CVE-2026-98581

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98581", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.358Z", "datePublished": "2026-10-18T15:18:54.696Z", "dateUpdated": "2026-10-19T09:22:07.016Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:07.016Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()\n\nnfc_llcp_recv_dm() handles DM(NOBOUND)/DM(REJ) for a socket that is still\nlinked on local->connecting_sockets: it looks the socket up with\nnfc_llcp_connecting_sock_get(), sets sk->sk_state = LLCP_CLOSED and\nreturns, without taking the socket lock and without unlinking the socket\nfrom the connecting_sockets list.\n\nllcp_sock_release() selects the list to unlink from by sk_state: a socket\nin LLCP_CONNECTING is unlinked from connecting_sockets, otherwise from the\nsockets list. Because recv_dm left the socket physically on\nconnecting_sockets but in the LLCP_CLOSED state, release() takes the else\nbranch and calls nfc_llcp_sock_unlink(&local->sockets, sk). That runs\nsk_del_node_init() while holding sockets.lock, i.e. it removes the socket\nfrom the connecting_sockets hlist under the wrong lock. A concurrent\nconnect() linking another socket onto connecting_sockets under\nconnecting_sockets.lock then mutates the same hlist unserialized, which\ncorrupts the list and desyncs the sk_add_node()/sk_del_node_init()\nsock_hold()/__sock_put() pairing. An unprivileged local process holding\nLLCP sockets, with the DM supplied by the remote peer over an established\nLLCP link, can drive this to leak kernel sockets without bound (the\nmis-decrement goes through the non-freeing __sock_put() path, so the\nobject is never released), leading to memory exhaustion / DoS.\n\nThis is the same class of bug that was fixed in the sibling handler\nnfc_llcp_recv_cc() by commit b493ea2765cc (\"nfc: llcp: Fix use-after-free\nrace in nfc_llcp_recv_cc()\"); recv_dm did not receive the equivalent fix.\n\nFix it the same way: take lock_sock(), re-check that the socket is still\nhashed (release() may have won the race), and for the NOBOUND/REJ case\nunlink it from connecting_sockets before moving it to LLCP_CLOSED. The\nunlink drops the connecting_sockets membership reference via\nsk_del_node_init(), leaving the socket unhashed, so the later\nnfc_llcp_sock_unlink() in llcp_sock_release() becomes a no-op and no\ndouble put occurs."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/nfc/llcp_core.c"], "versions": [{"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "lessThan": "dd2d24add86b3b63cd87cf2feff98ae119ba19a6", "status": "affected", "versionType": "git"}, {"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "lessThan": "812731dd8511f5768f4ff279b3c18d85cd21da4b", "status": "affected", "versionType": "git"}, {"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "lessThan": "dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08", "status": "affected", "versionType": "git"}, {"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "lessThan": "c1e9ed52a6697354366dddf190fbacee8ed2f7c5", "status": "affected", "versionType": "git"}, {"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "lessThan": "7fb2c0eeb79bfad64065f539a453138abd0edda6", "status": "affected", "versionType": "git"}, {"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "lessThan": "b94cf09720543cc34256c7aa88f8059cbe7c0419", "status": "affected", "versionType": "git"}, {"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "lessThan": "320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1", "status": "affected", "versionType": "git"}, {"version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "lessThan": "bf1460acdf8cf5a07c819f59785d40f20d113099", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/nfc/llcp_core.c"], "versions": [{"version": "3.6", "status": "affected"}, {"version": "0", "lessThan": "3.