CVE-2026-99117

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99117", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.392Z", "datePublished": "2026-10-28T10:34:33.874Z", "dateUpdated": "2026-10-31T12:43:18.238Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-31T12:43:18.238Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mcast: don't truncate the port group walk on teardown\n\n__br_multicast_disable_port_ctx() and br_multicast_del_port() walk\nport->mglist with hlist_for_each_entry_safe(). However,\nbr_multicast_find_del_pg() can also delete other entries from the same\nlist through br_multicast_fwd_src_remove() or __fwd_del_star_excl().\n\nIf such an entry is the iterator's saved next node, hlist_del_init()\nclears its ->next and terminates the walk early. The reproducer triggers\nthis in both teardown walks, leaving port groups in the bridge mdb with\na dangling ->key.port after del_nbp() frees the port:\n\n BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320\n __mdb_fill_info+0x1191/0x1320\n br_mdb_dump+0x594/0xe40\n rtnl_mdb_dump+0x1cf/0x5d0\n\nUse hlist_del_init_rcu() to unlink the group while preserving ->next.\nbr_multicast_del_pg() and the teardown walks run under\nbr->multicast_lock. The GC worker must acquire the same lock before\ndetaching the group for destruction, so the node remains alive while\nthe walk uses the preserved pointer.\n\nPreserving ->next means a walk can now reach a group that an earlier\niteration already deleted as a side effect. That group is off mp->ports,\nso br_multicast_find_del_pg() would fall through its port scan and hit\nthe trailing WARN_ON(1). Skip such groups at the top of that helper: a\nport group is put on port->mglist when it is created and only unlinked\nwhen it is deleted, so hlist_unhashed() identifies exactly this case."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - A local RTM_SETLINK with IFLA_MASTER=0 reaches rtnl_setlink()\u2192do_set_master()\u2192br_del_if()\u2192del_nbp()\u2192br_multicast_del_port()\u2192br_multicast_find_del_pg()\u2192patched br_multicast_del_pg(); IGMPv3 reports can prepare membership state but cannot perform the required port teardown.\nAC:L - By adding several temporary (S,G) entries before corresponding IGMPv3 MODE_IS_INCLUDE reports, the attacker deterministically orders port->mglist so cascading deletion removes each saved next node; detaching the port then triggers both truncated walks without a race or external timing.\nPR:L - rtnetlink_rcv_msg() requires CAP_NET_ADMIN in the socket's network namespace for RTM_NEWMDB and RTM_SETLINK. set_cred_user_ns() grants that capability to an unprivileged caller in a new user and network namespace, so ordinary local access suffices.\nUI:N - The attacker creates the bridge and memberships, injects the IGMPv3 reports, detaches the port, and requests RTM_GETMDB without requiring another user to act.\nS:U - The dangling net_bridge_port pointer and surviving bridge MDB groups remain within the host kernel's security authority; exploitation from a user-created network namespace is ordinary kernel privilege escalation, not a VM, IOMMU, or hypervisor boundary crossing.\nC:H - The surviving port group retains pg->key.port after release_nbp() frees the net_bridge_port; RTM_GETMDB reaches __mdb_fill_info(), which follows reclaimed port->dev and returns derived data, allowing heap reclamation to steer kernel reads through the dangling pointer.\nI:H - When a surviving source expires, br_multicast_group_src_expired() reaches br_multicast_del_pg() through the dangling key.port; br_multicast_port_ngroups_dec() then writes mdb_n_entries through freed or reclaimed port memory, supporting memory corruption and control-flow exploitation.\nA:H - The demonstrated RTM_GETMDB path produces a KASAN slab-use-after-free in __mdb_fill_info(), while surviving source or port-group timers also dereference the freed port; these paths can oops or panic the kernel and are repeatable from the attacker's namespace."