CVE-2026-99039

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99039", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.387Z", "datePublished": "2026-10-23T12:21:57.421Z", "dateUpdated": "2026-10-30T12:41:12.630Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:41:12.630Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: core: wait for request completion before freeing card\n\nIn memstick_alloc_card() and memstick_set_rw_addr(),\nwait_for_completion_timeout() is used to wait for device identification\nand address configuration requests to complete.\n\nThe memstick subsystem does not provide an abort or cancellation\ncallback in struct memstick_host for in-flight requests. If\nwait_for_completion_timeout() expires (for instance, when a USB transfer\nor command retry is delayed), memstick_alloc_card() returns an error and\nfrees the memstick_dev structure via kfree(card).\n\nHowever, the host controller driver (such as rtsx_usb_ms) is still\nrunning the request asynchronously in worker context. When the transfer\neventually finishes, the driver writes into host->req->data, which\npoints to memory inside the already freed card structure. This leads to\na KASAN slab-use-after-free write:\n\n BUG: KASAN: slab-use-after-free in ms_read_bytes+0x8fe/0x990\n Write of size 1 at addr ffff88813c188079 by task kworker/1:5/5239\n Workqueue: events rtsx_usb_ms_handle_req\n Call Trace:\n ms_read_bytes+0x8fe/0x990 drivers/memstick/host/rtsx_usb_ms.c:450\n rtsx_usb_ms_issue_cmd drivers/memstick/host/rtsx_usb_ms.c:477 [inline]\n rtsx_usb_ms_handle_req+0x557/0x1a00 drivers/memstick/host/rtsx_usb_ms.c:531\n process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\n worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560\n kthread+0x373/0x450 kernel/kthread.c:436\n\n Allocated by task 1662:\n memstick_alloc_card drivers/memstick/core/memstick.c:383 [inline]\n memstick_check+0x2c1/0x10d0 drivers/memstick/core/memstick.c:452\n process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\n\n Freed by task 1662:\n kfree+0x20c/0x650 mm/slub.c:6792\n memstick_alloc_card drivers/memstick/core/memstick.c:420 [inline]\n memstick_check+0x72b/0x10d0 drivers/memstick/core/memstick.c:452\n process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\n\nHost controller drivers (rtsx_usb_ms, jmb38x_ms, tifm_ms, r592) already\nimplement their own hardware and bus timeouts, and callers in\nmspro_block and ms_block already rely on wait_for_completion()\nunconditionally.\n\nReplace wait_for_completion_timeout() with wait_for_completion() in\nmemstick_set_rw_addr() and memstick_alloc_card() so that the card\nstructure is never freed while an asynchronous request is in flight."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/memstick/core/memstick.c"], "versions": [{"version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "lessThan": "b90f33ad9179c69658342323382bfed158f88cb9", "status": "affected", "versionType": "git"}, {"version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "lessThan": "1c23da6f148089d59b3d3e9b2e7f1eefa927cab9", "status": "affected", "versionType": "git"}, {"version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "lessThan": "a2f1aa3341f185ca52103dc4908647570b208855", "status": "affected", "versionType": "git"}, {"version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "lessThan": "c3ab92542475d59ae685cbb294e70ca4d0ba38e9", "status": "affected", "versionType": "git"}, {"version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "lessThan": "810580cf60edc75c9891c2de3225e4cda78e4d9f", "status": "affected", "versionType": "git"}, {"version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "lessThan": "f2795c50144d528dabc2cf2fd53c0f0c63a823a1", "status": "affected", "versionType": "git"}, {"version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "lessThan": "3af81770e2011c6ac7bb597a4af2e4f3591f928c", "status": "affected", "versionType": "git"}, {"version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "lessThan": "aa0a37b5024d921e96ac4f8f487c8bfbf1f1a582", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/memstick/core/memstick.c"], "versions": [{"version": "2.6.25", "status": "affected"}, {"version": "0", "lessThan": "2.6.25", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b90f33ad9179c69658342323382bfed158f88cb9"}, {"url": "https://git.kernel.org/stable/c/1c23da6f148089d59b3d3e9b2e7f1eefa927cab9"}, {"url": "https://git.kernel.org/stable/c/a2f1aa3341f185ca52103dc4908647570b208855"}, {"url": "https://git.kernel.org/stable/c/c3ab92542475d59ae685cbb294e70ca4d0ba38e9"}, {"url": "https://git.kernel.org/stable/c/810580cf60edc75c9891c2de3225e4cda78e4d9f"}, {"url": "https://git.kernel.org/stable/c/f2795c50144d528dabc2cf2fd53c0f0c63a823a1"}, {"url": "https://git.kernel.org/stable/c/3af81770e2011c6ac7bb597a4af2e4f3591f928c"}, {"url": "https://git.kernel.org/stable/c/aa0a37b5024d921e96ac4f8f487c8bfbf1f1a582"}], "title": "memstick: core: wait for request completion before freeing card", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/memstick/core/memstick.