CVE-2026-98006

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98006", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.068Z", "datePublished": "2026-09-25T10:23:32.334Z", "dateUpdated": "2026-10-19T09:12:11.824Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:12:11.824Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: Decoupling ep1_in_urb in caiaq dev\n\nThe epq_in_urb object belonging to the caiaq device is coupled within\nthe struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)\nexecutes successfully, epq_in_urb is successfully added to the urbp_list\nqueue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD\nlayer driver for the caiaq USB device).\n\nWhen init_card() calls snd_usb_caiaq_send_command() which subsequently\nfails due to a timeout, and proceeds to call snd_card_free() to release\nthe card, the embedded ep1_in_urb object is also freed. When the dummy\nHCD driver detects that the URB has been unlinked, it returns the URB\n(by usb_hcd_giveback_urb()), which triggers [1].\n\nDecouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch\nto using a pointer instead. Separately allocate and manage the memory for\nep1_in_urb to prevent the release of the snd_card memory object from\ninterfering with it.\n\nmidi_out_urb has the same issue as ep1_in_urb and is handled in the same\nway.\n\n[1]\nBUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96\nWrite of size 4 at addr ffff88803cee1050 by task ktimers/1/29\nCall Trace:\n usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96\n dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019\n __run_hrtimer kernel/time/hrtimer.c:2067 [inline]\n __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124\n hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141\n\nAllocated by task 36:\n snd_card_new+0x7b/0x110 sound/core/init.c:184\n create_card sound/usb/caiaq/device.c:429 [inline]\n snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544\n\nFreed by task 36:\n snd_card_free_when_closed sound/core/init.c:630 [inline]\n snd_card_free+0x138/0x1d0 sound/core/init.c:662\n snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/caiaq/device.c", "sound/usb/caiaq/device.h", "sound/usb/caiaq/midi.c"], "versions": [{"version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "lessThan": "a3bbd2845bc7188ae18548a591da1067af997e80", "status": "affected", "versionType": "git"}, {"version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "lessThan": "fbfbad728da2e95d6560e43266895de5c8e844b3", "status": "affected", "versionType": "git"}, {"version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "lessThan": "dbd3effcbdb85394d3c4bd5ee9df785a44303333", "status": "affected", "versionType": "git"}, {"version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "lessThan": "671037b282eb7fe477136bd0130ffd9029eb8668", "status": "affected", "versionType": "git"}, {"version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "lessThan": "d6dd3c915b0d02457711d8fbaa60efc52144557f", "status": "affected", "versionType": "git"}, {"version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "lessThan": "0c1b907d5db2f3508375776e5b78d69591aa5626", "status": "affected", "versionType": "git"}, {"version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "lessThan": "d41e6c1533f09b27fc562260d41417490d2b6084", "status": "affected", "versionType": "git"}, {"version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "lessThan": "402a9d6aab7ac787ab075adeb562c3db8b8f564b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/caiaq/device.c", "sound/usb/caiaq/device.h", "sound/usb/caiaq/midi.c"], "versions": [{"version": "2.6.22", "status": "affected"}, {"version": "0", "lessThan": "2.6.22", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a3bbd2845bc7188ae18548a591da1067af997e80"}, {"url": "https://git.kernel.org/stable/c/fbfbad728da2e95d6560e43266895de5c8e844b3"}, {"url": "https://git.kernel.org/stable/c/dbd3effcbdb85394d3c4bd5ee9df785a44303333"}, {"url": "https://git.kernel.org/stable/c/671037b282eb7fe477136bd0130ffd9029eb8668"}, {"url": "https://git.kernel.org/stable/c/d6dd3c915b0d02457711d8fbaa60efc52144557f"}, {"url": "https://git.kernel.org/stable/c/0c1b907d5db2f3508375776e5b78d69591aa5626"}, {"url": "https://git.kernel.org/stable/c/d41e6c1533f09b27fc562260d41417490d2b6084"}, {"url": "https://git.kernel.org/stable/c/402a9d6aab7ac787ab075adeb562c3db8b8f564b"}], "title": "ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/caiaq/device.c", "sound/usb/caiaq/device.h", "sound/usb/caiaq/midi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a3bbd2845bc7188ae18548a591da1067af997e80", "status": "affected", "version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "versionType": "git"}, {"lessThan": "fbfbad728da2e95d6560e43266895de5c8e844b3", "status": "affected", "version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "versionType": "git"}, {"lessThan": "dbd3effcbdb85394d3c4bd5ee9df785a44303333", "status": "affected", "version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "versionType": "git"}, {"lessThan": "671037b282eb7fe477136bd0130ffd9029eb8668", "status": "affected", "version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "versionType": "git"}, {"lessThan": "d6dd3c915b0d02457711d8fbaa60efc52144557f", "status": "affected", "version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "versionType": "git"}, {"lessThan": "0c1b907d5db2f3508375776e5b78d69591aa5626", "status": "affected", "version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "versionType": "git"}, {"lessThan": "d41e6c1533f09b27fc562260d41417490d2b6084", "status": "affected", "version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "versionType": "git"}, {"lessThan": "402a9d6aab7ac787ab075adeb562c3db8b8f564b", "status": "affected", "version": "523f1dce37434a9a6623bf46e7893e2b4b10ac3c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/caiaq/device.c", "sound/usb/caiaq/device.h", "sound/usb/caiaq/midi.