CVE-2026-98968

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98968", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.383Z", "datePublished": "2026-10-23T12:19:39.236Z", "dateUpdated": "2026-10-30T12:40:34.695Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:34.695Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\namt: send the relay's General Query directly from the receive path\n\nAn skb queued in a qdisc can outlive the tunnel it references\nthrough a raw pointer in skb->cb. For example, with igmp_qrv set\nto 1 on the relay a tunnel lives for 135s, so a netem delay of\n180s on the amt device outlives it; when the tunnel expires and is\nfreed, the subsequent dequeue triggers a use-after-free in\namt_dev_xmit().\n\n BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20\n Call Trace:\n amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262]\n dev_hard_start_xmit+0x22f/0x620\n sch_direct_xmit+0x12e/0xac0\n netem_dequeue+0x333/0xc50\n net_tx_action+0x35c/0xa60\n\namt_send_igmp_gq() and amt_send_mld_gq() are only called from\namt_request_handler(), inside the rcu_read_lock_bh() section of\namt_rcv(). amt_request_handler() already has the tunnel the query is\nfor: it found or created it inside that section. Queuing the query with\ndev_queue_xmit() only leads back into amt_dev_xmit(), which strips the\nEthernet header and calls amt_send_membership_query() for that tunnel.\n\nMake that call directly from the two senders instead, the same way\namt_send_advertisement() transmits from the receive path. The query\nnever waits in a qdisc, the tunnel is only dereferenced inside the\nRCU section that found or created it, and nothing is stored in\nskb->cb, so no lookup or refcount is needed. Remove the query branch\nof amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no\nusers left.\n\nBehaviour changes:\n - The relay's own General Queries no longer pass through the amt\n device's egress path: its qdisc, tc egress (clsact/tcx), the\n netfilter egress hook and packet taps. They are still visible as\n UDP on the underlay.\n - A query that is sent successfully is no longer counted as\n tx_dropped. The old query branch left through the unlock label,\n which counted every sent query as dropped.\n - A query that reaches amt_dev_xmit() on a relay from elsewhere,\n such as a userspace querier, is now dropped at the IGMP/MLD type\n switch. Before, it trusted whatever skb->cb held, and a NULL\n tunnel hit the WARN_ON(1)."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - A routable UDP AMT_MSG_REQUEST enters udp_rcv() and amt_rcv(), and amt_request_handler() uses its source tuple, nonce, and p bit in the patched amt_send_igmp_gq()/amt_send_mld_gq(); the resulting query later dequeues into patched amt_dev_xmit().\nAC:H - The remote attacker can send the Request and let the tunnel expire, but cannot arrange the required relay-local queue retention: the demonstrated trigger uses igmp_qrv=1 for a 135-second amt_gmi() and a 180-second netem delay. Success therefore depends on target state outside remote control.\nPR:N - The relay branch of amt_rcv() dispatches AMT_MSG_REQUEST directly to amt_request_handler(), which checks only length and reserved/version bits before creating a tunnel; it requires no Discovery state, nonce/MAC validation, credentials, or capability.\nUI:N - Once the relay and delaying qdisc exist, the attacker only sends a Request; amt_request_handler() schedules gc_wq, and amt_tunnel_expire() plus netem dequeue run without victim action.\nS:U - The freed amt_tunnel_list and the accesses from amt_dev_xmit()/amt_send_membership_query() remain within the relay host's kernel; no VM, IOMMU, or other authority boundary is crossed.\nC:H - amt_send_membership_query() reads freed tunnel->ip4, source_port, nonce, and mac, and emits the nonce and MAC in an outbound AMT Membership Query; reclaiming the slab makes this a kernel UAF disclosure primitive.\nI:H - After transmission, amt_update_relay_status() executes spin_lock_bh(&tunnel->lock) and writes tunnel->status through the freed or reallocated amt_tunnel_list, enabling kernel heap corruption and potential control-flow hijacking.\nA:H - The delayed dequeue in amt_dev_xmit() produced the reported KASAN slab-use-after-free; its stale routing, lock, and status accesses can oops, panic, or hang the kernel, and new Requests can trigger it again after tunnel expiry."