CVE-2026-74725

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74725", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.929Z", "datePublished": "2026-08-22T15:33:16.460Z", "dateUpdated": "2026-10-16T19:16:12.099Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:42:05.934Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nenic: fix tx_hang_reset use-after-free on device removal\n\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\n\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF occurs during enic_remove() PCI/driver teardown (sysfs unbind, rmmod, or hot-unplug); TX timeout is raised by the local netdev watchdog, not by remote packet processing, and there is no standalone network path into enic_remove itself.\nAC:L - This is a workqueue race during removal: once teardown starts the netdev can still be up so the watchdog schedules enic_tx_hang_reset, and an attacker can reliably drive TX timeout by stalling or flooding xmit on the still-registered interface while removal proceeds.\nPR:L - PCI unbind/module unload needs elevated privileges, but an unprivileged local or tenant workload can supply the concurrent netdev watchdog TX timeout (local/remote traffic on the Cisco VIC uplink) that schedules tx_hang_reset; per driver-removal UAF precedent, PR:L.\nUI:N - No victim interaction is required beyond routine driver removal, module unload, or hypervisor VNIC hot-unplug; monitoring and network traffic on the live interface can schedule tx_hang_reset during teardown without cooperation.\nS:U - Impact is use-after-free of netdev_priv enic memory in the host/guest kernel, enabling crash or privilege escalation within the same kernel security authority; it does not cross VM, hypervisor, IOMMU, or container boundaries.\nC:H - enic_tx_hang_reset dereferences freed enic/netdev memory via container_of(work, struct enic, tx_hang_reset); UAF on the unified netdev slab enables arbitrary kernel memory disclosure once the object is reallocated.\nI:H - The scheduled work performs hang reset, stop/open, and notifier calls through the dangling enic pointer, giving attacker-influenced writes and control-flow hijack primitives typical of netdev driver UAF exploitation.\nA:H - Use-after-free during enic_tx_hang_reset reliably causes kernel oops/panic when the work runs after free_netdev(), and even attempted exploitation crashes the system on dangling enic/netdev accesses."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/cisco/enic/enic_main.c"], "versions": [{"version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "lessThan": "8619865f34fb3b130b567855382a5c4aadd522b9", "status": "affected", "versionType": "git"}, {"version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "lessThan": "e506e704b74748ffd0e1c92a7453ca2a959f832b", "status": "affected", "versionType": "git"}, {"version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "lessThan": "4f3464fc6c1f26afc504fd525c574f2bc14c9d42", "status": "affected", "versionType": "git"}, {"version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "lessThan": "ec680ea4ba1bca92a767fb7e7869758bfdd886e3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/cisco/enic/enic_main.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9"}, {"url": "https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b"}, {"url": "https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42"}, {"url": "https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"}], "title": "enic: fix tx_hang_reset use-after-free on device removal", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74725", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:15:41.206988Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:16:12.099Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74725", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:15:41.206988Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:15:42.587Z"}}], "cna": {"title": "enic: fix tx_hang_reset use-after-free on device removal", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF occurs during enic_remove() PCI/driver teardown (sysfs unbind, rmmod, or hot-unplug); TX timeout is raised by the local netdev watchdog, not by remote packet processing, and there is no standalone network path into enic_remove itself.\nAC:L - This is a workqueue race during removal: once teardown starts the netdev can still be up so the watchdog schedules enic_tx_hang_reset, and an attacker can reliably drive TX timeout by stalling or flooding xmit on the still-registered interface while removal proceeds.\nPR:L - PCI unbind/module unload needs elevated privileges, but an unprivileged local or tenant workload can supply the concurrent netdev watchdog TX timeout (local/remote traffic on the Cisco VIC uplink) that schedules tx_hang_reset; per driver-removal UAF precedent, PR:L.\nUI:N - No victim interaction is required beyond routine driver removal, module unload, or hypervisor VNIC hot-unplug; monitoring and network traffic on the live interface can schedule tx_hang_reset during teardown without cooperation.\nS:U - Impact is use-after-free of netdev_priv enic memory in the host/guest kernel, enabling crash or privilege escalation within the same kernel security authority; it does not cross VM, hypervisor, IOMMU, or container boundaries.\nC:H - enic_tx_hang_reset dereferences freed enic/netdev memory via container_of(work, struct enic, tx_hang_reset); UAF on the unified netdev slab enables arbitrary kernel memory disclosure once the object is reallocated.\nI:H - The scheduled work performs hang reset, stop/open, and notifier calls through the dangling enic pointer, giving attacker-influenced writes and control-flow hijack primitives typical of netdev driver UAF exploitation.