CVE-2026-98312

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98312", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.339Z", "datePublished": "2026-10-06T08:46:08.388Z", "dateUpdated": "2026-10-19T09:17:22.807Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:17:22.807Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix OOB write from device-reported iso length\n\nusb6fire_pcm_in_urb_handler() sizes each outgoing isochronous packet as\n(actual_length - 4) / (in_n_analog << 2) * (out_n_analog << 2) + 4, where\nactual_length is the unsigned length the device reported for the matching\nIN packet. A packet completed with status 0 and actual_length < 4 wraps\nthe subtraction to 0x7fffffec; a zero-length isochronous packet is legal\non the bus, and the preceding loop rejects only non-zero status. The sum\nreaches memset() on out_urb->buffer, a 4832-byte object from\nkcalloc(PCM_MAX_PACKET_SIZE, PCM_N_PACKETS_PER_URB).\n\nEven without the wrap the result is out of bounds: at 88.2/96 kHz the\n4-in/6-out scaling turns a full 420-byte IN packet into 628, so eight\npackets span 5024 bytes of that buffer. usb_submit_urb() rejects an\nover-long descriptor only after the memset() and the\nusb6fire_pcm_playback() copy of user PCM data have run.\n\nGuard the subtraction as the sibling usb6fire_pcm_capture() already does,\nand limit the frame count to what fits in rt->out_packet_size, the OUT\nendpoint's wMaxPacketSize. This bounds total_length by the buffer size\nwhile keeping each packet length aligned to a whole output frame.\n\n BUG: KASAN: out-of-bounds in usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338)\n Write of size 18446744073709551456 at addr ffff88802a3d0000 by task vhci_rx/5018\n Call Trace:\n dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\n print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:595)\n kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200)\n __asan_memset (mm/kasan/shadow.c:84)\n usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338)\n __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)\n usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)\n vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107 drivers/usb/usbip/vhci_rx.c:242)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\n Allocated by task 10:\n __kmalloc_cache_noprof (mm/slub.c:5563)\n usb6fire_pcm_init (sound/usb/6fire/pcm.c:560 sound/usb/6fire/pcm.c:595)\n usb6fire_chip_probe (sound/usb/6fire/chip.c:133)\n usb_probe_interface (drivers/usb/core/driver.c:399)\n\n The buggy address belongs to the object at ffff88802a3d0000\n which belongs to the cache kmalloc-8k of size 8192\n The buggy address is located 0 bytes inside of\n 4832-byte region [ffff88802a3d0000, ffff88802a3d12e0)\n Kernel panic - not syncing: Fatal exception in interrupt"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/6fire/pcm.c"], "versions": [{"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "lessThan": "61e665fb48e9eee44ec6d610514af383b1802cc1", "status": "affected", "versionType": "git"}, {"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "lessThan": "246de677552fe5dede293a1543b632e9853f31e4", "status": "affected", "versionType": "git"}, {"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "lessThan": "001ba7c1d9677225a5ecbc3e60d4865c08bb21d8", "status": "affected", "versionType": "git"}, {"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "lessThan": "ea11ade10583cc45af515d6b24510dbfa0184ca6", "status": "affected", "versionType": "git"}, {"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "lessThan": "cdc31537012bc7a58c95c6750db321b69dd802bb", "status": "affected", "versionType": "git"}, {"version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "lessThan": "1589afe2d099d3e817873bc474676968d7080410", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/6fire/pcm.c"], "versions": [{"version": "2.6.39", "status": "affected"}, {"version": "0", "lessThan": "2.6.39", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/61e665fb48e9eee44ec6d610514af383b1802cc1"}, {"url": "https://git.kernel.org/stable/c/246de677552fe5dede293a1543b632e9853f31e4"}, {"url": "https://git.kernel.org/stable/c/001ba7c1d9677225a5ecbc3e60d4865c08bb21d8"}, {"url": "https://git.kernel.org/stable/c/ea11ade10583cc45af515d6b24510dbfa0184ca6"}, {"url": "https://git.kernel.org/stable/c/cdc31537012bc7a58c95c6750db321b69dd802bb"}, {"url": "https://git.kernel.org/stable/c/1589afe2d099d3e817873bc474676968d7080410"}], "title": "ALSA: 6fire: fix