CVE-2026-98524

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98524", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.355Z", "datePublished": "2026-10-18T15:17:41.420Z", "dateUpdated": "2026-10-24T14:09:17.970Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:17.970Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: Clear the sg list when mapping an MR fails\n\nrds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still\nreturn the MR to the pool with the stale pointer set.\n\nThis leaves the pool with a dangling scatterlist and can lead to local\nprivilege escalation. KASAN detects the resulting use-after-free when the\nMR is later torn down:\n\nBUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr\nRead of size 8\n\nCall Trace:\n __rds_ib_teardown_mr\n rds_ib_unreg_frmr\n rds_ib_flush_mr_pool\n rds_ib_flush_mrs\n rds_free_mr\n rds_setsockopt\n\nStore the scatterlist in the MR only after DMA mapping succeeds. If DMA\nmapping fails, return directly while the MR fields remain clear; the caller\nkeeps ownership of the scatterlist and its pinned pages. If a later\nregistration step fails, unmap the scatterlist and clear the MR fields\nbefore returning."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker reaches patched rds_ib_map_frmr() through sendmsg() with a local RDS_CMSG_RDMA_MAP control message; no RDS packet field from a remote peer supplies the scatterlist or faulty ownership state.\nAC:L - On HNS hardware, the attacker can start an outgoing RDS connection and retry sendmsg() while its QP is RESET/INIT/RTR; check_send_valid() makes hns_roce_v2_post_send() return -EINVAL to rds_ib_post_reg_frmr(), creating the required failure.\nPR:L - rds_create(), rds_bind(), and rds_sendmsg() impose no capability or authentication check, and __rds_rdma_map() accepts an unprivileged process whenever can_do_mlock() sees a nonzero RLIMIT_MEMLOCK; RDS/IB merely requires the host's initial network namespace.\nUI:N - The attacking process performs both RDS_CMSG_RDMA_MAP and the zero-cookie setsockopt(SOL_RDS, RDS_FREE_MR) that calls rds_ib_flush_mrs(); no victim action is required.\nS:U - The stale ibmr->sg is consumed by __rds_ib_teardown_mr() within the host kernel, so exploitation elevates authority inside that same kernel rather than crossing a VM, IOMMU, or other security boundary.\nC:H - __rds_ib_teardown_mr() obtains page pointers with sg_page() from a freed, reclaimable scatterlist; attacker-controlled reclamation and the subsequent invalid free can enable kernel-memory compromise and disclosure.\nI:H - Teardown passes page pointers taken from the stale scatterlist to unpin_user_pages_dirty_lock() and then kfree()s the already-freed or reallocated array, enabling page-refcount and heap corruption usable for arbitrary writes or control-flow takeover.\nA:H - The observed slab use-after-free occurs in __rds_ib_teardown_mr(); dereferencing an invalid sg_page(), unpinning the resulting bogus page, or freeing the dangling scatterlist can produce a kernel oops or panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/ib_frmr.c"], "versions": [{"version": "1659185fb4d0025835eb2058a141f0746c5cab00", "lessThan": "1be3211e6ac77adbb1eac01314d989d243b32c59", "status": "affected", "versionType": "git"}, {"version": "1659185fb4d0025835eb2058a141f0746c5cab00", "lessThan": "c42d316163f89cd23de2f3e24558177a8c29bad8", "status": "affected", "versionType": "git"}, {"version": "1659185fb4d0025835eb2058a141f0746c5cab00", "lessThan": "8dca3c81344532a7f05edb3d12f31f3009410a90", "status": "affected", "versionType": "git"}, {"version": "1659185fb4d0025835eb2058a141f0746c5cab00", "lessThan": "49ba5ed0129906e0362c2e4b5e21c89b2a41e115", "status": "affected", "versionType": "git"}, {"version": "1659185fb4d0025835eb2058a141f0746c5cab00", "lessThan": "4468df5bcdef959fd96494e9968f323561a45f4c", "status": "affected", "versionType": "git"}, {"version": "1659185fb4d0025835eb2058a141f0746c5cab00", "lessThan": "e2ee0616260080376123997488b5cf8a3870b8d9", "status": "affected", "versionType": "git"}, {"version": "1659185fb4d0025835eb2058a141f0746c5cab00", "lessThan": "b36d32f30c3f1e58e3a5ae79d0f52836a316b36e", "status": "affected", "versionType": "git"}, {"version": "1659185fb4d0025835eb2058a141f0746c5cab00", "lessThan": "58eb1b3325edac42dc6df72c80962bd53a3c8ca7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/ib_frmr.c"], "versions": [{"version": "4.6", "status": "affected"}, {"version": "0", "lessThan": "4.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1be3211e6ac77adbb1eac01314d989d243b32c59"}, {"url": "https://git.kernel.org/stable/c/c42d316163f89cd23de2f3e24558177a8c29bad8"}, {"url": "https://git.kernel.org/stable/c/8dca3c81344532a7f05edb3d12f31f3009410a90"}, {"url": "https://git.kernel.org/stable/c/49ba5ed0129906e0362c2e4b5e21c89b2a41e115"}, {"url": "https://git.kernel.org/stable/c/4468df5bcdef959fd96494e9968f323561a45f4c"}, {"url": "https://git.kernel.org/stable/c/e2ee0616260080376123997488b5cf8a3870b8d9"}, {"url": "https://git.kernel.org/stable/c/b36d32f30c3f1e58e3a5ae79d0f52836a316b36e"}, {"url": "https://git.kernel.org/stable/c/58eb1b3325edac42dc6df72c80962bd53a3c8ca7"}], "title": "rds: ib: Clear the sg list when mapping an MR