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_multicast.c"], "versions": [{"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "lessThan": "be331b23c650de9518f8266b901d8abb9b36af77", "status": "affected", "versionType": "git"}, {"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "lessThan": "ab836d56ff43f2e7927e88c83cd02c47a98a672e", "status": "affected", "versionType": "git"}, {"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "lessThan": "025c25ad73323c7dc5af4ee97fe0a2c0b3c177c8", "status": "affected", "versionType": "git"}, {"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "lessThan": "b0db9f4ff402becff710ab27dbd9f6fe4850b47e", "status": "affected", "versionType": "git"}, {"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "lessThan": "e69d4927dacd6ddaff09777a89efc0d3143d3b0d", "status": "affected", "versionType": "git"}, {"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "lessThan": "8243d587a081e790ad96e80d48eef44d9f7ef005", "status": "affected", "versionType": "git"}, {"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "lessThan": "b45e8c24608c992d1e2cea047eb5bcbfa537f86b", "status": "affected", "versionType": "git"}, {"version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "lessThan": "5a3f7a683aee56e1f15c9d53041f3236767eaae7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_multicast.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/be331b23c650de9518f8266b901d8abb9b36af77"}, {"url": "https://git.kernel.org/stable/c/ab836d56ff43f2e7927e88c83cd02c47a98a672e"}, {"url": "https://git.kernel.org/stable/c/025c25ad73323c7dc5af4ee97fe0a2c0b3c177c8"}, {"url": "https://git.kernel.org/stable/c/b0db9f4ff402becff710ab27dbd9f6fe4850b47e"}, {"url": "https://git.kernel.org/stable/c/e69d4927dacd6ddaff09777a89efc0d3143d3b0d"}, {"url": "https://git.kernel.org/stable/c/8243d587a081e790ad96e80d48eef44d9f7ef005"}, {"url": "https://git.kernel.org/stable/c/b45e8c24608c992d1e2cea047eb5bcbfa537f86b"}, {"url": "https://git.kernel.org/stable/c/5a3f7a683aee56e1f15c9d53041f3236767eaae7"}], "title": "net: bridge: mcast: don't truncate the port group walk on teardown", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bridge/br_multicast.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "be331b23c650de9518f8266b901d8abb9b36af77", "status": "affected", "version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "versionType": "git"}, {"lessThan": "ab836d56ff43f2e7927e88c83cd02c47a98a672e", "status": "affected", "version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "versionType": "git"}, {"lessThan": "025c25ad73323c7dc5af4ee97fe0a2c0b3c177c8", "status": "affected", "version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "versionType": "git"}, {"lessThan": "b0db9f4ff402becff710ab27dbd9f6fe4850b47e", "status": "affected", "version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "versionType": "git"}, {"lessThan": "e69d4927dacd6ddaff09777a89efc0d3143d3b0d", "status": "affected", "version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "versionType": "git"}, {"lessThan": "8243d587a081e790ad96e80d48eef44d9f7ef005", "status": "affected", "version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "versionType": "git"}, {"lessThan": "b45e8c24608c992d1e2cea047eb5bcbfa537f86b", "status": "affected", "version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "versionType": "git"}, {"lessThan": "5a3f7a683aee56e1f15c9d53041f3236767eaae7", "status": "affected", "version": "b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bridge/br_multicast.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mcast: don't truncate the port group walk on teardown\n\n__br_multicast_disable_port_ctx() and br_multicast_del_port() walk\nport->mglist with hlist_for_each_entry_safe(). However,\nbr_multicast_find_del_pg() can also delete other entries from the same\nlist through br_multicast_fwd_src_remove() or __fwd_del_star_excl().\n\nIf such an entry is the iterator's saved next node, hlist_del_init()\nclears its ->next and terminates the walk early. The reproducer triggers\nthis in both teardown walks, leaving port groups in the bridge mdb with\na dangling ->key.port after del_nbp() frees the port:\n\n BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320\n __mdb_fill_info+0x1191/0x1320\n br_mdb_dump+0x594/0xe40\n rtnl_mdb_dump+0x1cf/0x5d0\n\nUse hlist_del_init_rcu() to unlink the group while preserving ->next.\nbr_multicast_del_pg() and the teardown walks run under\nbr->multicast_lock. The GC worker must acquire the same lock before\ndetaching the group for destruction, so the node remains alive while\nthe walk uses the preserved pointer.