CVE-2026-99032

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99032", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.387Z", "datePublished": "2026-10-23T12:21:36.202Z", "dateUpdated": "2026-10-30T12:41:05.122Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:41:05.122Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: protect clcsock lifetime in smc_getname\n\nsmc_getname() dereferences smc->clcsock without holding\nclcsock_release_lock. Link-group termination can release the CLC socket\nthrough smc_close_active_abort() while the SMC socket is still open,\nfor example after shutdown(SHUT_WR).\n\nA getsockname() caller can load smc->clcsock, then the termination worker\ncan clear the pointer and call sock_release() before the caller accesses\nclcsock->ops or invokes getname(). This causes a use-after-free; if the\nworker clears the pointer before the load, it causes a NULL dereference.\nThe syscall's file reference keeps the SMC socket alive but does not\nprevent asynchronous release of its CLC socket.\n\nKASAN reported the following with test-only timing instrumentation:\n\n BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0\n Read of size 8 at addr ffff888109abb4e0 by task poc/103\n Call Trace:\n smc_getname+0x19e/0x1b0\n do_getsockname+0xe5/0x170\n __sys_getsockname+0x8c/0x100\n\n Allocated by task 95:\n sock_alloc_inode+0x1e/0x280\n sock_alloc+0x3d/0x240\n __sock_create+0x7e/0x430\n smc_create+0x121/0x240\n\n Freed by task 0:\n kmem_cache_free+0xcc/0x340\n rcu_core+0x50a/0x1850\n\n Last potentially related work creation:\n evict+0x446/0x6c0\n smc_clcsock_release+0xa8/0xd0\n smc_close_active_abort+0x26a/0x3a0\n __smc_lgr_terminate.part.0+0x137/0x2e0\n\nHold clcsock_release_lock across the pointer check and the getname()\ncallback to serialize with smc_clcsock_release(). Return -EBADF if the\nCLC socket has already been released, preserving the existing peer\nstate check and the callback's return value otherwise."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - getsockname(2) on an attacker-owned SMC fd follows __sys_getsockname()->do_getsockname()->smc_getname(), whose unlocked clcsock dereference is the fault; no SMC/TCP message invokes smc_getname(), so a remote peer alone cannot trigger it.\nAC:L - After shutdown(SHUT_WR) moves the socket to SMC_PEERCLOSEWAIT1, the attacker can loop getsockname() while its SMC peer sends LLC DELETE LINK ALL, driving __smc_lgr_terminate()->smc_close_active_abort()->smc_clcsock_release(); both race sides are attacker-controlled.\nPR:L - smc_create() accepts SOCK_STREAM with SMCPROTO_SMC or SMCPROTO_SMC6 without capable() or ns_capable(), while shutdown() and getsockname() require only the socket fd; an ordinary local user can execute the complete path.\nUI:N - The attacker creates and connects the SMC socket, calls shutdown(SHUT_WR), and races getsockname() against termination without requiring another user to mount, open, or approve anything.\nS:U - smc_getname() and the freed CLC socket execute within the same host kernel security authority; this path crosses no guest-host, IOMMU, or other separately governed boundary.\nC:H - The stale struct socket contains both ops and sk; after sock_inode_cache reuse, the indirect getname callback can consume attacker-groomed recycled socket state and return data to userspace, giving the UAF a kernel-memory disclosure primitive.\nI:H - The freed struct socket supplies the indirect ops->getname target and its sk operand; reclaiming it with attacker-created sockets permits callback/operand confusion and mutable kernel-socket access, supporting control-flow or write-oriented exploitation.\nA:H - If smc_clcsock_release() clears the pointer first, smc_getname() dereferences NULL; if freeing follows the caller's load, KASAN confirms a slab use-after-free. Either path can produce a kernel oops or panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/smc/af_smc.c"], "versions": [{"version": "b03faa1fafc8018295401dc558bdc76362d860a4", "lessThan": "5d0fa089d5ed497366ea5c000c6eefb346c7cb01", "status": "affected", "versionType": "git"}, {"version": "b03faa1fafc8018295401dc558bdc76362d860a4", "lessThan": "94a43efd71ad440c35dd469559d3a6d665f102d9", "status": "affected", "versionType": "git"}, {"version": "b03faa1fafc8018295401dc558bdc76362d860a4", "lessThan": "04069199816285c49199a35971f4298199609687", "status": "affected", "versionType": "git"}, {"version": "b03faa1fafc8018295401dc558bdc76362d860a4", "lessThan": "e607017a553d2a48e428ec8b8ffb06bf3bb92ce9", "status": "affected", "versionType": "git"}, {"version": "b03faa1fafc8018295401dc558bdc76362d860a4", "lessThan": "1512e3714b3946bda75a160a34f22a51710daa43", "status": "affected", "versionType": "git"}, {"version": "b03faa1fafc8018295401dc558bdc76362d860a4", "lessThan": "6a1833f0d7dc037c8e876b9178ba69d5d107c086", "status": "affected", "versionType": "git"}, {"version": "b03faa1fafc8018295401dc558bdc76362d860a4", "lessThan": "c223da71abfaea2ebb1c7208ae9ebf15038f9388", "status": "affected", "versionType": "git"}, {"version": "b03faa1fafc8018295401dc558bdc76362d860a4", "lessThan": "64a6b36b0e1855288080bc5f89769f27d6dc03c8", "status": "affected", "versionType": "git"}, {"version": "0b6153d04c96a1d4b6284692386aa21d04d7956c", "status": "affected", "versionType": "git"}, {"version": "4.19.299", "lessThan": "4.