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dd2d24add86b3b63cd87cf2feff98ae119ba19a6"}, {"url": "https://git.kernel.org/stable/c/812731dd8511f5768f4ff279b3c18d85cd21da4b"}, {"url": "https://git.kernel.org/stable/c/dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08"}, {"url": "https://git.kernel.org/stable/c/c1e9ed52a6697354366dddf190fbacee8ed2f7c5"}, {"url": "https://git.kernel.org/stable/c/7fb2c0eeb79bfad64065f539a453138abd0edda6"}, {"url": "https://git.kernel.org/stable/c/b94cf09720543cc34256c7aa88f8059cbe7c0419"}, {"url": "https://git.kernel.org/stable/c/320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1"}, {"url": "https://git.kernel.org/stable/c/bf1460acdf8cf5a07c819f59785d40f20d113099"}], "title": "nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/nfc/llcp_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dd2d24add86b3b63cd87cf2feff98ae119ba19a6", "status": "affected", "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "versionType": "git"}, {"lessThan": "812731dd8511f5768f4ff279b3c18d85cd21da4b", "status": "affected", "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "versionType": "git"}, {"lessThan": "dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08", "status": "affected", "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "versionType": "git"}, {"lessThan": "c1e9ed52a6697354366dddf190fbacee8ed2f7c5", "status": "affected", "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "versionType": "git"}, {"lessThan": "7fb2c0eeb79bfad64065f539a453138abd0edda6", "status": "affected", "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "versionType": "git"}, {"lessThan": "b94cf09720543cc34256c7aa88f8059cbe7c0419", "status": "affected", "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "versionType": "git"}, {"lessThan": "320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1", "status": "affected", "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "versionType": "git"}, {"lessThan": "bf1460acdf8cf5a07c819f59785d40f20d113099", "status": "affected", "version": "a69f32af86e389dd232b1bb2269e202c1bfcc60f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/nfc/llcp_core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.6"}, {"lessThan": "3.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()\n\nnfc_llcp_recv_dm() handles DM(NOBOUND)/DM(REJ) for a socket that is still\nlinked on local->connecting_sockets: it looks the socket up with\nnfc_llcp_connecting_sock_get(), sets sk->sk_state = LLCP_CLOSED and\nreturns, without taking the socket lock and without unlinking the socket\nfrom the connecting_sockets list.\n\nllcp_sock_release() selects the list to unlink from by sk_state: a socket\nin LLCP_CONNECTING is unlinked from connecting_sockets, otherwise from the\nsockets list. Because recv_dm left the socket physically on\nconnecting_sockets but in the LLCP_CLOSED state, release() takes the else\nbranch and calls nfc_llcp_sock_unlink(&local->sockets, sk). That runs\nsk_del_node_init() while holding sockets.lock, i.e. it removes the socket\nfrom the connecting_sockets hlist under the wrong lock. A concurrent\nconnect() linking another socket onto connecting_sockets under\nconnecting_sockets.lock then mutates the same hlist unserialized, which\ncorrupts the list and desyncs the sk_add_node()/sk_del_node_init()\nsock_hold()/__sock_put() pairing. An unprivileged local process holding\nLLCP sockets, with the DM supplied by the remote peer over an established\nLLCP link, can drive this to leak kernel sockets without bound (the\nmis-decrement goes through the non-freeing __sock_put() path, so the\nobject is never released), leading to memory exhaustion / DoS.\n\nThis is the same class of bug that was fixed in the sibling handler\nnfc_llcp_recv_cc() by commit b493ea2765cc (\"nfc: llcp: Fix use-after-free\nrace in nfc_llcp_recv_cc()\"); recv_dm did not receive the equivalent fix.\n\nFix it the same way: take lock_sock(), re-check that the socket is still\nhashed (release() may have won the race), and for the NOBOUND/REJ case\nunlink it from connecting_sockets before moving it to LLCP_CLOSED. The\nunlink drops the connecting_sockets membership reference via\nsk_del_node_init(), leaving the socket unhashed, so the later\nnfc_llcp_sock_unlink() in llcp_sock_release() becomes a no-op and no\ndouble put occurs."