CVE-2026-97612

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97612", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.158Z", "datePublished": "2026-09-25T10:22:21.423Z", "dateUpdated": "2026-10-19T09:10:16.030Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:10:16.030Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: clear inner_protocol when the last label is popped\n\nskb_mpls_push() records the pre-encapsulation network header once, gated\non !skb->inner_protocol. skb_mpls_pop() never clears that record, so it\noutlives the encapsulation it describes.\n\nOpen vSwitch can then re-push MPLS onto a packet whose\ninner_network_header still points at the older, deeper offset: push a\nlabel, pop every label, recirculate (ovs_flow_key_update() re-derives\nkey->eth.type and resets network_header, but leaves inner_*), then push\nagain. ovs_fragment() trusts the record:\n\n\tskb->network_header = skb->inner_network_header;\n\nso skb_network_offset() goes negative. The bound check is signed:\n\n\tif (skb_network_offset(skb) > MAX_L2_LEN)\n\na negative offset passes it, and prepare_frag() widens the value:\n\n\tunsigned int hlen = skb_network_offset(skb);\n\tmemcpy(&data->l2_data, skb->data, hlen);\n\nwhich is a ~4GiB memcpy out of a 30-byte per-CPU buffer.\n\nReproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):\n\n BUG: unable to handle page fault for address: ffffe8ffffc16000\n #PF: supervisor write access in kernel mode\n Oops: 0002 [#1] SMP KASAN NOPTI\n RIP: 0010:memcpy+0x8/0x20\n RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000\n prepare_frag+0x3df/0x4e0\n ovs_fragment+0x589/0x7e0\n do_output+0x4ce/0x5e0\n do_execute_actions+0x55d2/0x7b30\n ovs_execute_actions+0xea/0x450\n\nSame root-cause shape as commit 975b5b067f52 (\"ipv6: sr: restore network\nheader before routing and forwarding\"): a stale network header offset\nreaching a consumer that widens it. Here it originates in the MPLS\npush/pop path.\n\nClear inner_protocol once the packet is no longer MPLS, so a later push\nre-records the current header. net/sched/act_mpls.c is the only other\nskb_mpls_pop() caller and gets the same fix; sch_frag.c saves and\nrestores inner_protocol around fragmentation in the same way OVS does."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The stale inner_network_header comes from OVS flow actions (push_mpls, pop_mpls, recirc, push_mpls) that the attacker installs over the ovs_flow/ovs_packet generic netlink families. No field of a received packet causes the bad offset, so the vector is local netlink rather than the wire.\nAC:L - The attacker chooses the flow action sequence and the oversized packet that sends do_output into ovs_fragment(). skb_mpls_pop() then deterministically leaves inner_protocol set, and the negative offset always passes the signed MAX_L2_LEN check, so nothing depends on timing or outside state.\nPR:L - The OVS datapath, vport, flow and packet genl operations use GENL_UNS_ADMIN_PERM with netnsok=true. That means CAP_NET_ADMIN inside an unprivileged user and network namespace (unshare -Urn) is enough to create a datapath, install the flows and execute packets.\nUI:N - No victim action is needed. The attacker installs the flows and injects or sends the packet themselves inside their own namespace.\nS:U - The overflow corrupts memory of the same kernel that performs the check. This is ordinary in-kernel memory corruption and crosses no hypervisor or IOMMU boundary.\nC:H - prepare_frag() turns a negative skb_network_offset() into an unsigned hlen of about 4 GiB and memcpy()s attacker packet bytes past the 30-byte per-CPU ovs_frag_data.l2_data. The write covers exec_level, owner, bh_lock and the per-CPU data that follows, and memory corruption of this kind can be leveraged for information disclosure.\nI:H - This is an out-of-bounds write of attacker-controlled skb data into the per-CPU ovs_pcpu_storage and the per-CPU memory after it, including a task_struct pointer (owner) and lock state. The corruption stays in place if the oops happens in process context (OVS_PACKET_CMD_EXECUTE).\nA:H - The runaway memcpy in prepare_frag() always runs until it hits an unmapped per-CPU page and oopses, as the fix's reproducer shows (write fault in memcpy from prepare_frag/ovs_fragment). The attacker can repeat this at will."