OOB write from device-reported iso length", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["sound/usb/6fire/pcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "61e665fb48e9eee44ec6d610514af383b1802cc1", "status": "affected", "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "versionType": "git"}, {"lessThan": "246de677552fe5dede293a1543b632e9853f31e4", "status": "affected", "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "versionType": "git"}, {"lessThan": "001ba7c1d9677225a5ecbc3e60d4865c08bb21d8", "status": "affected", "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "versionType": "git"}, {"lessThan": "ea11ade10583cc45af515d6b24510dbfa0184ca6", "status": "affected", "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "versionType": "git"}, {"lessThan": "cdc31537012bc7a58c95c6750db321b69dd802bb", "status": "affected", "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "versionType": "git"}, {"lessThan": "1589afe2d099d3e817873bc474676968d7080410", "status": "affected", "version": "c6d43ba816d1cf1d125bfbfc938f2a28a87facf9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["sound/usb/6fire/pcm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.39"}, {"lessThan": "2.6.39", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix OOB write from device-reported iso length\n\nusb6fire_pcm_in_urb_handler() sizes each outgoing isochronous packet as\n(actual_length - 4) / (in_n_analog << 2) * (out_n_analog << 2) + 4, where\nactual_length is the unsigned length the device reported for the matching\nIN packet. A packet completed with status 0 and actual_length < 4 wraps\nthe subtraction to 0x7fffffec; a zero-length isochronous packet is legal\non the bus, and the preceding loop rejects only non-zero status. The sum\nreaches memset() on out_urb->buffer, a 4832-byte object from\nkcalloc(PCM_MAX_PACKET_SIZE, PCM_N_PACKETS_PER_URB).\n\nEven without the wrap the result is out of bounds: at 88.2/96 kHz the\n4-in/6-out scaling turns a full 420-byte IN packet into 628, so eight\npackets span 5024 bytes of that buffer. usb_submit_urb() rejects an\nover-long descriptor only after the memset() and the\nusb6fire_pcm_playback() copy of user PCM data have run.\n\nGuard the subtraction as the sibling usb6fire_pcm_capture() already does,\nand limit the frame count to what fits in rt->out_packet_size, the OUT\nendpoint's wMaxPacketSize. This bounds total_length by the buffer size\nwhile keeping each packet length aligned to a whole output frame.\n\n BUG: KASAN: out-of-bounds in usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338)\n Write of size 18446744073709551456 at addr ffff88802a3d0000 by task vhci_rx/5018\n Call Trace:\n dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\n print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n kasan_report (mm/kasan/report.c:595)\n kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200)\n __asan_memset (mm/kasan/shadow.c:84)\n usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338)\n __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)\n usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)\n vhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107 drivers/usb/usbip/vhci_rx.c:242)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n\n Allocated by task 10:\n __kmalloc_cache_noprof (mm/slub.c:5563)\n usb6fire_pcm_init (sound/usb/6fire/pcm.c:560 sound/usb/6fire/pcm.c:595)\n usb6fire_chip_probe (sound/usb/6fire/chip.c:133)\n usb_probe_interface (drivers/usb/core/driver.c:399)\n\n The buggy address belongs to the object at ffff88802a3d0000\n which belongs to the cache kmalloc-8k of size 8192\n The buggy address is located 0 bytes inside of\n 4832-byte region [ffff88802a3d0000, ffff88802a3d12e0)\n Kernel panic - not syncing: Fatal exception in interrupt"}], "id": "CVE-2026-98312", "lastModified": "2026-10-19T10:18:33.290", "metrics": {}, "published": "2026-10-06T09:18:22.727", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/001ba7c1d9677225a5ecbc3e60d4865c08bb21d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1589afe2d099d3e817873bc474676968d7080410"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/246de677552fe5dede293a1543b632e9853f31e4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/61e665fb48e9eee44ec6d610514af383b1802cc1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cdc31537012bc7a58c95c6750db321b69dd802bb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea11ade10583cc45af515d6b24510dbfa0184ca6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ALSA: 