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/smc/af_smc.c"], "versions": [{"version": "5.1", "status": "affected"}, {"version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.299"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5d0fa089d5ed497366ea5c000c6eefb346c7cb01"}, {"url": "https://git.kernel.org/stable/c/94a43efd71ad440c35dd469559d3a6d665f102d9"}, {"url": "https://git.kernel.org/stable/c/04069199816285c49199a35971f4298199609687"}, {"url": "https://git.kernel.org/stable/c/e607017a553d2a48e428ec8b8ffb06bf3bb92ce9"}, {"url": "https://git.kernel.org/stable/c/1512e3714b3946bda75a160a34f22a51710daa43"}, {"url": "https://git.kernel.org/stable/c/6a1833f0d7dc037c8e876b9178ba69d5d107c086"}, {"url": "https://git.kernel.org/stable/c/c223da71abfaea2ebb1c7208ae9ebf15038f9388"}, {"url": "https://git.kernel.org/stable/c/64a6b36b0e1855288080bc5f89769f27d6dc03c8"}], "title": "net/smc: protect clcsock lifetime in smc_getname", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/smc/af_smc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5d0fa089d5ed497366ea5c000c6eefb346c7cb01", "status": "affected", "version": "b03faa1fafc8018295401dc558bdc76362d860a4", "versionType": "git"}, {"lessThan": "94a43efd71ad440c35dd469559d3a6d665f102d9", "status": "affected", "version": "b03faa1fafc8018295401dc558bdc76362d860a4", "versionType": "git"}, {"lessThan": "04069199816285c49199a35971f4298199609687", "status": "affected", "version": "b03faa1fafc8018295401dc558bdc76362d860a4", "versionType": "git"}, {"lessThan": "e607017a553d2a48e428ec8b8ffb06bf3bb92ce9", "status": "affected", "version": "b03faa1fafc8018295401dc558bdc76362d860a4", "versionType": "git"}, {"lessThan": "1512e3714b3946bda75a160a34f22a51710daa43", "status": "affected", "version": "b03faa1fafc8018295401dc558bdc76362d860a4", "versionType": "git"}, {"lessThan": "6a1833f0d7dc037c8e876b9178ba69d5d107c086", "status": "affected", "version": "b03faa1fafc8018295401dc558bdc76362d860a4", "versionType": "git"}, {"lessThan": "c223da71abfaea2ebb1c7208ae9ebf15038f9388", "status": "affected", "version": "b03faa1fafc8018295401dc558bdc76362d860a4", "versionType": "git"}, {"lessThan": "64a6b36b0e1855288080bc5f89769f27d6dc03c8", "status": "affected", "version": "b03faa1fafc8018295401dc558bdc76362d860a4", "versionType": "git"}, {"status": "affected", "version": "0b6153d04c96a1d4b6284692386aa21d04d7956c", "versionType": "git"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.299", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/smc/af_smc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.1"}, {"lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: protect clcsock lifetime in smc_getname\n\nsmc_getname() dereferences smc->clcsock without holding\nclcsock_release_lock. Link-group termination can release the CLC socket\nthrough smc_close_active_abort() while the SMC socket is still open,\nfor example after shutdown(SHUT_WR).\n\nA getsockname() caller can load smc->clcsock, then the termination worker\ncan clear the pointer and call sock_release() before the caller accesses\nclcsock->ops or invokes getname(). This causes a use-after-free; if the\nworker clears the pointer before the load, it causes a NULL dereference.\nThe syscall's file reference keeps the SMC socket alive but does not\nprevent asynchronous release of its CLC socket.\n\nKASAN reported the following with test-only timing instrumentation:\n\n BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0\n Read of size 8 at addr ffff888109abb4e0 by task poc/103\n Call Trace:\n smc_getname+0x19e/0x1b0\n do_getsockname+0xe5/0x170\n __sys_getsockname+0x8c/0x100\n\n Allocated by task 95:\n sock_alloc_inode+0x1e/0x280\n sock_alloc+0x3d/0x240\n __sock_create+0x7e/0x430\n smc_create+0x121/0x240\n\n Freed by task 0:\n kmem_cache_free+0xcc/0x340\n rcu_core+0x50a/0x1850\n\n Last potentially related work creation:\n evict+0x446/0x6c0\n smc_clcsock_release+0xa8/0xd0\n smc_close_active_abort+0x26a/0x3a0\n __smc_lgr_terminate.part.0+0x137/0x2e0\n\nHold clcsock_release_lock across the pointer check and the getname()\ncallback to serialize with smc_clcsock_release(). Return -EBADF if the\nCLC socket has already been released, preserving the existing peer\nstate check and the callback's return value otherwise."}], "id": "CVE-2026-99032", "lastModified": "2026-10-30T13:21:39.