CVE-2026-98265

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98265", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.333Z", "datePublished": "2026-10-06T08:45:28.438Z", "dateUpdated": "2026-10-30T12:38:00.448Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:38:00.448Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Clamp implicit feedback packet count to URB capacity\n\ndata_ep_set_params() allocates each data URB for exactly u->packets\nisochronous frames, so urb->iso_frame_desc[] has u->packets slots and\nctx->packets is the driver's only record of that limit. For an implicit\nfeedback sink, snd_usb_queue_pending_output_urbs() overwrites it with the\nsync source's packet count, which is calculated independently from the\ncapture endpoint's parameters. When that count is larger,\nprepare_playback_urb() and prepare_silent_urb() can write\niso_frame_desc[] past the allocation; their existing bounds limit payload\nbytes, not the descriptor index.\n\nThe reproducer uses a high-speed UAC2 device declaring bInterval 1 for\nimplicit feedback capture (8 packets) and bInterval 4 for playback\n(1 packet). On the first capture completion after the stream starts, it\naccesses seven descriptors spanning 112 bytes beyond the one-packet URB:\n\n BUG: KASAN: slab-out-of-bounds in prepare_playback_urb (sound/usb/pcm.c:1560)\n Write of size 4 at addr ffff88801e696ad0 by task vhci_rx/178\n prepare_playback_urb (sound/usb/pcm.c:1560)\n prepare_outbound_urb (sound/usb/endpoint.c:340)\n snd_usb_queue_pending_output_urbs (sound/usb/endpoint.c:501)\n snd_complete_urb (sound/usb/endpoint.c:1834)\n __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)\n usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)\n vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107)\n kthread (kernel/kthread.c:436)\n The buggy address belongs to the object at ffff88801e696a00\n which belongs to the cache kmalloc-256 of size 256\n The buggy address is located 0 bytes to the right of\n allocated 208-byte region [ffff88801e696a00, ffff88801e696ad0)\n\nRecord the allocated packet count per endpoint and clamp both the adopted\ncount and the packet-size copy to it. Fold the Format Type II delimiter\ninto urb_packs before the allocation loop so the recorded limit matches\nevery URB."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/card.h", "sound/usb/endpoint.c"], "versions": [{"version": "df75696e70c88b22ed1d8c9d515993a858c58fd0", "lessThan": "6c5c986f761756a6ff7b3aea51c11994fc2464e5", "status": "affected", "versionType": "git"}, {"version": "3a74f6b46c01d9a816378cd83c327a59f61475ec", "lessThan": "e44cee1bf51e606f3e70a213eb5a1abb3fa56a81", "status": "affected", "versionType": "git"}, {"version": "c26bde6301f20d9aafbfb7c2459a88c6a6ec178f", "lessThan": "8b637ab10e40e01b452f4aff66dad335a9b89a16", "status": "affected", "versionType": "git"}, {"version": "32a1f64f8ff6e2c5391f5964baec697bce25b83c", "lessThan": "ad279ba0dc1781229f5b52f58d38d56960400e06", "status": "affected", "versionType": "git"}, {"version": "e949fd266cfa1dcca7caa3faa698578c4ffd26d6", "lessThan": "79c55a7b5d71cf2a6bbd4bd7698e1b10b70f813a", "status": "affected", "versionType": "git"}, {"version": "cf044e44190234a41a788de1cdbb6c21f4a52e1e", "lessThan": "ab77e3f453c5f2499c08d6e8e218501d25bab39e", "status": "affected", "versionType": "git"}, {"version": "cf044e44190234a41a788de1cdbb6c21f4a52e1e", "lessThan": "76a986c980bb502c7688d605ac7a67fd257a9a1b", "status": "affected", "versionType": "git"}, {"version": "f6fbdf797e016fbf968dd54301026b182175985a", "status": "affected", "versionType": "git"}, {"version": "5.15.202", "lessThan": "5.15.224", "status": "affected", "versionType": "semver"}, {"version": "6.1.165", "lessThan": "6.1.191", "status": "affected", "versionType": "semver"}, {"version": "6.6.128", "lessThan": "6.6.160", "status": "affected", "versionType": "semver"}, {"version": "6.12.75", "lessThan": "6.12.112", "status": "affected", "versionType": "semver"}, {"version": "6.18.16", "lessThan": "6.18.54", "status": "affected", "versionType": "semver"}, {"version": "6.19.6", "lessThan": "6.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/card.h", "sound/usb/endpoint.