CVE-2026-99053

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99053", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.388Z", "datePublished": "2026-10-23T12:22:35.462Z", "dateUpdated": "2026-10-30T12:41:20.179Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:41:20.179Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: hold a reference to nodes found by link name\n\ntipc_node_find_by_name() returns a node after dropping its RCU read lock\nwithout taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS\nhandlers then lock and access the node, racing with timer-driven cleanup of\na down peer. Generic netlink serialization does not exclude the node\ntimer.\n\nThe following interleaving can leave a handler using a freed node:\n\n CPU 0: find the node under RCU and release the node read lock\n CPU 1: tipc_node_timeout() clears the links and unlinks the down node\n CPU 1: drop the list and timer references, queuing tipc_node_free()\n CPU 0: leave the RCU read-side critical section\n CPU 1: complete the grace period and free the node\n CPU 0: acquire the node lock through the stale pointer\n\nLINK_SET also uses the node's media address after releasing the node lock,\nwhen passing queued packets to tipc_bearer_xmit().\n\nKASAN on v7.3-rc5 reported:\n\n BUG: KASAN: slab-use-after-free in _raw_read_lock_bh\n Write of size 4 at addr ffff88807e06f008 by task poc/92\n Call Trace:\n _raw_read_lock_bh kernel/locking/spinlock.c:287\n tipc_nl_node_set_link net/tipc/node.c:2475\n genl_family_rcv_msg_doit net/netlink/genetlink.c:1114\n genl_rcv_msg net/netlink/genetlink.c:1209\n netlink_rcv_skb net/netlink/af_netlink.c:2575\n\n Allocated by task 0:\n tipc_node_create net/tipc/node.c:539\n tipc_node_check_dest net/tipc/node.c:1196\n tipc_disc_rcv net/tipc/discover.c:252\n\n Freed by task 92:\n kfree mm/slub.c:6801\n rcu_core kernel/rcu/tree.c:2919\n\n Last potentially related work creation:\n __call_rcu_common.constprop.0 kernel/rcu/tree.c:3181\n tipc_node_timeout net/tipc/node.c:814\n\nAcquire a reference to the selected node with kref_get_unless_zero() before\nleaving RCU, returning NULL if the node has already been released. Release\nthat reference on every caller exit after the last node access, including\ntransmission in LINK_SET. Keep the existing link lookup order and locking\nso concurrent link removal still takes the existing error paths."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The attacker-controlled selector is TIPC_NLA_LINK_NAME in a local NETLINK_GENERIC TIPC_NL_LINK_GET request, dispatched to tipc_nl_node_get_link() and patched tipc_node_find_by_name(). Remote packets can create or down the peer but cannot invoke this handler, so one remote actor cannot trigger the UAF.\nAC:L - The same local attacker can create TIPC peers in user/network namespaces, stop one so node_lost_contact() sets delete_at, and flood LINK_GET while tipc_node_timeout() performs cleanup. Both sides of this repeatable race are attacker-controlled, and the submitted PoC reached the KASAN UAF.\nPR:L - TIPC_NL_LINK_GET is registered without an administrative permission flag and reaches tipc_nl_node_get_link() for any local netlink caller. Setup mutators use GENL_UNS_ADMIN_PERM and the family has netnsok=true, allowing an unprivileged user to obtain the necessary namespace-local rights.\nUI:N - The attacker can create and stop its own TIPC peer and issue the racing TIPC_NL_LINK_GET requests without any victim action.\nS:U - The stale pointer from tipc_node_find_by_name() corrupts host-kernel tipc_node and tipc_link slab objects; no VM, IOMMU, or other security-authority boundary is crossed.\nC:H - TIPC_NL_LINK_GET follows a reclaimed node->links[bearer_id].link into __tipc_nl_add_link(), which copies link names, properties, and statistics into the attacker's netlink reply. Heap grooming can therefore turn the stale node into an arbitrary kernel-read primitive.\nI:H - _raw_read_lock_bh() already performs the reported four-byte write to freed node->lock. With a reclaimed links pointer, TIPC_NL_LINK_RESET_STATS reaches tipc_link_reset_stats(), whose memset() provides an attacker-directed kernel write suitable for further corruption or control-flow hijacking.\nA:H - The observed slab use-after-free occurs while tipc_nl_node_set_link() locks the freed node; corrupted lock state or the subsequent stale node/link dereferences can cause a kernel oops or panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/node.c"], "versions": [{"version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "lessThan": "384edc67201f8561b7de952647b923f0524b1f36", "status": "affected", "versionType": "git"}, {"version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "lessThan": "5b7e58e8be90f4e8530e7a60372d003dfa7fd666", "status": "affected", "versionType": "git"}, {"version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "lessThan": "92f3b3368722631e933a4db0cf8bd578ed08cd9c", "status": "affected", "versionType": "git"}, {"version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "lessThan": "b60259d4047fbb735476c729dcf9306a038b6110", "status": "affected", "versionType": "git"}, {"version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "lessThan": "f17e70206a1e763fcca2578a8db3c4eed0f843a9", "status": "affected", "versionType": "git"}, {"version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "lessThan": "1428c5f1d346a2e1ac9156713975a72246957009", "status": "affected", "versionType": "git"}, {"version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "lessThan": "3c3b308ee6e25729a6cf09b69cdd0e093220d40b", "status": "affected", "versionType": "git"}, {"version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "lessThan": "17e73bae400f6a434dc006e3bee92c94cf781954", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/node.