genpd active) then suspending or closing the DSI path so imx93_blk_ctrl_power_off() clears shared PHY bit 12; no uncontrollable timing or rare layout is required.\nPR:L - Triggering the vulnerable power_off path needs only a local unprivileged application user able to open standard media device nodes (typical video/render group or embedded app account on automotive, kiosk, and industrial i.MX93 targets), not init-namespace root or capabilities unavailable via user namespaces.\nUI:N - No separate victim action is required when the attacker controls both display and camera interfaces on the same device; they can independently start CSI streaming and release DSI runtime PM to force premature shared PHY teardown.\nS:U - Impact is confined to kernel and on-chip media hardware on the same i.MX93 host; it does not cross VM, container, or IOMMU security boundaries into another authority.\nC:H - Asserting reset and gating the shared MIPI PHY (BIT(12)) while CSI/DSI DMA is still active can leave media bus masters operating against powered-down hardware; on i.MX93 platforms without in-tree SMMU isolation this plausibly enables errant DMA reads exposing kernel or other process memory.\nI:H - The same premature PHY reset/clock gate during active capture or display transfers can cause misdirected media-master writes beyond intended buffers, corrupting arbitrary physical memory on affected embedded i.MX93 deployments where DMA is not IOMMU-contained.\nA:H - Disabling shared PHY resources while the sibling MIPI interface remains active causes camera/display failure, driver hangs, and potential kernel oops or panic from malfunctioning CSI/DSI hardware and interrupt storms on safety-critical embedded systems using concurrent display and camera."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/pmdomain/imx/imx93-blk-ctrl.c"], "versions": [{"version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "lessThan": "73c0d6957811d7c138124107e1d31e8fb0133156", "status": "affected", "versionType": "git"}, {"version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "lessThan": "94b8a47f45f19c537964355fa539670631882b20", "status": "affected", "versionType": "git"}, {"version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "lessThan": "4fd5b33faf092ef2d09f730a7d9e49f9e976ac67", "status": "affected", "versionType": "git"}, {"version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "lessThan": "4ba6d7166750d0b810c6cfc0b1df7585f513b48c", "status": "affected", "versionType": "git"}, {"version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "lessThan": "99611233f8cda833169fa6487d5dacdf189e5cb0", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/pmdomain/imx/imx93-blk-ctrl.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/73c0d6957811d7c138124107e1d31e8fb0133156"}, {"url": "https://git.kernel.org/stable/c/94b8a47f45f19c537964355fa539670631882b20"}, {"url": "https://git.kernel.org/stable/c/4fd5b33faf092ef2d09f730a7d9e49f9e976ac67"}, {"url": "https://git.kernel.org/stable/c/4ba6d7166750d0b810c6cfc0b1df7585f513b48c"}, {"url": "https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"}], "title": "pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72009", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:49:53.130863Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T21:09:12.628Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72009", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:49:53.130863Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:49:53.864Z"}}], "cna": {"title": "pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local access on an i.MX93 system to trigger MIPI DSI/CSI power-domain transitions via DRM display ioctls and V4L2 camera streaming on /dev/dri/* and /dev/video*; there is no network, Bluetooth, or physical USB attack path to this pmdomain driver.\nAC:L - On affected imx93 boards with both DSI and CSI enabled, an attacker can reliably reproduce the fault by starting a CSI capture (keeping the CSI genpd active) then suspending or closing the DSI path so imx93_blk_ctrl_power_off() clears shared PHY bit 12; no uncontrollable timing or rare layout is required.\nPR:L - Triggering the vulnerable power_off path needs only a local unprivileged application user able to open standard media device nodes (typical video/render group or embedded app account on automotive, kiosk, and industrial i.MX93 targets), not init-namespace root or capabilities unavailable via user namespaces.\nUI:N - No separate victim action is required when the attacker controls both display and camera interfaces on the same device; they can independently start CSI streaming and release DSI runtime PM to force premature shared PHY teardown.\nS:U - Impact is confined to kernel and on-chip media hardware on the same i.MX93 host; it does not cross VM, container, or IOMMU security boundaries into another authority.\nC:H - Asserting reset and gating the shared MIPI PHY (BIT(12)) while CSI/DSI DMA is still active can leave media bus masters operating against powered-down hardware; on i.MX93 platforms without in-tree SMMU isolation this plausibly enables errant DMA reads exposing kernel or other process memory.\nI:H - The same premature PHY reset/clock gate during active capture or display transfers can cause misdirected media-master writes beyond intended buffers, corrupting arbitrary physical memory on affected embedded i.MX93 deployments where DMA is not IOMMU-contained.