6fire: fix OOB write from device-reported iso length", "id": "2546353", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546353"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: 6fire: fix OOB write from device-reported iso length\nusb6fire_pcm_in_urb_handler() sizes each outgoing isochronous packet as\n(actual_length - 4) / (in_n_analog << 2) * (out_n_analog << 2) + 4, where\nactual_length is the unsigned length the device reported for the matching\nIN packet. A packet completed with status 0 and actual_length < 4 wraps\nthe subtraction to 0x7fffffec; a zero-length isochronous packet is legal\non the bus, and the preceding loop rejects only non-zero status. The sum\nreaches memset() on out_urb->buffer, a 4832-byte object from\nkcalloc(PCM_MAX_PACKET_SIZE, PCM_N_PACKETS_PER_URB).\nEven without the wrap the result is out of bounds: at 88.2/96 kHz the\n4-in/6-out scaling turns a full 420-byte IN packet into 628, so eight\npackets span 5024 bytes of that buffer. usb_submit_urb() rejects an\nover-long descriptor only after the memset() and the\nusb6fire_pcm_playback() copy of user PCM data have run.\nGuard the subtraction as the sibling usb6fire_pcm_capture() already does,\nand limit the frame count to what fits in rt->out_packet_size, the OUT\nendpoint's wMaxPacketSize. This bounds total_length by the buffer size\nwhile keeping each packet length aligned to a whole output frame.\nBUG: KASAN: out-of-bounds in usb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338)\nWrite of size 18446744073709551456 at addr ffff88802a3d0000 by task vhci_rx/5018\nCall Trace:\ndump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\nprint_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\nkasan_report (mm/kasan/report.c:595)\nkasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200)\n__asan_memset (mm/kasan/shadow.c:84)\nusb6fire_pcm_in_urb_handler (sound/usb/6fire/pcm.c:338)\n__usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)\nusb_hcd_giveback_urb (drivers/usb/core/hcd.c:1741)\nvhci_rx_loop (drivers/usb/usbip/vhci_rx.c:107 drivers/usb/usbip/vhci_rx.c:242)\nkthread (kernel/kthread.c:436)\nret_from_fork (arch/x86/kernel/process.c:158)\nret_from_fork_asm (arch/x86/entry/entry_64.S:245)\nAllocated by task 10:\n__kmalloc_cache_noprof (mm/slub.c:5563)\nusb6fire_pcm_init (sound/usb/6fire/pcm.c:560 sound/usb/6fire/pcm.c:595)\nusb6fire_chip_probe (sound/usb/6fire/chip.c:133)\nusb_probe_interface (drivers/usb/core/driver.c:399)\nThe buggy address belongs to the object at ffff88802a3d0000\nwhich belongs to the cache kmalloc-8k of size 8192\nThe buggy address is located 0 bytes inside of\n4832-byte region [ffff88802a3d0000, ffff88802a3d12e0)\nKernel panic - not syncing: Fatal exception in interrupt", "A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) 6fire USB audio driver. When processing incoming audio data, the driver improperly calculates buffer sizes based on device-reported packet lengths without sufficient bounds checking. An attacker capable of connecting a crafted USB device could exploit this issue to trigger an out-of-bounds write, leading to a system crash, denial of service (DoS), or potentially arbitrary code execution."], "name": "CVE-2026-98312", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98312\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98312\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98312.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c6d43ba816d1cf1d125bfbfc938f2a28a87facf9,61e665fb48e9eee44ec6d610514af383b1802cc1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c6d43ba816d1cf1d125bfbfc938f2a28a87facf9,246de677552fe5dede293a1543b632e9853f31e4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c6d43ba816d1cf1d125bfbfc938f2a28a87facf9,001ba7c1d9677225a5ecbc3e60d4865c08bb21d8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c6d43ba816d1cf1d125bfbfc938f2a28a87facf9,ea11ade10583cc45af515d6b24510dbfa0184ca6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c6d43ba816d1cf1d125bfbfc938f2a28a87facf9,cdc31537012bc7a58c95c6750db321b69dd802bb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c6d43ba816d1cf1d125bfbfc938f2a28a87facf9,1589afe2d099d3e817873bc474676968d7080410)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.39"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.39)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T13:00:15.830213+00:00", "updated": "2026-10-10T02:00:11.799949+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-787"]}