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.22"}, {"lessThan": "2.6.22", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: Decoupling ep1_in_urb in caiaq dev\n\nThe epq_in_urb object belonging to the caiaq device is coupled within\nthe struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)\nexecutes successfully, epq_in_urb is successfully added to the urbp_list\nqueue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD\nlayer driver for the caiaq USB device).\n\nWhen init_card() calls snd_usb_caiaq_send_command() which subsequently\nfails due to a timeout, and proceeds to call snd_card_free() to release\nthe card, the embedded ep1_in_urb object is also freed. When the dummy\nHCD driver detects that the URB has been unlinked, it returns the URB\n(by usb_hcd_giveback_urb()), which triggers [1].\n\nDecouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch\nto using a pointer instead. Separately allocate and manage the memory for\nep1_in_urb to prevent the release of the snd_card memory object from\ninterfering with it.\n\nmidi_out_urb has the same issue as ep1_in_urb and is handled in the same\nway.\n\n[1]\nBUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96\nWrite of size 4 at addr ffff88803cee1050 by task ktimers/1/29\nCall Trace:\n usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96\n dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019\n __run_hrtimer kernel/time/hrtimer.c:2067 [inline]\n __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124\n hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141\n\nAllocated by task 36:\n snd_card_new+0x7b/0x110 sound/core/init.c:184\n create_card sound/usb/caiaq/device.c:429 [inline]\n snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544\n\nFreed by task 36:\n snd_card_free_when_closed sound/core/init.c:630 [inline]\n snd_card_free+0x138/0x1d0 sound/core/init.c:662\n snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553"}], "id": "CVE-2026-98006", "lastModified": "2026-10-19T10:17:51.943", "metrics": {}, "published": "2026-09-25T11:17:28.847", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0c1b907d5db2f3508375776e5b78d69591aa5626"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/402a9d6aab7ac787ab075adeb562c3db8b8f564b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/671037b282eb7fe477136bd0130ffd9029eb8668"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a3bbd2845bc7188ae18548a591da1067af997e80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d41e6c1533f09b27fc562260d41417490d2b6084"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d6dd3c915b0d02457711d8fbaa60efc52144557f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dbd3effcbdb85394d3c4bd5ee9df785a44303333"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fbfbad728da2e95d6560e43266895de5c8e844b3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev", "id": "2541304", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541304"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: caiaq: Decoupling ep1_in_urb in caiaq dev\nThe epq_in_urb object belonging to the caiaq device is coupled within\nthe struct snd_usb_caiaqdev. After usb_submit_urb(epq_in_urb, GFP_KERNEL)\nexecutes successfully, epq_in_urb is successfully added to the urbp_list\nqueue of the dummy HCD driver (userspace specifies dummy_hcd as the HCD\nlayer driver for the caiaq USB device).\nWhen init_card() calls snd_usb_caiaq_send_command() which subsequently\nfails due to a timeout, and proceeds to call snd_card_free() to release\nthe card, the embedded ep1_in_urb object is also freed. When the dummy\nHCD driver detects that the URB has been unlinked, it returns the URB\n(by usb_hcd_giveback_urb()), which triggers [1].\nDecouple the ep1_in_urb object from the struct snd_usb_caiaqdev and switch\nto using a pointer instead. Separately allocate and manage the memory for\nep1_in_urb to prevent the release of the snd_card memory object from\ninterfering with it.\nmidi_out_urb has the same issue as ep1_in_urb and is handled in the same\nway.\n[1]\nBUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96\nWrite of size 4 at addr ffff88803cee1050 by task ktimers/1/29\nCall Trace:\nusb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96\ndummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019\n__run_hrtimer kernel/time/hrtimer.c:2067 [inline]\n__hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124\nhrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141\nAllocated by task 36:\nsnd_card_new+0x7b/0x110 sound/core/init.c:184\ncreate_card sound/usb/caiaq/device.c:429 [inline]\nsnd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544\nFreed by task 36:\nsnd_card_free_when_closed sound/core/init.c:630 [inline]\nsnd_card_free+0x138/0x1d0 sound/core/init.c:662\nsnd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553", "A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) caiaq USB audio driver. During device initialization failures, the driver prematurely releases memory structures used for USB communication while they remain queued in the host controller. An attacker connecting a crafted USB device or a local user could exploit this use-after-free condition to trigger a kernel crash resulting in Denial of Service (DoS), or potentially execute arbitrary code."], "name": "CVE-2026-98006", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98006\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98006\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98006.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[523f1dce37434a9a6623bf46e7893e2b4b10ac3c,d6dd3c915b0d02457711d8fbaa60efc52144557f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[523f1dce37434a9a6623bf46e7893e2b4b10ac3c,0c1b907d5db2f3508375776e5b78d69591aa5626)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[523f1dce37434a9a6623bf46e7893e2b4b10ac3c,d41e6c1533f09b27fc562260d41417490d2b6084)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[523f1dce37434a9a6623bf46e7893e2b4b10ac3c,402a9d6aab7ac787ab075adeb562c3db8b8f564b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.22"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,2.6.22)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T15:30:06.907338+00:00", "updated": "2026-10-01T02:00:15.518493+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}