\nA:H - Disabling shared PHY resources while the sibling MIPI interface remains active causes camera/display failure, driver hangs, and potential kernel oops or panic from malfunctioning CSI/DSI hardware and interrupt storms on safety-critical embedded systems using concurrent display and camera."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "lessThan": "94b8a47f45f19c537964355fa539670631882b20", "versionType": "git"}, {"status": "affected", "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "lessThan": "4fd5b33faf092ef2d09f730a7d9e49f9e976ac67", "versionType": "git"}, {"status": "affected", "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "lessThan": "4ba6d7166750d0b810c6cfc0b1df7585f513b48c", "versionType": "git"}, {"status": "affected", "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "lessThan": "99611233f8cda833169fa6487d5dacdf189e5cb0", "versionType": "git"}], "programFiles": ["drivers/pmdomain/imx/imx93-blk-ctrl.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"status": "unaffected", "version": "0", "lessThan": "6.1", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/pmdomain/imx/imx93-blk-ctrl.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/94b8a47f45f19c537964355fa539670631882b20"}, {"url": "https://git.kernel.org/stable/c/4fd5b33faf092ef2d09f730a7d9e49f9e976ac67"}, {"url": "https://git.kernel.org/stable/c/4ba6d7166750d0b810c6cfc0b1df7585f513b48c"}, {"url": "https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI\n\nThe MIPI DSI and CSI domains share control bits for clock and reset, which\ncan lead to incorrect behavior if one domain disables the shared resource\nwhile the other is still active.\n\nTo fix the issue, introduce a shared MIPI PHY power domain to own the\ncommon resources and make DSI and CSI its subdomains. This ensures the\nshared bits are properly managed and not disabled while still in use."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.42", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:44:18.359Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72009", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:44:18.359Z", "dateReserved": "2026-08-09T03:40:39.899Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:51:39.019Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/pmdomain/imx/imx93-blk-ctrl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "73c0d6957811d7c138124107e1d31e8fb0133156", "status": "affected", "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "versionType": "git"}, {"lessThan": "94b8a47f45f19c537964355fa539670631882b20", "status": "affected", "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "versionType": "git"}, {"lessThan": "4fd5b33faf092ef2d09f730a7d9e49f9e976ac67", "status": "affected", "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "versionType": "git"}, {"lessThan": "4ba6d7166750d0b810c6cfc0b1df7585f513b48c", "status": "affected", "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "versionType": "git"}, {"lessThan": "99611233f8cda833169fa6487d5dacdf189e5cb0", "status": "affected", "version": "e9aa77d413c903ba4cf7da3fe0b419cae5b97a81", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/pmdomain/imx/imx93-blk-ctrl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI\n\nThe MIPI DSI and CSI domains share control bits for clock and reset, which\ncan lead to incorrect behavior if one domain disables the shared resource\nwhile the other is still active.\n\nTo fix the issue, introduce a shared MIPI PHY power domain to own the\ncommon resources and make DSI and CSI its subdomains. This ensures the\nshared bits are properly managed and not disabled while still in use."}], "id": "CVE-2026-72009", "lastModified": "2026-10-30T13:19:46.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72009", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:49:53.130863Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:20:59.570", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ba6d7166750d0b810c6cfc0b1df7585f513b48c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4fd5b33faf092ef2d09f730a7d9e49f9e976ac67"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/73c0d6957811d7c138124107e1d31e8fb0133156"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/94b8a47f45f19c537964355fa539670631882b20"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/99611233f8cda833169fa6487d5dacdf189e5cb0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI", "id": "2516634", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516634"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["A flaw was found in the Linux kernel. The MIPI DSI (Display Serial Interface) and CSI (Camera Serial Interface) power domains share control bits for clock and reset. This improper resource management allows one domain to disable shared resources while the other is still active, leading to incorrect system behavior. This can result in a denial of service (DoS) or system instability."], "name": "CVE-2026-72009", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72009\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72009\nhttps://lore.kernel.org/linux-cve-announce/2026081507-CVE-2026-72009-c32b@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e9aa77d413c903ba4cf7da3fe0b419cae5b97a81,4fd5b33faf092ef2d09f730a7d9e49f9e976ac67)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e9aa77d413c903ba4cf7da3fe0b419cae5b97a81,4ba6d7166750d0b810c6cfc0b1df7585f513b48c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e9aa77d413c903ba4cf7da3fe0b419cae5b97a81,99611233f8cda833169fa6487d5dacdf189e5cb0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T09:15:04.422565+00:00", "updated": "2026-10-20T11:15:14.043260+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}