fails", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rds/ib_frmr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1be3211e6ac77adbb1eac01314d989d243b32c59", "status": "affected", "version": "1659185fb4d0025835eb2058a141f0746c5cab00", "versionType": "git"}, {"lessThan": "c42d316163f89cd23de2f3e24558177a8c29bad8", "status": "affected", "version": "1659185fb4d0025835eb2058a141f0746c5cab00", "versionType": "git"}, {"lessThan": "8dca3c81344532a7f05edb3d12f31f3009410a90", "status": "affected", "version": "1659185fb4d0025835eb2058a141f0746c5cab00", "versionType": "git"}, {"lessThan": "49ba5ed0129906e0362c2e4b5e21c89b2a41e115", "status": "affected", "version": "1659185fb4d0025835eb2058a141f0746c5cab00", "versionType": "git"}, {"lessThan": "4468df5bcdef959fd96494e9968f323561a45f4c", "status": "affected", "version": "1659185fb4d0025835eb2058a141f0746c5cab00", "versionType": "git"}, {"lessThan": "e2ee0616260080376123997488b5cf8a3870b8d9", "status": "affected", "version": "1659185fb4d0025835eb2058a141f0746c5cab00", "versionType": "git"}, {"lessThan": "b36d32f30c3f1e58e3a5ae79d0f52836a316b36e", "status": "affected", "version": "1659185fb4d0025835eb2058a141f0746c5cab00", "versionType": "git"}, {"lessThan": "58eb1b3325edac42dc6df72c80962bd53a3c8ca7", "status": "affected", "version": "1659185fb4d0025835eb2058a141f0746c5cab00", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rds/ib_frmr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.6"}, {"lessThan": "4.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: Clear the sg list when mapping an MR fails\n\nrds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still\nreturn the MR to the pool with the stale pointer set.\n\nThis leaves the pool with a dangling scatterlist and can lead to local\nprivilege escalation. KASAN detects the resulting use-after-free when the\nMR is later torn down:\n\nBUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr\nRead of size 8\n\nCall Trace:\n __rds_ib_teardown_mr\n rds_ib_unreg_frmr\n rds_ib_flush_mr_pool\n rds_ib_flush_mrs\n rds_free_mr\n rds_setsockopt\n\nStore the scatterlist in the MR only after DMA mapping succeeds. If DMA\nmapping fails, return directly while the MR fields remain clear; the caller\nkeeps ownership of the scatterlist and its pinned pages. If a later\nregistration step fails, unmap the scatterlist and clear the MR fields\nbefore returning."}], "id": "CVE-2026-98524", "lastModified": "2026-10-24T14:16:46.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-18T16:17:03.827", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1be3211e6ac77adbb1eac01314d989d243b32c59"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4468df5bcdef959fd96494e9968f323561a45f4c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/49ba5ed0129906e0362c2e4b5e21c89b2a41e115"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/58eb1b3325edac42dc6df72c80962bd53a3c8ca7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8dca3c81344532a7f05edb3d12f31f3009410a90"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b36d32f30c3f1e58e3a5ae79d0f52836a316b36e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c42d316163f89cd23de2f3e24558177a8c29bad8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e2ee0616260080376123997488b5cf8a3870b8d9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: rds: ib: Clear the sg list when mapping an MR fails", "id": "2555039", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555039"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nrds: ib: Clear the sg list when mapping an MR fails\nrds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still\nreturn the MR to the pool with the stale pointer set.\nThis leaves the pool with a dangling scatterlist and can lead to local\nprivilege escalation. KASAN detects the resulting use-after-free when the\nMR is later torn down:\nBUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr\nRead of size 8\nCall Trace:\n__rds_ib_teardown_mr\nrds_ib_unreg_frmr\nrds_ib_flush_mr_pool\nrds_ib_flush_mrs\nrds_free_mr\nrds_setsockopt\nStore the scatterlist in the MR only after DMA mapping succeeds. If DMA\nmapping fails, return directly while the MR fields remain clear; the caller\nkeeps ownership of the scatterlist and its pinned pages. If a later\nregistration step fails, unmap the scatterlist and clear the MR fields\nbefore returning.", "A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. When memory region mapping fails during InfiniBand operations, the kernel can retain a stale reference to memory buffers that have already been released. A local attacker could exploit this flaw to trigger a use-after-free condition, potentially leading to local privilege escalation or a denial of service through a system crash."], "name": "CVE-2026-98524", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98524\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98524\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98524.mbox"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1659185fb4d0025835eb2058a141f0746c5cab00,1be3211e6ac77adbb1eac01314d989d243b32c59)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1659185fb4d0025835eb2058a141f0746c5cab00,c42d316163f89cd23de2f3e24558177a8c29bad8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1659185fb4d0025835eb2058a141f0746c5cab00,8dca3c81344532a7f05edb3d12f31f3009410a90)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1659185fb4d0025835eb2058a141f0746c5cab00,49ba5ed0129906e0362c2e4b5e21c89b2a41e115)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1659185fb4d0025835eb2058a141f0746c5cab00,4468df5bcdef959fd96494e9968f323561a45f4c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1659185fb4d0025835eb2058a141f0746c5cab00,e2ee0616260080376123997488b5cf8a3870b8d9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1659185fb4d0025835eb2058a141f0746c5cab00,b36d32f30c3f1e58e3a5ae79d0f52836a316b36e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1659185fb4d0025835eb2058a141f0746c5cab00,58eb1b3325edac42dc6df72c80962bd53a3c8ca7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,6.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,6.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:45:07.049143+00:00", "updated": "2026-10-20T16:30:06.799819+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}