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/384edc67201f8561b7de952647b923f0524b1f36"}, {"url": "https://git.kernel.org/stable/c/5b7e58e8be90f4e8530e7a60372d003dfa7fd666"}, {"url": "https://git.kernel.org/stable/c/92f3b3368722631e933a4db0cf8bd578ed08cd9c"}, {"url": "https://git.kernel.org/stable/c/b60259d4047fbb735476c729dcf9306a038b6110"}, {"url": "https://git.kernel.org/stable/c/f17e70206a1e763fcca2578a8db3c4eed0f843a9"}, {"url": "https://git.kernel.org/stable/c/1428c5f1d346a2e1ac9156713975a72246957009"}, {"url": "https://git.kernel.org/stable/c/3c3b308ee6e25729a6cf09b69cdd0e093220d40b"}, {"url": "https://git.kernel.org/stable/c/17e73bae400f6a434dc006e3bee92c94cf781954"}], "title": "tipc: hold a reference to nodes found by link name", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/tipc/node.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "384edc67201f8561b7de952647b923f0524b1f36", "status": "affected", "version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "versionType": "git"}, {"lessThan": "5b7e58e8be90f4e8530e7a60372d003dfa7fd666", "status": "affected", "version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "versionType": "git"}, {"lessThan": "92f3b3368722631e933a4db0cf8bd578ed08cd9c", "status": "affected", "version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "versionType": "git"}, {"lessThan": "b60259d4047fbb735476c729dcf9306a038b6110", "status": "affected", "version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "versionType": "git"}, {"lessThan": "f17e70206a1e763fcca2578a8db3c4eed0f843a9", "status": "affected", "version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "versionType": "git"}, {"lessThan": "1428c5f1d346a2e1ac9156713975a72246957009", "status": "affected", "version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "versionType": "git"}, {"lessThan": "3c3b308ee6e25729a6cf09b69cdd0e093220d40b", "status": "affected", "version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "versionType": "git"}, {"lessThan": "17e73bae400f6a434dc006e3bee92c94cf781954", "status": "affected", "version": "6a939f365bdb03a74b4617bdb4402fc08da088b9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/tipc/node.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: hold a reference to nodes found by link name\n\ntipc_node_find_by_name() returns a node after dropping its RCU read lock\nwithout taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS\nhandlers then lock and access the node, racing with timer-driven cleanup of\na down peer. Generic netlink serialization does not exclude the node\ntimer.\n\nThe following interleaving can leave a handler using a freed node:\n\n CPU 0: find the node under RCU and release the node read lock\n CPU 1: tipc_node_timeout() clears the links and unlinks the down node\n CPU 1: drop the list and timer references, queuing tipc_node_free()\n CPU 0: leave the RCU read-side critical section\n CPU 1: complete the grace period and free the node\n CPU 0: acquire the node lock through the stale pointer\n\nLINK_SET also uses the node's media address after releasing the node lock,\nwhen passing queued packets to tipc_bearer_xmit().\n\nKASAN on v7.3-rc5 reported:\n\n BUG: KASAN: slab-use-after-free in _raw_read_lock_bh\n Write of size 4 at addr ffff88807e06f008 by task poc/92\n Call Trace:\n _raw_read_lock_bh kernel/locking/spinlock.c:287\n tipc_nl_node_set_link net/tipc/node.c:2475\n genl_family_rcv_msg_doit net/netlink/genetlink.c:1114\n genl_rcv_msg net/netlink/genetlink.c:1209\n netlink_rcv_skb net/netlink/af_netlink.c:2575\n\n Allocated by task 0:\n tipc_node_create net/tipc/node.c:539\n tipc_node_check_dest net/tipc/node.c:1196\n tipc_disc_rcv net/tipc/discover.c:252\n\n Freed by task 92:\n kfree mm/slub.c:6801\n rcu_core kernel/rcu/tree.c:2919\n\n Last potentially related work creation:\n __call_rcu_common.constprop.0 kernel/rcu/tree.c:3181\n tipc_node_timeout net/tipc/node.c:814\n\nAcquire a reference to the selected node with kref_get_unless_zero() before\nleaving RCU, returning NULL if the node has already been released. Release\nthat reference on every caller exit after the last node access, including\ntransmission in LINK_SET. Keep the existing link lookup order and locking\nso concurrent link removal still takes the existing error paths."