\n\nPreserving ->next means a walk can now reach a group that an earlier\niteration already deleted as a side effect. That group is off mp->ports,\nso br_multicast_find_del_pg() would fall through its port scan and hit\nthe trailing WARN_ON(1). Skip such groups at the top of that helper: a\nport group is put on port->mglist when it is created and only unlinked\nwhen it is deleted, so hlist_unhashed() identifies exactly this case."}], "id": "CVE-2026-99117", "lastModified": "2026-10-31T13:17:56.280", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-28T11:17:31.253", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/025c25ad73323c7dc5af4ee97fe0a2c0b3c177c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5a3f7a683aee56e1f15c9d53041f3236767eaae7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8243d587a081e790ad96e80d48eef44d9f7ef005"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ab836d56ff43f2e7927e88c83cd02c47a98a672e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b0db9f4ff402becff710ab27dbd9f6fe4850b47e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b45e8c24608c992d1e2cea047eb5bcbfa537f86b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be331b23c650de9518f8266b901d8abb9b36af77"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e69d4927dacd6ddaff09777a89efc0d3143d3b0d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: bridge: mcast: don't truncate the port group walk on teardown", "id": "2562654", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562654"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: bridge: mcast: don't truncate the port group walk on teardown\n__br_multicast_disable_port_ctx() and br_multicast_del_port() walk\nport->mglist with hlist_for_each_entry_safe(). However,\nbr_multicast_find_del_pg() can also delete other entries from the same\nlist through br_multicast_fwd_src_remove() or __fwd_del_star_excl().\nIf such an entry is the iterator's saved next node, hlist_del_init()\nclears its ->next and terminates the walk early. The reproducer triggers\nthis in both teardown walks, leaving port groups in the bridge mdb with\na dangling ->key.port after del_nbp() frees the port:\nBUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320\n__mdb_fill_info+0x1191/0x1320\nbr_mdb_dump+0x594/0xe40\nrtnl_mdb_dump+0x1cf/0x5d0\nUse hlist_del_init_rcu() to unlink the group while preserving ->next.\nbr_multicast_del_pg() and the teardown walks run under\nbr->multicast_lock. The GC worker must acquire the same lock before\ndetaching the group for destruction, so the node remains alive while\nthe walk uses the preserved pointer.\nPreserving ->next means a walk can now reach a group that an earlier\niteration already deleted as a side effect. That group is off mp->ports,\nso br_multicast_find_del_pg() would fall through its port scan and hit\nthe trailing WARN_ON(1). Skip such groups at the top of that helper: a\nport group is put on port->mglist when it is created and only unlinked\nwhen it is deleted, so hlist_unhashed() identifies exactly this case.", "A flaw was found in the Linux kernel's network bridge multicast subsystem. During network bridge port removal, the cleanup process can terminate prematurely, leaving behind orphaned records pointing to deallocated memory. A local attacker with network administration privileges can trigger this flaw to cause a use-after-free condition, where the operating system attempts to access memory that has already been released. This flaw primarily leads to a system crash resulting in a Denial of Service (DoS), and could potentially enable memory corruption or privilege escalation."], "name": "CVE-2026-99117", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99117\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99117\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99117.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2,8243d587a081e790ad96e80d48eef44d9f7ef005)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2,b45e8c24608c992d1e2cea047eb5bcbfa537f86b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2,5a3f7a683aee56e1f15c9d53041f3236767eaae7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2,8243d587a081e790ad96e80d48eef44d9f7ef005)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2,b45e8c24608c992d1e2cea047eb5bcbfa537f86b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b08123684bd55fa6d6ee4b52d4ae3040fadb5aa2,5a3f7a683aee56e1f15c9d53041f3236767eaae7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:45:16.182354+00:00", "updated": "2026-10-31T13:30:13.674725+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}