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.202", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.165", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.128", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.75", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.16", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6c5c986f761756a6ff7b3aea51c11994fc2464e5"}, {"url": "https://git.kernel.org/stable/c/e44cee1bf51e606f3e70a213eb5a1abb3fa56a81"}, {"url": "https://git.kernel.org/stable/c/8b637ab10e40e01b452f4aff66dad335a9b89a16"}, {"url": "https://git.kernel.org/stable/c/ad279ba0dc1781229f5b52f58d38d56960400e06"}, {"url": "https://git.kernel.org/stable/c/79c55a7b5d71cf2a6bbd4bd7698e1b10b70f813a"}, {"url": "https://git.kernel.org/stable/c/ab77e3f453c5f2499c08d6e8e218501d25bab39e"}, {"url": "https://git.kernel.org/stable/c/76a986c980bb502c7688d605ac7a67fd257a9a1b"}], "title": "ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/card.h", "sound/usb/endpoint.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6c5c986f761756a6ff7b3aea51c11994fc2464e5", "status": "affected", "version": "df75696e70c88b22ed1d8c9d515993a858c58fd0", "versionType": "git"}, {"lessThan": "e44cee1bf51e606f3e70a213eb5a1abb3fa56a81", "status": "affected", "version": "3a74f6b46c01d9a816378cd83c327a59f61475ec", "versionType": "git"}, {"lessThan": "8b637ab10e40e01b452f4aff66dad335a9b89a16", "status": "affected", "version": "c26bde6301f20d9aafbfb7c2459a88c6a6ec178f", "versionType": "git"}, {"lessThan": "ad279ba0dc1781229f5b52f58d38d56960400e06", "status": "affected", "version": "32a1f64f8ff6e2c5391f5964baec697bce25b83c", "versionType": "git"}, {"lessThan": "79c55a7b5d71cf2a6bbd4bd7698e1b10b70f813a", "status": "affected", "version": "e949fd266cfa1dcca7caa3faa698578c4ffd26d6", "versionType": "git"}, {"lessThan": "ab77e3f453c5f2499c08d6e8e218501d25bab39e", "status": "affected", "version": "cf044e44190234a41a788de1cdbb6c21f4a52e1e", "versionType": "git"}, {"lessThan": "76a986c980bb502c7688d605ac7a67fd257a9a1b", "status": "affected", "version": "cf044e44190234a41a788de1cdbb6c21f4a52e1e", "versionType": "git"}, {"status": "affected", "version": "f6fbdf797e016fbf968dd54301026b182175985a", "versionType": "git"}, {"lessThan": "5.15.224", "status": "affected", "version": "5.15.202", "versionType": "semver"}, {"lessThan": "6.1.191", "status": "affected", "version": "6.1.165", "versionType": "semver"}, {"lessThan": "6.6.160", "status": "affected", "version": "6.6.128", "versionType": "semver"}, {"lessThan": "6.12.112", "status": "affected", "version": "6.12.75", "versionType": "semver"}, {"lessThan": "6.18.54", "status": "affected", "version": "6.18.16", "versionType": "semver"}, {"lessThan": "6.20", "status": "affected", "version": "6.19.6", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/card.h", "sound/usb/endpoint.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Clamp implicit feedback packet count to URB capacity\n\ndata_ep_set_params() allocates each data URB for exactly u->packets\nisochronous frames, so urb->iso_frame_desc[] has u->packets slots and\nctx->packets is the driver's only record of that limit. For an implicit\nfeedback sink, snd_usb_queue_pending_output_urbs() overwrites it with the\nsync source's packet count, which is calculated independently from the\ncapture endpoint's parameters. When that count is larger,\nprepare_playback_urb() and prepare_silent_urb() can write\niso_frame_desc[] past the allocation; their existing bounds limit payload\nbytes, not the descriptor index.\n\nThe reproducer uses a high-speed UAC2 device declaring bInterval 1 for\nimplicit feedback capture (8 packets) and bInterval 4 for playback\n(1 packet). On the first capture completion after the stream starts, it\naccesses seven descriptors spanning 112 bytes beyond the one-packet URB:\n\n BUG: KASAN: slab-out-of-bounds in prepare_playback_urb (sound/usb/pcm.c:1560)\n Write of size 4 at addr ffff88801e696ad0 by task vhci_rx/178\n prepare_playback_urb (sound/usb/pcm.c:1560)\n prepare_outbound_urb (sound/usb/endpoint.c:340)\n snd_usb_queue_pending_output_urbs (sound/usb/endpoint.c:501)\n snd_complete_urb (sound/usb/endpoint.c:1834)\n __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)\n usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)\n vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107)\n kthread (kernel/kthread.c:436)\n The buggy address belongs to the object at ffff88801e696a00\n which belongs to the cache kmalloc-256 of size 256\n The buggy address is located 0 bytes to the right of\n allocated 208-byte region [ffff88801e696a00, ffff88801e696ad0)\n\nRecord the allocated packet count per endpoint and clamp both the adopted\ncount and the packet-size copy to it. Fold the Format Type II delimiter\ninto urb_packs before the allocation loop so the recorded limit matches\nevery URB."