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-23T13:17:26.310", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/04069199816285c49199a35971f4298199609687"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1512e3714b3946bda75a160a34f22a51710daa43"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d0fa089d5ed497366ea5c000c6eefb346c7cb01"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/64a6b36b0e1855288080bc5f89769f27d6dc03c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6a1833f0d7dc037c8e876b9178ba69d5d107c086"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/94a43efd71ad440c35dd469559d3a6d665f102d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c223da71abfaea2ebb1c7208ae9ebf15038f9388"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e607017a553d2a48e428ec8b8ffb06bf3bb92ce9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/smc: protect clcsock lifetime in smc_getname", "id": "2559710", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559710"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/smc: protect clcsock lifetime in smc_getname\nsmc_getname() dereferences smc->clcsock without holding\nclcsock_release_lock. Link-group termination can release the CLC socket\nthrough smc_close_active_abort() while the SMC socket is still open,\nfor example after shutdown(SHUT_WR).\nA getsockname() caller can load smc->clcsock, then the termination worker\ncan clear the pointer and call sock_release() before the caller accesses\nclcsock->ops or invokes getname(). This causes a use-after-free; if the\nworker clears the pointer before the load, it causes a NULL dereference.\nThe syscall's file reference keeps the SMC socket alive but does not\nprevent asynchronous release of its CLC socket.\nKASAN reported the following with test-only timing instrumentation:\nBUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0\nRead of size 8 at addr ffff888109abb4e0 by task poc/103\nCall Trace:\nsmc_getname+0x19e/0x1b0\ndo_getsockname+0xe5/0x170\n__sys_getsockname+0x8c/0x100\nAllocated by task 95:\nsock_alloc_inode+0x1e/0x280\nsock_alloc+0x3d/0x240\n__sock_create+0x7e/0x430\nsmc_create+0x121/0x240\nFreed by task 0:\nkmem_cache_free+0xcc/0x340\nrcu_core+0x50a/0x1850\nLast potentially related work creation:\nevict+0x446/0x6c0\nsmc_clcsock_release+0xa8/0xd0\nsmc_close_active_abort+0x26a/0x3a0\n__smc_lgr_terminate.part.0+0x137/0x2e0\nHold clcsock_release_lock across the pointer check and the getname()\ncallback to serialize with smc_clcsock_release(). Return -EBADF if the\nCLC socket has already been released, preserving the existing peer\nstate check and the callback's return value otherwise.", "A flaw was found in the Linux kernel's Shared Memory Communications (SMC) subsystem. A race condition in the smc_getname() function allows an underlying socket to be released while its address information is being retrieved. A local user can exploit this vulnerability to trigger a use-after-free condition, resulting in a Denial of Service (DoS) through a kernel crash or potentially allowing privilege escalation."], "name": "CVE-2026-99032", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99032\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99032\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99032.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b03faa1fafc8018295401dc558bdc76362d860a4,e607017a553d2a48e428ec8b8ffb06bf3bb92ce9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b03faa1fafc8018295401dc558bdc76362d860a4,1512e3714b3946bda75a160a34f22a51710daa43)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b03faa1fafc8018295401dc558bdc76362d860a4,6a1833f0d7dc037c8e876b9178ba69d5d107c086)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b03faa1fafc8018295401dc558bdc76362d860a4,c223da71abfaea2ebb1c7208ae9ebf15038f9388)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b03faa1fafc8018295401dc558bdc76362d860a4,64a6b36b0e1855288080bc5f89769f27d6dc03c8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "0b6153d04c96a1d4b6284692386aa21d04d7956c"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.19.299,4.20)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b03faa1fafc8018295401dc558bdc76362d860a4,e607017a553d2a48e428ec8b8ffb06bf3bb92ce9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b03faa1fafc8018295401dc558bdc76362d860a4,1512e3714b3946bda75a160a34f22a51710daa43)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b03faa1fafc8018295401dc558bdc76362d860a4,6a1833f0d7dc037c8e876b9178ba69d5d107c086)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b03faa1fafc8018295401dc558bdc76362d860a4,c223da71abfaea2ebb1c7208ae9ebf15038f9388)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b03faa1fafc8018295401dc558bdc76362d860a4,64a6b36b0e1855288080bc5f89769f27d6dc03c8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "0b6153d04c96a1d4b6284692386aa21d04d7956c"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.19.299,4.20)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:15:14.432990+00:00", "updated": "2026-10-29T19:15:08.622826+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}