CVE-2026-98550

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98550", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.356Z", "datePublished": "2026-10-18T15:18:18.173Z", "dateUpdated": "2026-10-24T14:09:23.470Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:09:23.470Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow\n\nCommit 48a5fe38772b (\"tipc: fix bc_ackers underflow on duplicate\nGRP_ACK_MSG\") rejected duplicate/stale ACKs in tipc_group_proto_rcv()\nby returning early when less_eq(acked, m->bc_acked).\n\nHowever, that check remains incomplete in two ways:\n\n1. When grp->bc_ackers is zero (e.g. on a quiet group, when replicast\n ACKs were not requested, or after all expected members have already\n acknowledged), an unexpected GRP_ACK_MSG with acked > m->bc_acked\n passes less_eq() and unconditionally decrements grp->bc_ackers.\n Because bc_ackers is a u16, this wraps to 65535, causing\n tipc_group_bc_cong() to permanently report congestion and blocking\n all future group broadcasts on the socket.\n\n2. During an active broadcast round (grp->bc_ackers > 0), the sender\n transmits packet S and advances grp->bc_snd_nxt to S + 1. Receivers\n increment their expected counter to S + 1 upon consuming packet S,\n so the only valid ACK value for the current round is strictly\n acked == grp->bc_snd_nxt.\n\n However, tipc_group_update_bc_members() initializes each member's\n m->bc_acked to prev = grp->bc_snd_nxt - 1 (S - 1 before increment).\n This leaves a 2-sequence gap (S - 1 to S + 1) in sequence space.\n An incoming ACK is therefore neither rejected as duplicate nor\n prevented from decrementing grp->bc_ackers if an unexpected or stale\n value (such as S) is received. A member sending acked = S followed\n by acked = S + 1 could decrement grp->bc_ackers twice in the same\n round, prematurely clearing bc_ackers or underflowing it.\n\nFix this by:\n- Dropping GRP_ACK_MSG immediately if grp->bc_ackers is zero.\n- Requiring acked == grp->bc_snd_nxt and rejecting duplicates where\n m->bc_acked == acked. Because replicast broadcast rounds are strictly\n sequential, only grp->bc_snd_nxt can be acknowledged, and each member\n can acknowledge at most once per round.\n\nNote that a related pre-existing issue in tipc_group_delete_member()\n(where grp->bc_ackers decrementing to zero upon member departure does\nnot restore *grp->open or trigger a socket wakeup) will be addressed\nin a separate patch."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - A crafted UDP/IP TIPC GROUP_PROTOCOL/GRP_ACK_MSG carrying attacker-controlled msg_grp_bc_acked() reaches tipc_group_proto_rcv() through tipc_udp_recv(), tipc_rcv(), link delivery, and socket filtering. The UDP bearer is routable.\nAC:L - After becoming a recognized group member, the attacker can send one ACK that compares newer than m->bc_acked while grp->bc_ackers is zero, deterministically causing the underflow. No race or external condition is required.\nPR:N - The GRP_ACK_MSG case in tipc_group_proto_rcv() verifies only that the packet's origin node and port match a tipc_member; it performs no credential or capability check. TIPC wire encryption is optional, so no victim-system privilege is required.\nUI:N - Once a cluster-scope TIPC group socket exists, the remote member triggers tipc_group_proto_rcv() solely by sending the crafted GRP_ACK_MSG; no victim action is needed.\nS:U - The malformed ACK changes grp->bc_ackers and availability of the same kernel-managed TIPC group socket; it does not cross a VM, sandbox, or other security-authority boundary.\nC:N - The faulty operation is a decrement of the u16 grp->bc_ackers field from zero to 65535. It neither reads outside an object nor returns kernel or application data to the sender.\nI:N - The bug alters only TIPC ACK-accounting state through the intended grp->bc_ackers field; it provides no out-of-bounds write, control-flow primitive, or modification of application data.\nA:H - After grp->bc_ackers wraps to 65535, tipc_group_bc_cong() continually reports congestion and tipc_send_group_bcast() blocks or fails all later broadcasts on that socket until the group is recreated."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/group.c"], "versions": [{"version": "2f487712b89376fce267223bbb0db93d393d4b09", "lessThan": "edc6593c442278fceff0120e8cc58bc592168c35", "status": "affected", "versionType": "git"}, {"version": "2f487712b89376fce267223bbb0db93d393d4b09", "lessThan": "9b94a90651e1fa573c6ac6a5a6b269d5874df2c0", "status": "affected", "versionType": "git"}, {"version": "2f487712b89376fce267223bbb0db93d393d4b09", "lessThan": "507a27435b2bb1f22e3a3674f6a6553eb815021b", "status": "affected", "versionType": "git"}, {"version": "2f487712b89376fce267223bbb0db93d393d4b09", "lessThan": "80a9ccfc24d3776ef6753a57315e726475fac7d7", "status": "affected", "versionType": "git"}, {"version": "2f487712b89376fce267223bbb0db93d393d4b09", "lessThan": "478fb08d0c2a53002a721d22b8d6681ec971d90f", "status": "affected", "versionType": "git"}, {"version": "2f487712b89376fce267223bbb0db93d393d4b09", "lessThan": "12cc3a1eac5a2a06b67a7b85f0f48ff241a94d1b", "status": "affected", "versionType": "git"}, {"version": "2f487712b89376fce267223bbb0db93d393d4b09", "lessThan": "b0e517961f09b9f60d338d1ea4e17aacdbf206f0", "status": "affected", "versionType": "git"}, {"version": "2f487712b89376fce267223bbb0db93d393d4b09", "lessThan": "99cc2a62e07a44a22254d7beca9ef1f8ad886d0d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/group.c"], "versions": [{"version": "4.15", "status": "affected"}, {"version": "0", "lessThan": "4.