}], "id": "CVE-2026-98265", "lastModified": "2026-10-30T13:21:12.733", "metrics": {}, "published": "2026-10-06T09:18:15.797", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6c5c986f761756a6ff7b3aea51c11994fc2464e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/76a986c980bb502c7688d605ac7a67fd257a9a1b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/79c55a7b5d71cf2a6bbd4bd7698e1b10b70f813a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8b637ab10e40e01b452f4aff66dad335a9b89a16"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab77e3f453c5f2499c08d6e8e218501d25bab39e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ad279ba0dc1781229f5b52f58d38d56960400e06"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e44cee1bf51e606f3e70a213eb5a1abb3fa56a81"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity", "id": "2546441", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546441"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: usb-audio: Clamp implicit feedback packet count to URB capacity\ndata_ep_set_params() allocates each data URB for exactly u->packets\nisochronous frames, so urb->iso_frame_desc[] has u->packets slots and\nctx->packets is the driver's only record of that limit. For an implicit\nfeedback sink, snd_usb_queue_pending_output_urbs() overwrites it with the\nsync source's packet count, which is calculated independently from the\ncapture endpoint's parameters. When that count is larger,\nprepare_playback_urb() and prepare_silent_urb() can write\niso_frame_desc[] past the allocation; their existing bounds limit payload\nbytes, not the descriptor index.\nThe reproducer uses a high-speed UAC2 device declaring bInterval 1 for\nimplicit feedback capture (8 packets) and bInterval 4 for playback\n(1 packet). On the first capture completion after the stream starts, it\naccesses seven descriptors spanning 112 bytes beyond the one-packet URB:\nBUG: KASAN: slab-out-of-bounds in prepare_playback_urb (sound/usb/pcm.c:1560)\nWrite of size 4 at addr ffff88801e696ad0 by task vhci_rx/178\nprepare_playback_urb (sound/usb/pcm.c:1560)\nprepare_outbound_urb (sound/usb/endpoint.c:340)\nsnd_usb_queue_pending_output_urbs (sound/usb/endpoint.c:501)\nsnd_complete_urb (sound/usb/endpoint.c:1834)\n__usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)\nusb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)\nvhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107)\nkthread (kernel/kthread.c:436)\nThe buggy address belongs to the object at ffff88801e696a00\nwhich belongs to the cache kmalloc-256 of size 256\nThe buggy address is located 0 bytes to the right of\nallocated 208-byte region [ffff88801e696a00, ffff88801e696ad0)\nRecord the allocated packet count per endpoint and clamp both the adopted\ncount and the packet-size copy to it. Fold the Format Type II delimiter\ninto urb_packs before the allocation loop so the recorded limit matches\nevery URB.", "A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio driver. When handling audio devices configured for implicit feedback synchronization, the driver fails to ensure that the received packet count does not exceed the pre-allocated buffer capacity. An attacker capable of connecting a crafted USB audio device can exploit this flaw to cause an out-of-bounds write in kernel memory, resulting in a Denial of Service (DoS) via a system crash or potential privilege escalation."], "name": "CVE-2026-98265", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98265\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98265\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98265.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[32a1f64f8ff6e2c5391f5964baec697bce25b83c,ad279ba0dc1781229f5b52f58d38d56960400e06)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e949fd266cfa1dcca7caa3faa698578c4ffd26d6,79c55a7b5d71cf2a6bbd4bd7698e1b10b70f813a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf044e44190234a41a788de1cdbb6c21f4a52e1e,ab77e3f453c5f2499c08d6e8e218501d25bab39e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cf044e44190234a41a788de1cdbb6c21f4a52e1e,76a986c980bb502c7688d605ac7a67fd257a9a1b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "df75696e70c88b22ed1d8c9d515993a858c58fd0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "3a74f6b46c01d9a816378cd83c327a59f61475ec"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "c26bde6301f20d9aafbfb7c2459a88c6a6ec178f"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "f6fbdf797e016fbf968dd54301026b182175985a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.75,6.12.112)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.16,6.18.54)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.202,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.165,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.128,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T14:15:17.996415+00:00", "updated": "2026-10-11T04:45:17.731939+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}