CVE-2026-99006

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99006", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.385Z", "datePublished": "2026-10-23T12:20:31.415Z", "dateUpdated": "2026-10-30T12:40:50.256Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:50.256Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Prevent overstepping exec array boundary\n\nIt is possible for eb_relocate_parse_slow() to call kvfree() on\nentries outside the original exec array during following\nscenario inside eb_relocate_parse_slow():\n\n1) eb_copy_relocations() allocates as many as eb->buffer_count\n copies for exec entries;\n2) eb_parse() appends up to two VMAs, right after incrementing\n eb->buffer_count;\n3) cleanup under \"out\" label uses this incremented buffer_count\n to release relocation pointers from exec array via kvfree(),\n not from VMA array.\n\nTo amend this problem, ensure that relocation cleanup uses the\noriginal exec object count, excluding the VMAs appended by the\ncommand parser.\n\n(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - A local process reaches the patched cleanup through ioctl(2) \u2192 drm_ioctl() \u2192 i915_gem_execbuffer2_ioctl() \u2192 i915_gem_do_execbuffer() \u2192 eb_relocate_parse_slow(); the exec and relocation arrays originate in local userspace, not a wire protocol.\nAC:L - On affected parser-enabled i915 hardware, the caller controls its relocs_ptr mapping to force eb_copy_relocations(), then submits a parser-using batch so eb_parse() appends VMAs. Any mapping race and heap grooming are controlled by the same caller and can be retried.\nPR:L - I915_GEM_EXECBUFFER2_WR is registered with DRM_RENDER_ALLOW, and drm_ioctl_permit() imposes no DRM_AUTH, DRM_MASTER, DRM_ROOT_ONLY, or CAP_SYS_ADMIN check; an ordinary user with render-node access can invoke it.\nUI:N - The attacker opens the i915 render node, prepares GEM objects and relocation arrays, and issues the execbuffer ioctl directly; no action by another user is required.\nS:U - The erroneous kvfree() corrupts the host kernel heap from a host userspace client, constituting ordinary local-to-kernel escalation without crossing a VM, IOMMU, or other distinct security authority.\nC:H - After eb_parse() increments buffer_count, eb_relocate_parse_slow() reads an untouched post-array slot as an exec object and passes its stale relocs_ptr to kvfree(); reusing a previously freed relocation-copy pointer produces a heap UAF capable of exposing kernel memory.\nI:H - The attacker-groomable kvfree() can double-free or prematurely free a live allocation referenced through the stale relocs_ptr; reclaiming that object while stale users remain provides heap-corruption and control-flow-hijacking primitives.\nA:H - kvfree() of the out-of-array relocs_ptr can immediately oops in kfree() for an invalid address or corrupt the allocator through a double-free; repeated execbuffer submissions can therefore crash or panic the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c"], "versions": [{"version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "lessThan": "7bed07cb4daa610cd6d92d9e72a575275a99ed54", "status": "affected", "versionType": "git"}, {"version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "lessThan": "cf42a445bd5036c30d57ae65b041b8b17dfef7b0", "status": "affected", "versionType": "git"}, {"version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "lessThan": "859e52356f913806e5c1ee5d2022b7aeda0a784a", "status": "affected", "versionType": "git"}, {"version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "lessThan": "24c04e80c35ff36947366f6deafddb522eea080c", "status": "affected", "versionType": "git"}, {"version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "lessThan": "b1c357131fc467c579f65e9a9d1fdc1a6273ae1d", "status": "affected", "versionType": "git"}, {"version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "lessThan": "152fb5083b9333a1cb8629572f9e0f276a404ba6", "status": "affected", "versionType": "git"}, {"version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "lessThan": "72d5cbb10d4916a3f8ef9da516c5c0634aca8439", "status": "affected", "versionType": "git"}, {"version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "lessThan": "ebe162db655881a38de43301151ff7ac940602b5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7bed07cb4daa610cd6d92d9e72a575275a99ed54"}, {"url": "https://git.kernel.org/stable/c/cf42a445bd5036c30d57ae65b041b8b17dfef7b0"}, {"url": "https://git.kernel.org/stable/c/859e52356f913806e5c1ee5d2022b7aeda0a784a"}, {"url": "https://git.kernel.org/stable/c/24c04e80c35ff36947366f6deafddb522eea080c"}, {"url": "https://git.kernel.org/stable/c/b1c357131fc467c579f65e9a9d1fdc1a6273ae1d"}, {"url": "https://git.kernel.org/stable/c/152fb5083b9333a1cb8629572f9e0f276a404ba6"}, {"url": "https://git.kernel.org/stable/c/72d5cbb10d4916a3f8ef9da516c5c0634aca8439"}, {"url": "https://git.kernel.org/stable/c/ebe162db655881a38de43301151ff7ac940602b5"}], "title": "drm/i915/gem: Prevent overstepping exec array