}], "id": "CVE-2026-98581", "lastModified": "2026-10-19T10:19:18.807", "metrics": {}, "published": "2026-10-18T16:17:10.610", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7fb2c0eeb79bfad64065f539a453138abd0edda6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/812731dd8511f5768f4ff279b3c18d85cd21da4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b94cf09720543cc34256c7aa88f8059cbe7c0419"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf1460acdf8cf5a07c819f59785d40f20d113099"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c1e9ed52a6697354366dddf190fbacee8ed2f7c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd2d24add86b3b63cd87cf2feff98ae119ba19a6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()", "id": "2554913", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554913"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-413", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()\nnfc_llcp_recv_dm() handles DM(NOBOUND)/DM(REJ) for a socket that is still\nlinked on local->connecting_sockets: it looks the socket up with\nnfc_llcp_connecting_sock_get(), sets sk->sk_state = LLCP_CLOSED and\nreturns, without taking the socket lock and without unlinking the socket\nfrom the connecting_sockets list.\nllcp_sock_release() selects the list to unlink from by sk_state: a socket\nin LLCP_CONNECTING is unlinked from connecting_sockets, otherwise from the\nsockets list. Because recv_dm left the socket physically on\nconnecting_sockets but in the LLCP_CLOSED state, release() takes the else\nbranch and calls nfc_llcp_sock_unlink(&local->sockets, sk). That runs\nsk_del_node_init() while holding sockets.lock, i.e. it removes the socket\nfrom the connecting_sockets hlist under the wrong lock. A concurrent\nconnect() linking another socket onto connecting_sockets under\nconnecting_sockets.lock then mutates the same hlist unserialized, which\ncorrupts the list and desyncs the sk_add_node()/sk_del_node_init()\nsock_hold()/__sock_put() pairing. An unprivileged local process holding\nLLCP sockets, with the DM supplied by the remote peer over an established\nLLCP link, can drive this to leak kernel sockets without bound (the\nmis-decrement goes through the non-freeing __sock_put() path, so the\nobject is never released), leading to memory exhaustion / DoS.\nThis is the same class of bug that was fixed in the sibling handler\nnfc_llcp_recv_cc() by commit b493ea2765cc (\"nfc: llcp: Fix use-after-free\nrace in nfc_llcp_recv_cc()\"); recv_dm did not receive the equivalent fix.\nFix it the same way: take lock_sock(), re-check that the socket is still\nhashed (release() may have won the race), and for the NOBOUND/REJ case\nunlink it from connecting_sockets before moving it to LLCP_CLOSED. The\nunlink drops the connecting_sockets membership reference via\nsk_del_node_init(), leaving the socket unhashed, so the later\nnfc_llcp_sock_unlink() in llcp_sock_release() becomes a no-op and no\ndouble put occurs.", "A flaw was found in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. When handling specific disconnection packets, the kernel fails to properly lock and unlink sockets before updating their state, leading to internal socket list corruption. A local user can exploit this flaw through concurrent socket operations to continuously leak kernel memory, ultimately causing system resource exhaustion and a Denial of Service (DoS)."], "name": "CVE-2026-98581", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98581\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98581\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98581.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a69f32af86e389dd232b1bb2269e202c1bfcc60f,dd2d24add86b3b63cd87cf2feff98ae119ba19a6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a69f32af86e389dd232b1bb2269e202c1bfcc60f,812731dd8511f5768f4ff279b3c18d85cd21da4b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a69f32af86e389dd232b1bb2269e202c1bfcc60f,dba1d9c7134afcb4b1bfad8c1b1b3f0ab5189b08)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a69f32af86e389dd232b1bb2269e202c1bfcc60f,c1e9ed52a6697354366dddf190fbacee8ed2f7c5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a69f32af86e389dd232b1bb2269e202c1bfcc60f,7fb2c0eeb79bfad64065f539a453138abd0edda6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a69f32af86e389dd232b1bb2269e202c1bfcc60f,b94cf09720543cc34256c7aa88f8059cbe7c0419)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a69f32af86e389dd232b1bb2269e202c1bfcc60f,320a2ff49bdce3f9a437b9a9ff341ff27d3bdbf1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a69f32af86e389dd232b1bb2269e202c1bfcc60f,bf1460acdf8cf5a07c819f59785d40f20d113099)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:15:14.328485+00:00", "updated": "2026-10-22T22:00:15.031955+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}