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/amt.c", "include/net/amt.h"], "versions": [{"version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "423a46053788ec4a021d57e69d66db7f7f550da4", "status": "affected", "versionType": "git"}, {"version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "95114e421196250e3d9662f12df442799477d3c3", "status": "affected", "versionType": "git"}, {"version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "e7183b7d518ce8b3e1f7284f9881d7a87569df14", "status": "affected", "versionType": "git"}, {"version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "181cb48c1e9af6b402567e132f879f89d1c54131", "status": "affected", "versionType": "git"}, {"version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "e7ea63b4195a150604993044ab574d8240f2a399", "status": "affected", "versionType": "git"}, {"version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "afae89de73dd693cfa329580ba0fba63bd3f0a11", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/amt.c", "include/net/amt.h"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/423a46053788ec4a021d57e69d66db7f7f550da4"}, {"url": "https://git.kernel.org/stable/c/95114e421196250e3d9662f12df442799477d3c3"}, {"url": "https://git.kernel.org/stable/c/e7183b7d518ce8b3e1f7284f9881d7a87569df14"}, {"url": "https://git.kernel.org/stable/c/181cb48c1e9af6b402567e132f879f89d1c54131"}, {"url": "https://git.kernel.org/stable/c/e7ea63b4195a150604993044ab574d8240f2a399"}, {"url": "https://git.kernel.org/stable/c/afae89de73dd693cfa329580ba0fba63bd3f0a11"}], "title": "amt: send the relay's General Query directly from the receive path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/amt.c", "include/net/amt.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "423a46053788ec4a021d57e69d66db7f7f550da4", "status": "affected", "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "versionType": "git"}, {"lessThan": "95114e421196250e3d9662f12df442799477d3c3", "status": "affected", "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "versionType": "git"}, {"lessThan": "e7183b7d518ce8b3e1f7284f9881d7a87569df14", "status": "affected", "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "versionType": "git"}, {"lessThan": "181cb48c1e9af6b402567e132f879f89d1c54131", "status": "affected", "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "versionType": "git"}, {"lessThan": "e7ea63b4195a150604993044ab574d8240f2a399", "status": "affected", "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "versionType": "git"}, {"lessThan": "afae89de73dd693cfa329580ba0fba63bd3f0a11", "status": "affected", "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/amt.c", "include/net/amt.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\namt: send the relay's General Query directly from the receive path\n\nAn skb queued in a qdisc can outlive the tunnel it references\nthrough a raw pointer in skb->cb. For example, with igmp_qrv set\nto 1 on the relay a tunnel lives for 135s, so a netem delay of\n180s on the amt device outlives it; when the tunnel expires and is\nfreed, the subsequent dequeue triggers a use-after-free in\namt_dev_xmit().\n\n BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20\n Call Trace:\n amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262]\n dev_hard_start_xmit+0x22f/0x620\n sch_direct_xmit+0x12e/0xac0\n netem_dequeue+0x333/0xc50\n net_tx_action+0x35c/0xa60\n\namt_send_igmp_gq() and amt_send_mld_gq() are only called from\namt_request_handler(), inside the rcu_read_lock_bh() section of\namt_rcv(). amt_request_handler() already has the tunnel the query is\nfor: it found or created it inside that section. Queuing the query with\ndev_queue_xmit() only leads back into amt_dev_xmit(), which strips the\nEthernet header and calls amt_send_membership_query() for that tunnel.\n\nMake that call directly from the two senders instead, the same way\namt_send_advertisement() transmits from the receive path. The query\nnever waits in a qdisc, the tunnel is only dereferenced inside the\nRCU section that found or created it, and nothing is stored in\nskb->cb, so no lookup or refcount is needed. Remove the query branch\nof amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no\nusers left.\n\nBehaviour changes:\n - The relay's own General Queries no longer pass through the amt\n device's egress path: its qdisc, tc egress (clsact/tcx), the\n netfilter egress hook and packet taps. They are still visible as\n UDP on the underlay.\n - A query that is sent successfully is no longer counted as\n tx_dropped. The old query branch left through the unlock label,\n which counted every sent query as dropped.\n - A query that reaches amt_dev_xmit() on a relay from elsewhere,\n such as a userspace querier, is now dropped at the IGMP/MLD type\n switch. Before, it trusted whatever skb->cb held, and a NULL\n tunnel hit the WARN_ON(1)."}], "id": "CVE-2026-98968", "lastModified": "2026-10-30T13:21:33.