CVE-2026-99081

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99081", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.390Z", "datePublished": "2026-10-23T12:23:28.347Z", "dateUpdated": "2026-10-30T12:41:36.421Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:41:36.421Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n [fault reason 0x06] PTE Read access is not set\n bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n ...\n NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a DMA read buffer overrun.\n\nIn bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),\nsuch as 42-byte untagged ARP frames, are padded:\n\n if (length < BNXT_MIN_PKT_SIZE) {\n pad = BNXT_MIN_PKT_SIZE - length;\n if (skb_pad(skb, pad))\n goto tx_kick_pending;\n length = BNXT_MIN_PKT_SIZE;\n }\n\n mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);\n ...\n dma_unmap_len_set(tx_buf, len, len);\n\nHowever, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)\nand is left unadjusted after padding. Consequently, dma_map_single() and\ndma_unmap_len_set() map and track only 42 bytes.\n\nLater, the hardware TX buffer descriptor is programmed with the padded length:\n\n txbd->tx_bd_len_flags_type =\n cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |\n TX_BD_FLAGS_PACKET_END);\n\nThe NIC DMA engine is thus instructed to read 52 bytes from a region where\nonly 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB\npage (within 'pad' bytes of the next page), the hardware DMA read overruns\ninto the unmapped adjacent page, triggering an IOMMU fault.\n\nThis issue was exposed after commit 447cbe95ebb9 (\"vlan: fix skb_under_panic\nand races when toggling HW VLAN offload\") because reserving extra VLAN\nheadroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data\noffsets and potentially causing small frames to land right against page\nboundaries.\n\nFix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in\nbnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled,\nbecause padding might linearize the skb.\nThis ensures skb->len and skb_headlen(skb) reflect the padded size so\nthat dma_map_single() maps the full buffer and the descriptor length is\nconsistent. This also removes the temporary 'pad' variable and masking logic.\n\nThe padding is done after the SW USO branch, otherwise\nbnxt_sw_udp_gso_xmit() would account the padding as UDP payload\nand send it in extra segments.\n\nNote that SW USO segments are still not padded: with IPv4, a segment\ncarrying less than 10 bytes of UDP payload (small gso_size, or a short\nlast segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.\nThis is a separate issue, left for a followup patch."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - A minimal IPv4 ICMP Echo Request follows bnxt_poll\u2192bnxt_rx_pkt\u2192icmp_rcv\u2192icmp_echo; icmp_reply builds a 42-byte reply that reaches the patched bnxt_start_xmit through ip_finish_output2\u2192dev_queue_xmit, including vlan_dev_hard_start_xmit on the reported VLAN setup.\nAC:L - A request burst keeps the TX ring nonempty, bypassing the push fast path and repeatedly exercising the 42-to-52-byte mismatch; repeated skb allocations provide the documented 4-KiB boundary placement without a race, second actor, or hardware failure.\nPR:N - icmp_rcv and icmp_echo process the Echo Request and invoke icmp_reply without socket credentials, capability checks, or authentication, so the remote sender needs no account or privileges.\nUI:N - Receipt of the ICMP Echo Request automatically constructs and transmits the short reply through bnxt_start_xmit; no victim must open a file, run a command, or otherwise act.\nS:U - bnxt_start_xmit misprograms the host NIC's TX DMA length, but the IOMMU rejects the overrun rather than being bypassed; no guest, sandbox, or other security authority is crossed.\nC:N - skb_pad zero-fills the intended ten padding bytes, while the demonstrated access reaches an unmapped IOVA page and faults; the code provides no path that returns host memory to the routed ICMP peer.\nI:N - The erroneous operation is a DMA_TO_DEVICE read of up to ten bytes beyond the mapping; it neither authorizes a NIC write into host memory nor modifies kernel data.\nA:H - The 52-byte descriptor read from a 42-byte mapping causes the documented IOMMU fault and NETDEV WATCHDOG TX-queue timeout; bnxt_tx_timeout then schedules bnxt_reset_task to close and reopen the NIC, and repeated requests can continually disrupt all interface traffic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "versions": [{"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "0f347e00d060dc0bf3b2d0ee041206e54848c233", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "b3fd0177cf18a6ac98d41af80b4040010ea40f4d", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "3a5d8465e73aff3c7d1ec38261dcaaa317367467", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "cf8530a25ae92c4493e2f22981ecb46f0b66f4c8", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "2956aca14dd2977cd08bd2ccafae3beb8b84b268", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "fbd977e513971ccb4f0762a7f59eac500e474f89", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "5213f65a9667d3dd85db2e6df8f2e0516290db34", "status": "affected", "versionType": "git"}, {"version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "lessThan": "a51d233ccd4889aadb71dace863525cc2b00271e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0f347e00d060dc0bf3b2d0ee041206e54848c233"}, {"url": "https://git.kernel.org/stable/c/b3fd0177cf18a6ac98d41af80b4040010ea40f4d"}, {"url": "https://git.kernel.org/stable/c/3a5d8465e73aff3c7d1ec38261dcaaa317367467"}, {"url": "https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8"}, {"url": "https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268"}, {"url": "https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89"}, {"url": "https://git.kernel.org/stable/c/5213f65a9667d3dd85db2e6df8f2e0516290db34"}, {"url": "https://git.kernel.org/stable/c/a51d233ccd4889aadb71dace863525cc2b00271e"}], "title": "bnxt_en: fix DMA mapping length for padded small packets", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0f347e00d060dc0bf3b2d0ee041206e54848c233", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "b3fd0177cf18a6ac98d41af80b4040010ea40f4d", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "3a5d8465e73aff3c7d1ec38261dcaaa317367467", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "cf8530a25ae92c4493e2f22981ecb46f0b66f4c8", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "2956aca14dd2977cd08bd2ccafae3beb8b84b268", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "fbd977e513971ccb4f0762a7f59eac500e474f89", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "5213f65a9667d3dd85db2e6df8f2e0516290db34", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}, {"lessThan": "a51d233ccd4889aadb71dace863525cc2b00271e", "status": "affected", "version": "c0c050c58d840994ba842ad1c338a98e7c12b764", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/broadcom/bnxt/bnxt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n [fault reason 0x06] PTE Read access is not set\n bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n ...