\nA:H - Use-after-free during enic_tx_hang_reset reliably causes kernel oops/panic when the work runs after free_netdev(), and even attempted exploitation crashes the system on dangling enic/netdev accesses."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "lessThan": "8619865f34fb3b130b567855382a5c4aadd522b9", "versionType": "git"}, {"status": "affected", "version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "lessThan": "e506e704b74748ffd0e1c92a7453ca2a959f832b", "versionType": "git"}, {"status": "affected", "version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "lessThan": "4f3464fc6c1f26afc504fd525c574f2bc14c9d42", "versionType": "git"}, {"status": "affected", "version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "lessThan": "ec680ea4ba1bca92a767fb7e7869758bfdd886e3", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/cisco/enic/enic_main.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"status": "unaffected", "version": "0", "lessThan": "4.4", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/cisco/enic/enic_main.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9"}, {"url": "https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b"}, {"url": "https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42"}, {"url": "https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nenic: fix tx_hang_reset use-after-free on device removal\n\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\n\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "4.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:42:05.934Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74725", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:16:12.099Z", "dateReserved": "2026-08-15T05:44:03.929Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:33:16.460Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/cisco/enic/enic_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8619865f34fb3b130b567855382a5c4aadd522b9", "status": "affected", "version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "versionType": "git"}, {"lessThan": "e506e704b74748ffd0e1c92a7453ca2a959f832b", "status": "affected", "version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "versionType": "git"}, {"lessThan": "4f3464fc6c1f26afc504fd525c574f2bc14c9d42", "status": "affected", "version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "versionType": "git"}, {"lessThan": "ec680ea4ba1bca92a767fb7e7869758bfdd886e3", "status": "affected", "version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/cisco/enic/enic_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nenic: fix tx_hang_reset use-after-free on device removal\n\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\n\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nenic: corrige el uso despu\u00e9s de liberaci\u00f3n de tx_hang_reset al retirar el dispositivo\n\nenic_remove() cancela los elementos de trabajo reset y change_mtu_work pero no cancela tx_hang_reset. Un tiempo de espera de TX que se activa mientras se retira el dispositivo puede programar enic_tx_hang_reset() para que se ejecute despu\u00e9s de free_netdev(), lo que resulta en un uso despu\u00e9s de liberaci\u00f3n.\n\ncancel_work_sync() por s\u00ed solo no es suficiente aqu\u00ed: las rutas de watchdog y notify a\u00fan activas pueden reprogramar estos elementos de trabajo en la ventana entre la cancelaci\u00f3n y unregister_netdev(). Utilice disable_work_sync(), que cancela el trabajo y bloquea cualquier schedule_work() posterior de volver a encolarlo, y apl\u00edquelo tambi\u00e9n a los elementos de trabajo reset y change_mtu_work para que la misma condici\u00f3n de carrera de reencolado se cierre para todo el trabajo de desmontaje."}], "id": "CVE-2026-74725", "lastModified": "2026-10-16T20:17:54.887", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74725", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:15:41.206988Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:47.567", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: enic: fix tx_hang_reset use-after-free on device removal", "id": "2521492", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521492"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-364", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nenic: fix tx_hang_reset use-after-free on device removal\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work.", "A flaw was found in the Linux kernel's enic driver. During device removal, a timing issue can occur where a transmit (TX) timeout schedules a reset operation after the device's memory has been freed. This leads to a use-after-free vulnerability, a type of memory corruption where the system attempts to access memory that is no longer allocated. This can result in system instability, crashes, or potentially allow an attacker to execute arbitrary code."], "name": "CVE-2026-74725", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74725\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74725\nhttps://lore.kernel.org/linux-cve-announce/2026082240-CVE-2026-74725-d59d@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[937317c7c1097aa878a5000e3aab616eb5c590c0,8619865f34fb3b130b567855382a5c4aadd522b9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[937317c7c1097aa878a5000e3aab616eb5c590c0,e506e704b74748ffd0e1c92a7453ca2a959f832b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[937317c7c1097aa878a5000e3aab616eb5c590c0,4f3464fc6c1f26afc504fd525c574f2bc14c9d42)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[937317c7c1097aa878a5000e3aab616eb5c590c0,ec680ea4ba1bca92a767fb7e7869758bfdd886e3)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.4,4.4]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:00:04.732754+00:00", "updated": "2026-08-25T17:45:04.930587+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}