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-23T13:17:18.310", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/181cb48c1e9af6b402567e132f879f89d1c54131"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/423a46053788ec4a021d57e69d66db7f7f550da4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/95114e421196250e3d9662f12df442799477d3c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/afae89de73dd693cfa329580ba0fba63bd3f0a11"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7183b7d518ce8b3e1f7284f9881d7a87569df14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7ea63b4195a150604993044ab574d8240f2a399"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: amt: send the relay's General Query directly from the receive path", "id": "2559763", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559763"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\namt: send the relay's General Query directly from the receive path\nAn skb queued in a qdisc can outlive the tunnel it references\nthrough a raw pointer in skb->cb. For example, with igmp_qrv set\nto 1 on the relay a tunnel lives for 135s, so a netem delay of\n180s on the amt device outlives it; when the tunnel expires and is\nfreed, the subsequent dequeue triggers a use-after-free in\namt_dev_xmit().\nBUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20\nCall Trace:\namt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262]\ndev_hard_start_xmit+0x22f/0x620\nsch_direct_xmit+0x12e/0xac0\nnetem_dequeue+0x333/0xc50\nnet_tx_action+0x35c/0xa60\namt_send_igmp_gq() and amt_send_mld_gq() are only called from\namt_request_handler(), inside the rcu_read_lock_bh() section of\namt_rcv(). amt_request_handler() already has the tunnel the query is\nfor: it found or created it inside that section. Queuing the query with\ndev_queue_xmit() only leads back into amt_dev_xmit(), which strips the\nEthernet header and calls amt_send_membership_query() for that tunnel.\nMake that call directly from the two senders instead, the same way\namt_send_advertisement() transmits from the receive path. The query\nnever waits in a qdisc, the tunnel is only dereferenced inside the\nRCU section that found or created it, and nothing is stored in\nskb->cb, so no lookup or refcount is needed. Remove the query branch\nof amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no\nusers left.\nBehaviour changes:\n- The relay's own General Queries no longer pass through the amt\ndevice's egress path: its qdisc, tc egress (clsact/tcx), the\nnetfilter egress hook and packet taps. They are still visible as\nUDP on the underlay.\n- A query that is sent successfully is no longer counted as\ntx_dropped. The old query branch left through the unlock label,\nwhich counted every sent query as dropped.\n- A query that reaches amt_dev_xmit() on a relay from elsewhere,\nsuch as a userspace querier, is now dropped at the IGMP/MLD type\nswitch. Before, it trusted whatever skb->cb held, and a NULL\ntunnel hit the WARN_ON(1).", "A flaw was found in the Linux kernel's Automatic Multicast Tunneling (AMT) driver. Network query packets queued for transmission can outlive and reference an AMT tunnel structure after it has expired and been freed. When the delayed packet is subsequently transmitted, the kernel accesses the deallocated memory, resulting in a use-after-free condition. An attacker capable of manipulating network traffic timing could exploit this flaw to cause a Denial of Service (DoS) through a system crash or potentially execute arbitrary code."], "name": "CVE-2026-98968", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98968\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98968\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98968.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,95114e421196250e3d9662f12df442799477d3c3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,e7183b7d518ce8b3e1f7284f9881d7a87569df14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,181cb48c1e9af6b402567e132f879f89d1c54131)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,e7ea63b4195a150604993044ab574d8240f2a399)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,afae89de73dd693cfa329580ba0fba63bd3f0a11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,95114e421196250e3d9662f12df442799477d3c3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,e7183b7d518ce8b3e1f7284f9881d7a87569df14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,181cb48c1e9af6b402567e132f879f89d1c54131)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,e7ea63b4195a150604993044ab574d8240f2a399)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,afae89de73dd693cfa329580ba0fba63bd3f0a11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T17:15:07.225854+00:00", "updated": "2026-10-29T22:45:03.530795+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}