\n NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a DMA read buffer overrun.\n\nIn bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),\nsuch as 42-byte untagged ARP frames, are padded:\n\n if (length < BNXT_MIN_PKT_SIZE) {\n pad = BNXT_MIN_PKT_SIZE - length;\n if (skb_pad(skb, pad))\n goto tx_kick_pending;\n length = BNXT_MIN_PKT_SIZE;\n }\n\n mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE);\n ...\n dma_unmap_len_set(tx_buf, len, len);\n\nHowever, 'len' was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)\nand is left unadjusted after padding. Consequently, dma_map_single() and\ndma_unmap_len_set() map and track only 42 bytes.\n\nLater, the hardware TX buffer descriptor is programmed with the padded length:\n\n txbd->tx_bd_len_flags_type =\n cpu_to_le32(((len + pad) << TX_BD_LEN_SHIFT) | flags |\n TX_BD_FLAGS_PACKET_END);\n\nThe NIC DMA engine is thus instructed to read 52 bytes from a region where\nonly 42 bytes were DMA-mapped. If skb->data ends near the boundary of a 4KB\npage (within 'pad' bytes of the next page), the hardware DMA read overruns\ninto the unmapped adjacent page, triggering an IOMMU fault.\n\nThis issue was exposed after commit 447cbe95ebb9 (\"vlan: fix skb_under_panic\nand races when toggling HW VLAN offload\") because reserving extra VLAN\nheadroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb->data\noffsets and potentially causing small frames to land right against page\nboundaries.\n\nFix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in\nbnxt_start_xmit(), before skb_shinfo(skb)->nr_frags is sampled,\nbecause padding might linearize the skb.\nThis ensures skb->len and skb_headlen(skb) reflect the padded size so\nthat dma_map_single() maps the full buffer and the descriptor length is\nconsistent. This also removes the temporary 'pad' variable and masking logic.\n\nThe padding is done after the SW USO branch, otherwise\nbnxt_sw_udp_gso_xmit() would account the padding as UDP payload\nand send it in extra segments.\n\nNote that SW USO segments are still not padded: with IPv4, a segment\ncarrying less than 10 bytes of UDP payload (small gso_size, or a short\nlast segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.\nThis is a separate issue, left for a followup patch."}], "id": "CVE-2026-99081", "lastModified": "2026-10-30T13:21:44.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-23T13:17:32.293", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f347e00d060dc0bf3b2d0ee041206e54848c233"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2956aca14dd2977cd08bd2ccafae3beb8b84b268"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3a5d8465e73aff3c7d1ec38261dcaaa317367467"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5213f65a9667d3dd85db2e6df8f2e0516290db34"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a51d233ccd4889aadb71dace863525cc2b00271e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b3fd0177cf18a6ac98d41af80b4040010ea40f4d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cf8530a25ae92c4493e2f22981ecb46f0b66f4c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fbd977e513971ccb4f0762a7f59eac500e474f89"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bnxt_en: fix DMA mapping length for padded small packets", "id": "2559802", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559802"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's Broadcom NetXtreme-E (bnxt_en) network driver, which can lead to a Denial of Service (DoS). When transmitting small network packets that require padding, the driver fails to update the Direct Memory Access (DMA) mapping length to account for the padded size. As a result, the network controller can read beyond the mapped memory buffer into unmapped memory, triggering an Input-Output Memory Management Unit (IOMMU) fault. An attacker capable of generating or transmitting small network packets across affected interfaces can exploit this vulnerability to trigger transmit queue timeouts and disrupt network connectivity."], "name": "CVE-2026-99081", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99081\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99081\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99081.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,cf8530a25ae92c4493e2f22981ecb46f0b66f4c8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,2956aca14dd2977cd08bd2ccafae3beb8b84b268)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,fbd977e513971ccb4f0762a7f59eac500e474f89)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,5213f65a9667d3dd85db2e6df8f2e0516290db34)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,a51d233ccd4889aadb71dace863525cc2b00271e)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,cf8530a25ae92c4493e2f22981ecb46f0b66f4c8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,2956aca14dd2977cd08bd2ccafae3beb8b84b268)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,fbd977e513971ccb4f0762a7f59eac500e474f89)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,5213f65a9667d3dd85db2e6df8f2e0516290db34)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c0c050c58d840994ba842ad1c338a98e7c12b764,a51d233ccd4889aadb71dace863525cc2b00271e)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.160,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T16:45:17.941992+00:00", "updated": "2026-10-27T10:45:06.386841+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}