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/edc6593c442278fceff0120e8cc58bc592168c35"}, {"url": "https://git.kernel.org/stable/c/9b94a90651e1fa573c6ac6a5a6b269d5874df2c0"}, {"url": "https://git.kernel.org/stable/c/507a27435b2bb1f22e3a3674f6a6553eb815021b"}, {"url": "https://git.kernel.org/stable/c/80a9ccfc24d3776ef6753a57315e726475fac7d7"}, {"url": "https://git.kernel.org/stable/c/478fb08d0c2a53002a721d22b8d6681ec971d90f"}, {"url": "https://git.kernel.org/stable/c/12cc3a1eac5a2a06b67a7b85f0f48ff241a94d1b"}, {"url": "https://git.kernel.org/stable/c/b0e517961f09b9f60d338d1ea4e17aacdbf206f0"}, {"url": "https://git.kernel.org/stable/c/99cc2a62e07a44a22254d7beca9ef1f8ad886d0d"}], "title": "tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/tipc/group.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "edc6593c442278fceff0120e8cc58bc592168c35", "status": "affected", "version": "2f487712b89376fce267223bbb0db93d393d4b09", "versionType": "git"}, {"lessThan": "9b94a90651e1fa573c6ac6a5a6b269d5874df2c0", "status": "affected", "version": "2f487712b89376fce267223bbb0db93d393d4b09", "versionType": "git"}, {"lessThan": "507a27435b2bb1f22e3a3674f6a6553eb815021b", "status": "affected", "version": "2f487712b89376fce267223bbb0db93d393d4b09", "versionType": "git"}, {"lessThan": "80a9ccfc24d3776ef6753a57315e726475fac7d7", "status": "affected", "version": "2f487712b89376fce267223bbb0db93d393d4b09", "versionType": "git"}, {"lessThan": "478fb08d0c2a53002a721d22b8d6681ec971d90f", "status": "affected", "version": "2f487712b89376fce267223bbb0db93d393d4b09", "versionType": "git"}, {"lessThan": "12cc3a1eac5a2a06b67a7b85f0f48ff241a94d1b", "status": "affected", "version": "2f487712b89376fce267223bbb0db93d393d4b09", "versionType": "git"}, {"lessThan": "b0e517961f09b9f60d338d1ea4e17aacdbf206f0", "status": "affected", "version": "2f487712b89376fce267223bbb0db93d393d4b09", "versionType": "git"}, {"lessThan": "99cc2a62e07a44a22254d7beca9ef1f8ad886d0d", "status": "affected", "version": "2f487712b89376fce267223bbb0db93d393d4b09", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/tipc/group.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow\n\nCommit 48a5fe38772b (\"tipc: fix bc_ackers underflow on duplicate\nGRP_ACK_MSG\") rejected duplicate/stale ACKs in tipc_group_proto_rcv()\nby returning early when less_eq(acked, m->bc_acked).\n\nHowever, that check remains incomplete in two ways:\n\n1. When grp->bc_ackers is zero (e.g. on a quiet group, when replicast\n ACKs were not requested, or after all expected members have already\n acknowledged), an unexpected GRP_ACK_MSG with acked > m->bc_acked\n passes less_eq() and unconditionally decrements grp->bc_ackers.\n Because bc_ackers is a u16, this wraps to 65535, causing\n tipc_group_bc_cong() to permanently report congestion and blocking\n all future group broadcasts on the socket.\n\n2. During an active broadcast round (grp->bc_ackers > 0), the sender\n transmits packet S and advances grp->bc_snd_nxt to S + 1. Receivers\n increment their expected counter to S + 1 upon consuming packet S,\n so the only valid ACK value for the current round is strictly\n acked == grp->bc_snd_nxt.\n\n However, tipc_group_update_bc_members() initializes each member's\n m->bc_acked to prev = grp->bc_snd_nxt - 1 (S - 1 before increment).\n This leaves a 2-sequence gap (S - 1 to S + 1) in sequence space.\n An incoming ACK is therefore neither rejected as duplicate nor\n prevented from decrementing grp->bc_ackers if an unexpected or stale\n value (such as S) is received. A member sending acked = S followed\n by acked = S + 1 could decrement grp->bc_ackers twice in the same\n round, prematurely clearing bc_ackers or underflowing it.\n\nFix this by:\n- Dropping GRP_ACK_MSG immediately if grp->bc_ackers is zero.\n- Requiring acked == grp->bc_snd_nxt and rejecting duplicates where\n m->bc_acked == acked. Because replicast broadcast rounds are strictly\n sequential, only grp->bc_snd_nxt can be acknowledged, and each member\n can acknowledge at most once per round.\n\nNote that a related pre-existing issue in tipc_group_delete_member()\n(where grp->bc_ackers decrementing to zero upon member departure does\nnot restore *grp->open or trigger a socket wakeup) will be addressed\nin a separate patch."