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b90f33ad9179c69658342323382bfed158f88cb9", "status": "affected", "version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "versionType": "git"}, {"lessThan": "1c23da6f148089d59b3d3e9b2e7f1eefa927cab9", "status": "affected", "version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "versionType": "git"}, {"lessThan": "a2f1aa3341f185ca52103dc4908647570b208855", "status": "affected", "version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "versionType": "git"}, {"lessThan": "c3ab92542475d59ae685cbb294e70ca4d0ba38e9", "status": "affected", "version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "versionType": "git"}, {"lessThan": "810580cf60edc75c9891c2de3225e4cda78e4d9f", "status": "affected", "version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "versionType": "git"}, {"lessThan": "f2795c50144d528dabc2cf2fd53c0f0c63a823a1", "status": "affected", "version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "versionType": "git"}, {"lessThan": "3af81770e2011c6ac7bb597a4af2e4f3591f928c", "status": "affected", "version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "versionType": "git"}, {"lessThan": "aa0a37b5024d921e96ac4f8f487c8bfbf1f1a582", "status": "affected", "version": "baf8532a147d5b76681ce040e2c8f25a3f0e718d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/memstick/core/memstick.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.25"}, {"lessThan": "2.6.25", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemstick: core: wait for request completion before freeing card\n\nIn memstick_alloc_card() and memstick_set_rw_addr(),\nwait_for_completion_timeout() is used to wait for device identification\nand address configuration requests to complete.\n\nThe memstick subsystem does not provide an abort or cancellation\ncallback in struct memstick_host for in-flight requests. If\nwait_for_completion_timeout() expires (for instance, when a USB transfer\nor command retry is delayed), memstick_alloc_card() returns an error and\nfrees the memstick_dev structure via kfree(card).\n\nHowever, the host controller driver (such as rtsx_usb_ms) is still\nrunning the request asynchronously in worker context. When the transfer\neventually finishes, the driver writes into host->req->data, which\npoints to memory inside the already freed card structure. This leads to\na KASAN slab-use-after-free write:\n\n BUG: KASAN: slab-use-after-free in ms_read_bytes+0x8fe/0x990\n Write of size 1 at addr ffff88813c188079 by task kworker/1:5/5239\n Workqueue: events rtsx_usb_ms_handle_req\n Call Trace:\n ms_read_bytes+0x8fe/0x990 drivers/memstick/host/rtsx_usb_ms.c:450\n rtsx_usb_ms_issue_cmd drivers/memstick/host/rtsx_usb_ms.c:477 [inline]\n rtsx_usb_ms_handle_req+0x557/0x1a00 drivers/memstick/host/rtsx_usb_ms.c:531\n process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\n worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560\n kthread+0x373/0x450 kernel/kthread.c:436\n\n Allocated by task 1662:\n memstick_alloc_card drivers/memstick/core/memstick.c:383 [inline]\n memstick_check+0x2c1/0x10d0 drivers/memstick/core/memstick.c:452\n process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\n\n Freed by task 1662:\n kfree+0x20c/0x650 mm/slub.c:6792\n memstick_alloc_card drivers/memstick/core/memstick.c:420 [inline]\n memstick_check+0x72b/0x10d0 drivers/memstick/core/memstick.c:452\n process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\n\nHost controller drivers (rtsx_usb_ms, jmb38x_ms, tifm_ms, r592) already\nimplement their own hardware and bus timeouts, and callers in\nmspro_block and ms_block already rely on wait_for_completion()\nunconditionally.\n\nReplace wait_for_completion_timeout() with wait_for_completion() in\nmemstick_set_rw_addr() and memstick_alloc_card() so that the card\nstructure is never freed while an asynchronous request is in flight."}], "id": "CVE-2026-99039", "lastModified": "2026-10-30T13:21:41.050", "metrics": {}, "published": "2026-10-23T13:17:27.223", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c23da6f148089d59b3d3e9b2e7f1eefa927cab9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3af81770e2011c6ac7bb597a4af2e4f3591f928c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/810580cf60edc75c9891c2de3225e4cda78e4d9f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a2f1aa3341f185ca52103dc4908647570b208855"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aa0a37b5024d921e96ac4f8f487c8bfbf1f1a582"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b90f33ad9179c69658342323382bfed158f88cb9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c3ab92542475d59ae685cbb294e70ca4d0ba38e9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f2795c50144d528dabc2cf2fd53c0f0c63a823a1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: memstick: core: wait for request completion before freeing card", "id": "2559785", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559785"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmemstick: core: wait for request completion before freeing card\nIn memstick_alloc_card() and memstick_set_rw_addr(),\nwait_for_completion_timeout() is used to wait for device identification\nand address configuration requests to complete.