boundary", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7bed07cb4daa610cd6d92d9e72a575275a99ed54", "status": "affected", "version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "versionType": "git"}, {"lessThan": "cf42a445bd5036c30d57ae65b041b8b17dfef7b0", "status": "affected", "version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "versionType": "git"}, {"lessThan": "859e52356f913806e5c1ee5d2022b7aeda0a784a", "status": "affected", "version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "versionType": "git"}, {"lessThan": "24c04e80c35ff36947366f6deafddb522eea080c", "status": "affected", "version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "versionType": "git"}, {"lessThan": "b1c357131fc467c579f65e9a9d1fdc1a6273ae1d", "status": "affected", "version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "versionType": "git"}, {"lessThan": "152fb5083b9333a1cb8629572f9e0f276a404ba6", "status": "affected", "version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "versionType": "git"}, {"lessThan": "72d5cbb10d4916a3f8ef9da516c5c0634aca8439", "status": "affected", "version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "versionType": "git"}, {"lessThan": "ebe162db655881a38de43301151ff7ac940602b5", "status": "affected", "version": "8e4ba491b0ba6fef69270d3c4e48fc517096ef41", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Prevent overstepping exec array boundary\n\nIt is possible for eb_relocate_parse_slow() to call kvfree() on\nentries outside the original exec array during following\nscenario inside eb_relocate_parse_slow():\n\n1) eb_copy_relocations() allocates as many as eb->buffer_count\n copies for exec entries;\n2) eb_parse() appends up to two VMAs, right after incrementing\n eb->buffer_count;\n3) cleanup under \"out\" label uses this incremented buffer_count\n to release relocation pointers from exec array via kvfree(),\n not from VMA array.\n\nTo amend this problem, ensure that relocation cleanup uses the\noriginal exec object count, excluding the VMAs appended by the\ncommand parser.\n\n(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)"}], "id": "CVE-2026-99006", "lastModified": "2026-10-30T13:21:35.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-23T13:17:23.040", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/152fb5083b9333a1cb8629572f9e0f276a404ba6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/24c04e80c35ff36947366f6deafddb522eea080c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/72d5cbb10d4916a3f8ef9da516c5c0634aca8439"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7bed07cb4daa610cd6d92d9e72a575275a99ed54"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/859e52356f913806e5c1ee5d2022b7aeda0a784a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b1c357131fc467c579f65e9a9d1fdc1a6273ae1d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cf42a445bd5036c30d57ae65b041b8b17dfef7b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ebe162db655881a38de43301151ff7ac940602b5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/i915/gem: Prevent overstepping exec array boundary", "id": "2559779", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559779"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/i915/gem: Prevent overstepping exec array boundary\nIt is possible for eb_relocate_parse_slow() to call kvfree() on\nentries outside the original exec array during following\nscenario inside eb_relocate_parse_slow():\n1) eb_copy_relocations() allocates as many as eb->buffer_count\ncopies for exec entries;\n2) eb_parse() appends up to two VMAs, right after incrementing\neb->buffer_count;\n3) cleanup under \"out\" label uses this incremented buffer_count\nto release relocation pointers from exec array via kvfree(),\nnot from VMA array.\nTo amend this problem, ensure that relocation cleanup uses the\noriginal exec object count, excluding the VMAs appended by the\ncommand parser.\n(cherry picked from commit 2a0158925fb943c7ba8f3216e2734952128defc9)", "A flaw was found in the Linux kernel's Intel i915 graphics driver. A local user could exploit this vulnerability to cause a Denial of Service (DoS) or potentially gain elevated privileges. By submitting a crafted graphics execution request that triggers an error path during relocation handling, an attacker causes the driver to free memory beyond the allocated array boundaries. This improper memory release results in kernel memory corruption and a system crash."], "name": "CVE-2026-99006", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99006\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99006\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99006.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8e4ba491b0ba6fef69270d3c4e48fc517096ef41,24c04e80c35ff36947366f6deafddb522eea080c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8e4ba491b0ba6fef69270d3c4e48fc517096ef41,b1c357131fc467c579f65e9a9d1fdc1a6273ae1d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8e4ba491b0ba6fef69270d3c4e48fc517096ef41,152fb5083b9333a1cb8629572f9e0f276a404ba6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8e4ba491b0ba6fef69270d3c4e48fc517096ef41,72d5cbb10d4916a3f8ef9da516c5c0634aca8439)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8e4ba491b0ba6fef69270d3c4e48fc517096ef41,ebe162db655881a38de43301151ff7ac940602b5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8e4ba491b0ba6fef69270d3c4e48fc517096ef41,24c04e80c35ff36947366f6deafddb522eea080c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8e4ba491b0ba6fef69270d3c4e48fc517096ef41,b1c357131fc467c579f65e9a9d1fdc1a6273ae1d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8e4ba491b0ba6fef69270d3c4e48fc517096ef41,152fb5083b9333a1cb8629572f9e0f276a404ba6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8e4ba491b0ba6fef69270d3c4e48fc517096ef41,72d5cbb10d4916a3f8ef9da516c5c0634aca8439)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8e4ba491b0ba6fef69270d3c4e48fc517096ef41,ebe162db655881a38de43301151ff7ac940602b5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:30:14.847833+00:00", "updated": "2026-10-29T14:45:14.609129+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-125"]}