}], "id": "CVE-2026-99053", "lastModified": "2026-10-30T13:21:41.943", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-23T13:17:28.877", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1428c5f1d346a2e1ac9156713975a72246957009"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/17e73bae400f6a434dc006e3bee92c94cf781954"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/384edc67201f8561b7de952647b923f0524b1f36"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c3b308ee6e25729a6cf09b69cdd0e093220d40b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b7e58e8be90f4e8530e7a60372d003dfa7fd666"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/92f3b3368722631e933a4db0cf8bd578ed08cd9c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b60259d4047fbb735476c729dcf9306a038b6110"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f17e70206a1e763fcca2578a8db3c4eed0f843a9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: tipc: hold a reference to nodes found by link name", "id": "2559697", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559697"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntipc: hold a reference to nodes found by link name\ntipc_node_find_by_name() returns a node after dropping its RCU read lock\nwithout taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS\nhandlers then lock and access the node, racing with timer-driven cleanup of\na down peer. Generic netlink serialization does not exclude the node\ntimer.\nThe following interleaving can leave a handler using a freed node:\nCPU 0: find the node under RCU and release the node read lock\nCPU 1: tipc_node_timeout() clears the links and unlinks the down node\nCPU 1: drop the list and timer references, queuing tipc_node_free()\nCPU 0: leave the RCU read-side critical section\nCPU 1: complete the grace period and free the node\nCPU 0: acquire the node lock through the stale pointer\nLINK_SET also uses the node's media address after releasing the node lock,\nwhen passing queued packets to tipc_bearer_xmit().\nKASAN on v7.3-rc5 reported:\nBUG: KASAN: slab-use-after-free in _raw_read_lock_bh\nWrite of size 4 at addr ffff88807e06f008 by task poc/92\nCall Trace:\n_raw_read_lock_bh kernel/locking/spinlock.c:287\ntipc_nl_node_set_link net/tipc/node.c:2475\ngenl_family_rcv_msg_doit net/netlink/genetlink.c:1114\ngenl_rcv_msg net/netlink/genetlink.c:1209\nnetlink_rcv_skb net/netlink/af_netlink.c:2575\nAllocated by task 0:\ntipc_node_create net/tipc/node.c:539\ntipc_node_check_dest net/tipc/node.c:1196\ntipc_disc_rcv net/tipc/discover.c:252\nFreed by task 92:\nkfree mm/slub.c:6801\nrcu_core kernel/rcu/tree.c:2919\nLast potentially related work creation:\n__call_rcu_common.constprop.0 kernel/rcu/tree.c:3181\ntipc_node_timeout net/tipc/node.c:814\nAcquire a reference to the selected node with kref_get_unless_zero() before\nleaving RCU, returning NULL if the node has already been released. Release\nthat reference on every caller exit after the last node access, including\ntransmission in LINK_SET. Keep the existing link lookup order and locking\nso concurrent link removal still takes the existing error paths.", "A flaw was found in the Linux kernel's Transparent Inter-Process Communication (TIPC) subsystem. This flaw allows a local user to cause a denial of service (DoS) or potentially escalate privileges on the system. The issue occurs because link configuration handlers release read locks without properly incrementing the node reference counter during node lookups. Consequently, a race condition with background cleanup routines can lead to a use-after-free condition when accessing stale node pointers."], "name": "CVE-2026-99053", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99053\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99053\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99053.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a939f365bdb03a74b4617bdb4402fc08da088b9,b60259d4047fbb735476c729dcf9306a038b6110)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a939f365bdb03a74b4617bdb4402fc08da088b9,f17e70206a1e763fcca2578a8db3c4eed0f843a9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a939f365bdb03a74b4617bdb4402fc08da088b9,1428c5f1d346a2e1ac9156713975a72246957009)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a939f365bdb03a74b4617bdb4402fc08da088b9,3c3b308ee6e25729a6cf09b69cdd0e093220d40b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a939f365bdb03a74b4617bdb4402fc08da088b9,17e73bae400f6a434dc006e3bee92c94cf781954)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a939f365bdb03a74b4617bdb4402fc08da088b9,b60259d4047fbb735476c729dcf9306a038b6110)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a939f365bdb03a74b4617bdb4402fc08da088b9,f17e70206a1e763fcca2578a8db3c4eed0f843a9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a939f365bdb03a74b4617bdb4402fc08da088b9,1428c5f1d346a2e1ac9156713975a72246957009)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a939f365bdb03a74b4617bdb4402fc08da088b9,3c3b308ee6e25729a6cf09b69cdd0e093220d40b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6a939f365bdb03a74b4617bdb4402fc08da088b9,17e73bae400f6a434dc006e3bee92c94cf781954)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T22:30:14.342806+00:00", "updated": "2026-10-27T22:30:10.515352+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}