\nThe memstick subsystem does not provide an abort or cancellation\ncallback in struct memstick_host for in-flight requests. If\nwait_for_completion_timeout() expires (for instance, when a USB transfer\nor command retry is delayed), memstick_alloc_card() returns an error and\nfrees the memstick_dev structure via kfree(card).\nHowever, the host controller driver (such as rtsx_usb_ms) is still\nrunning the request asynchronously in worker context. When the transfer\neventually finishes, the driver writes into host->req->data, which\npoints to memory inside the already freed card structure. This leads to\na KASAN slab-use-after-free write:\nBUG: KASAN: slab-use-after-free in ms_read_bytes+0x8fe/0x990\nWrite of size 1 at addr ffff88813c188079 by task kworker/1:5/5239\nWorkqueue: events rtsx_usb_ms_handle_req\nCall Trace:\nms_read_bytes+0x8fe/0x990 drivers/memstick/host/rtsx_usb_ms.c:450\nrtsx_usb_ms_issue_cmd drivers/memstick/host/rtsx_usb_ms.c:477 [inline]\nrtsx_usb_ms_handle_req+0x557/0x1a00 drivers/memstick/host/rtsx_usb_ms.c:531\nprocess_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\nworker_thread+0x5ef/0xe50 kernel/workqueue.c:3560\nkthread+0x373/0x450 kernel/kthread.c:436\nAllocated by task 1662:\nmemstick_alloc_card drivers/memstick/core/memstick.c:383 [inline]\nmemstick_check+0x2c1/0x10d0 drivers/memstick/core/memstick.c:452\nprocess_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\nFreed by task 1662:\nkfree+0x20c/0x650 mm/slub.c:6792\nmemstick_alloc_card drivers/memstick/core/memstick.c:420 [inline]\nmemstick_check+0x72b/0x10d0 drivers/memstick/core/memstick.c:452\nprocess_one_work+0xac7/0x1b10 kernel/workqueue.c:3396\nHost controller drivers (rtsx_usb_ms, jmb38x_ms, tifm_ms, r592) already\nimplement their own hardware and bus timeouts, and callers in\nmspro_block and ms_block already rely on wait_for_completion()\nunconditionally.\nReplace wait_for_completion_timeout() with wait_for_completion() in\nmemstick_set_rw_addr() and memstick_alloc_card() so that the card\nstructure is never freed while an asynchronous request is in flight.", "A flaw was found in the Linux kernel's memstick subsystem. This vulnerability allows a local user or physically proximate attacker to cause a Denial of Service (DoS) or kernel memory corruption. When device initialization or configuration requests experience a timeout, the kernel prematurely frees the memory structure associated with the card while asynchronous hardware operations remain active. When the delayed operation completes, the host controller driver writes into the released memory, triggering a use-after-free condition that leads to a system crash."], "name": "CVE-2026-99039", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99039\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99039\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99039.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baf8532a147d5b76681ce040e2c8f25a3f0e718d,c3ab92542475d59ae685cbb294e70ca4d0ba38e9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baf8532a147d5b76681ce040e2c8f25a3f0e718d,810580cf60edc75c9891c2de3225e4cda78e4d9f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baf8532a147d5b76681ce040e2c8f25a3f0e718d,f2795c50144d528dabc2cf2fd53c0f0c63a823a1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baf8532a147d5b76681ce040e2c8f25a3f0e718d,3af81770e2011c6ac7bb597a4af2e4f3591f928c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baf8532a147d5b76681ce040e2c8f25a3f0e718d,aa0a37b5024d921e96ac4f8f487c8bfbf1f1a582)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.25"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.25)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baf8532a147d5b76681ce040e2c8f25a3f0e718d,c3ab92542475d59ae685cbb294e70ca4d0ba38e9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baf8532a147d5b76681ce040e2c8f25a3f0e718d,810580cf60edc75c9891c2de3225e4cda78e4d9f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baf8532a147d5b76681ce040e2c8f25a3f0e718d,f2795c50144d528dabc2cf2fd53c0f0c63a823a1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baf8532a147d5b76681ce040e2c8f25a3f0e718d,3af81770e2011c6ac7bb597a4af2e4f3591f928c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baf8532a147d5b76681ce040e2c8f25a3f0e718d,aa0a37b5024d921e96ac4f8f487c8bfbf1f1a582)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.25"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.25)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:15:14.432302+00:00", "updated": "2026-10-29T22:15:04.244782+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}