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skbuff.c"], "versions": [{"version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "55ed97db27bffe29c21fdefd5d25601322c36ff8", "status": "affected", "versionType": "git"}, {"version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "833ec2788322306407503b4cfc7745cd1f9d785f", "status": "affected", "versionType": "git"}, {"version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34", "status": "affected", "versionType": "git"}, {"version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "0b3425fd0ecd515997956f7bb8a8a576b444ed64", "status": "affected", "versionType": "git"}, {"version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "011e17b5cae19b9f6a150923275e41c278de64f0", "status": "affected", "versionType": "git"}, {"version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e", "status": "affected", "versionType": "git"}, {"version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "b39120523475d6b436be7f6cb27d48064148a327", "status": "affected", "versionType": "git"}, {"version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "lessThan": "78a86d75a70e1e227711c72865c59b1422d0a5ae", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skbuff.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/55ed97db27bffe29c21fdefd5d25601322c36ff8"}, {"url": "https://git.kernel.org/stable/c/833ec2788322306407503b4cfc7745cd1f9d785f"}, {"url": "https://git.kernel.org/stable/c/38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34"}, {"url": "https://git.kernel.org/stable/c/0b3425fd0ecd515997956f7bb8a8a576b444ed64"}, {"url": "https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0"}, {"url": "https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e"}, {"url": "https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327"}, {"url": "https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae"}], "title": "net: mpls: clear inner_protocol when the last label is popped", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/skbuff.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "55ed97db27bffe29c21fdefd5d25601322c36ff8", "status": "affected", "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "versionType": "git"}, {"lessThan": "833ec2788322306407503b4cfc7745cd1f9d785f", "status": "affected", "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "versionType": "git"}, {"lessThan": "38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34", "status": "affected", "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "versionType": "git"}, {"lessThan": "0b3425fd0ecd515997956f7bb8a8a576b444ed64", "status": "affected", "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "versionType": "git"}, {"lessThan": "011e17b5cae19b9f6a150923275e41c278de64f0", "status": "affected", "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "versionType": "git"}, {"lessThan": "da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e", "status": "affected", "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "versionType": "git"}, {"lessThan": "b39120523475d6b436be7f6cb27d48064148a327", "status": "affected", "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "versionType": "git"}, {"lessThan": "78a86d75a70e1e227711c72865c59b1422d0a5ae", "status": "affected", "version": "48d2ab609b6bbecb7698487c8579bc40de9d6dfa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/skbuff.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mpls: clear inner_protocol when the last label is popped\n\nskb_mpls_push() records the pre-encapsulation network header once, gated\non !skb->inner_protocol. skb_mpls_pop() never clears that record, so it\noutlives the encapsulation it describes.\n\nOpen vSwitch can then re-push MPLS onto a packet whose\ninner_network_header still points at the older, deeper offset: push a\nlabel, pop every label, recirculate (ovs_flow_key_update() re-derives\nkey->eth.type and resets network_header, but leaves inner_*), then push\nagain. ovs_fragment() trusts the record:\n\n\tskb->network_header = skb->inner_network_header;\n\nso skb_network_offset() goes negative. The bound check is signed:\n\n\tif (skb_network_offset(skb) > MAX_L2_LEN)\n\na negative offset passes it, and prepare_frag() widens the value:\n\n\tunsigned int hlen = skb_network_offset(skb);\n\tmemcpy(&data->l2_data, skb->data, hlen);\n\nwhich is a ~4GiB memcpy out of a 30-byte per-CPU buffer.\n\nReproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):\n\n BUG: unable to handle page fault for address: ffffe8ffffc16000\n #PF: supervisor write access in kernel mode\n Oops: 0002 [#1] SMP KASAN NOPTI\n RIP: 0010:memcpy+0x8/0x20\n RDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000\n prepare_frag+0x3df/0x4e0\n ovs_fragment+0x589/0x7e0\n do_output+0x4ce/0x5e0\n do_execute_actions+0x55d2/0x7b30\n ovs_execute_actions+0xea/0x450\n\nSame root-cause shape as commit 975b5b067f52 (\"ipv6: sr: restore network\nheader before routing and forwarding\"): a stale network header offset\nreaching a consumer that widens it. Here it originates in the MPLS\npush/pop path.