}], "id": "CVE-2026-98550", "lastModified": "2026-10-24T14:16:47.290", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-18T16:17:07.030", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/12cc3a1eac5a2a06b67a7b85f0f48ff241a94d1b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/478fb08d0c2a53002a721d22b8d6681ec971d90f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/507a27435b2bb1f22e3a3674f6a6553eb815021b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/80a9ccfc24d3776ef6753a57315e726475fac7d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/99cc2a62e07a44a22254d7beca9ef1f8ad886d0d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b94a90651e1fa573c6ac6a5a6b269d5874df2c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b0e517961f09b9f60d338d1ea4e17aacdbf206f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/edc6593c442278fceff0120e8cc58bc592168c35"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow", "id": "2554946", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554946"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow\nCommit 48a5fe38772b (\"tipc: fix bc_ackers underflow on duplicate\nGRP_ACK_MSG\") rejected duplicate/stale ACKs in tipc_group_proto_rcv()\nby returning early when less_eq(acked, m->bc_acked).\nHowever, that check remains incomplete in two ways:\n1. When grp->bc_ackers is zero (e.g. on a quiet group, when replicast\nACKs were not requested, or after all expected members have already\nacknowledged), an unexpected GRP_ACK_MSG with acked > m->bc_acked\npasses less_eq() and unconditionally decrements grp->bc_ackers.\nBecause bc_ackers is a u16, this wraps to 65535, causing\ntipc_group_bc_cong() to permanently report congestion and blocking\nall future group broadcasts on the socket.\n2. During an active broadcast round (grp->bc_ackers > 0), the sender\ntransmits packet S and advances grp->bc_snd_nxt to S + 1. Receivers\nincrement their expected counter to S + 1 upon consuming packet S,\nso the only valid ACK value for the current round is strictly\nacked == grp->bc_snd_nxt.\nHowever, tipc_group_update_bc_members() initializes each member's\nm->bc_acked to prev = grp->bc_snd_nxt - 1 (S - 1 before increment).\nThis leaves a 2-sequence gap (S - 1 to S + 1) in sequence space.\nAn incoming ACK is therefore neither rejected as duplicate nor\nprevented from decrementing grp->bc_ackers if an unexpected or stale\nvalue (such as S) is received. A member sending acked = S followed\nby acked = S + 1 could decrement grp->bc_ackers twice in the same\nround, prematurely clearing bc_ackers or underflowing it.\nFix this by:\n- Dropping GRP_ACK_MSG immediately if grp->bc_ackers is zero.\n- Requiring acked == grp->bc_snd_nxt and rejecting duplicates where\nm->bc_acked == acked. Because replicast broadcast rounds are strictly\nsequential, only grp->bc_snd_nxt can be acknowledged, and each member\ncan acknowledge at most once per round.\nNote that a related pre-existing issue in tipc_group_delete_member()\n(where grp->bc_ackers decrementing to zero upon member departure does\nnot restore *grp->open or trigger a socket wakeup) will be addressed\nin a separate patch.", "A flaw was found in the TIPC (Transparent Inter-Process Communication) subsystem of the Linux kernel. This flaw allows an attacker to cause a Denial of Service (DoS) by sending unexpected or duplicate group acknowledgment messages. Due to improper validation of incoming protocol messages, an internal acknowledgment counter can underflow, permanently placing the socket into a congested state and blocking all subsequent broadcast communication."], "name": "CVE-2026-98550", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98550\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98550\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98550.mbox"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f487712b89376fce267223bbb0db93d393d4b09,edc6593c442278fceff0120e8cc58bc592168c35)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f487712b89376fce267223bbb0db93d393d4b09,9b94a90651e1fa573c6ac6a5a6b269d5874df2c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f487712b89376fce267223bbb0db93d393d4b09,507a27435b2bb1f22e3a3674f6a6553eb815021b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f487712b89376fce267223bbb0db93d393d4b09,80a9ccfc24d3776ef6753a57315e726475fac7d7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f487712b89376fce267223bbb0db93d393d4b09,478fb08d0c2a53002a721d22b8d6681ec971d90f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f487712b89376fce267223bbb0db93d393d4b09,12cc3a1eac5a2a06b67a7b85f0f48ff241a94d1b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f487712b89376fce267223bbb0db93d393d4b09,b0e517961f09b9f60d338d1ea4e17aacdbf206f0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f487712b89376fce267223bbb0db93d393d4b09,99cc2a62e07a44a22254d7beca9ef1f8ad886d0d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T18:15:15.190320+00:00", "updated": "2026-10-22T23:00:14.524055+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}