\n\nClear inner_protocol once the packet is no longer MPLS, so a later push\nre-records the current header. net/sched/act_mpls.c is the only other\nskb_mpls_pop() caller and gets the same fix; sch_frag.c saves and\nrestores inner_protocol around fragmentation in the same way OVS does."}], "id": "CVE-2026-97612", "lastModified": "2026-10-19T10:17:31.307", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-25T11:17:15.330", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/011e17b5cae19b9f6a150923275e41c278de64f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0b3425fd0ecd515997956f7bb8a8a576b444ed64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/38db09804b2616aa1e2fcdf97f0c3ae8b9dbdd34"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/55ed97db27bffe29c21fdefd5d25601322c36ff8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/78a86d75a70e1e227711c72865c59b1422d0a5ae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/833ec2788322306407503b4cfc7745cd1f9d785f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b39120523475d6b436be7f6cb27d48064148a327"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: mpls: clear inner_protocol when the last label is popped", "id": "2541154", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541154"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: mpls: clear inner_protocol when the last label is popped\nskb_mpls_push() records the pre-encapsulation network header once, gated\non !skb->inner_protocol. skb_mpls_pop() never clears that record, so it\noutlives the encapsulation it describes.\nOpen vSwitch can then re-push MPLS onto a packet whose\ninner_network_header still points at the older, deeper offset: push a\nlabel, pop every label, recirculate (ovs_flow_key_update() re-derives\nkey->eth.type and resets network_header, but leaves inner_*), then push\nagain. ovs_fragment() trusts the record:\nskb->network_header = skb->inner_network_header;\nso skb_network_offset() goes negative. The bound check is signed:\nif (skb_network_offset(skb) > MAX_L2_LEN)\na negative offset passes it, and prepare_frag() widens the value:\nunsigned int hlen = skb_network_offset(skb);\nmemcpy(&data->l2_data, skb->data, hlen);\nwhich is a ~4GiB memcpy out of a 30-byte per-CPU buffer.\nReproduced on v7.3-rc1. RDX is the truncated length, (unsigned int)(-8):\nBUG: unable to handle page fault for address: ffffe8ffffc16000\n#PF: supervisor write access in kernel mode\nOops: 0002 [#1] SMP KASAN NOPTI\nRIP: 0010:memcpy+0x8/0x20\nRDX: 00000000fffffff8 RSI: ffff888105d732db RDI: ffffe8ffffc16000\nprepare_frag+0x3df/0x4e0\novs_fragment+0x589/0x7e0\ndo_output+0x4ce/0x5e0\ndo_execute_actions+0x55d2/0x7b30\novs_execute_actions+0xea/0x450\nSame root-cause shape as commit 975b5b067f52 (\"ipv6: sr: restore network\nheader before routing and forwarding\"): a stale network header offset\nreaching a consumer that widens it. Here it originates in the MPLS\npush/pop path.\nClear inner_protocol once the packet is no longer MPLS, so a later push\nre-records the current header. net/sched/act_mpls.c is the only other\nskb_mpls_pop() caller and gets the same fix; sch_frag.c saves and\nrestores inner_protocol around fragmentation in the same way OVS does.", "A flaw was found in the Linux kernel's Multiprotocol Label Switching (MPLS) networking subsystem. When all labels are removed from an encapsulated packet, the kernel fails to clear internal protocol tracking metadata, leaving stale network header references. An attacker could exploit this flaw by sending network traffic processed by affected routing environments such as Open vSwitch, causing an out-of-bounds memory copy. This failure triggers a kernel crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-97612", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97612\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97612\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97612.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[48d2ab609b6bbecb7698487c8579bc40de9d6dfa,011e17b5cae19b9f6a150923275e41c278de64f0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[48d2ab609b6bbecb7698487c8579bc40de9d6dfa,da8c3a7f5d3137fec4ff60a6248f5f6d66b6a63e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[48d2ab609b6bbecb7698487c8579bc40de9d6dfa,b39120523475d6b436be7f6cb27d48064148a327)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[48d2ab609b6bbecb7698487c8579bc40de9d6dfa,78a86d75a70e1e227711c72865c59b1422d0a5ae)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T20:00:08.974349+00:00", "updated": "2026-10-01T11:30:05.845663+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}