CVE-2026-99156

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99156", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.397Z", "datePublished": "2026-10-28T10:35:10.493Z", "dateUpdated": "2026-10-31T12:44:14.895Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-31T12:44:14.895Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: st: Fix use-after-free race between st_remove() and st_open()\n\nst_remove() drops the probe reference on the scsi_tape with kref_put()\nand only afterwards removes its index from st_index_idr. If that was the\nlast reference, scsi_tape_release() frees the structure while it is\nstill published in the idr.\n\nscsi_tape_get(), called from st_open(), looks up the tape in\nst_index_idr and takes a reference under st_ref_mutex and\nst_index_lock. remove_cdevs() does not wait for opens that are already\npast chrdev_open(), so an open that is blocked on st_ref_mutex while\nst_remove() holds it can take the mutex as soon as st_remove() drops it,\nfind the freed tpnt in the idr and call kref_get() on it:\n\n BUG: KASAN: slab-use-after-free in st_open\n Write of size 4 ...\n st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)\n chrdev_open\n ...\n Freed by task ...:\n kfree\n st_remove (drivers/scsi/st.c:4512)\n\nRemove the index from the idr before dropping the reference, all under\nst_ref_mutex. A concurrent scsi_tape_get() now either runs first and\nholds a valid reference that keeps the tape alive, or runs afterwards\nand finds nothing, so st_open() fails with -ENXIO.\n\nThis restores the ordering st_remove() had before the conversion to\nst_index_idr, where the tape was unpublished from scsi_tapes[] before\nthe final kref_put()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - A local openat() reaches st_open() through chrdev_open(), then scsi_tape_get(); concurrent hot-unplug reaches the patched st_remove() through __scsi_remove_device(), with no network-supplied input.\nAC:L - A tape-device user controlling a hotpluggable TYPE_TAPE device can flood /dev/stN opens while disconnecting it, controlling both st_open() and st_remove() and retrying the race at will.\nPR:L - st_open() and scsi_tape_get() perform no capability check; may_open() applies device-node DAC and device-cgroup policy, so a tape-group user controlling an external tape needs no init-namespace administrative privilege.\nUI:N - The attacker performs both the /dev/stN open flood and device disconnect; no separate victim must open the tape, remove it, or mount attacker-supplied content.\nS:U - The freed scsi_tape object and subsequent corruption remain within the host kernel's SCSI-tape authority, without crossing a VM, IOMMU, or sandbox security boundary.\nC:H - st_remove() leaves a freed kmalloc-1k scsi_tape in st_index_idr; scsi_tape_get() reads its device pointer and st_open() follows buffer and mode pointers from reclaimable storage, enabling kernel-memory disclosure.\nI:H - kref_get() performs a confirmed four-byte write into the freed scsi_tape, and successful reclamation exposes further st_open() writes through in_use, state, and buffer fields, supporting control-flow hijacking.\nA:H - The stale device and buffer pointers are subsequently dereferenced by scsi_device_get() and st_open() buffer handling; the reported UAF proceeds to unrelated corruption, oops/GPF, and kernel panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/st.c"], "versions": [{"version": "6c648d95a6af4a79241a916871df17c84c68ea20", "lessThan": "7d7f9d2ee4b0841f3eba9fa3627044ad329428de", "status": "affected", "versionType": "git"}, {"version": "6c648d95a6af4a79241a916871df17c84c68ea20", "lessThan": "d9517fc39ec3ee13eadefdc17f45300f7d23ed8c", "status": "affected", "versionType": "git"}, {"version": "6c648d95a6af4a79241a916871df17c84c68ea20", "lessThan": "e7a5da4a4820210aa7d7cd8e6eb25aabe9e5b5a7", "status": "affected", "versionType": "git"}, {"version": "6c648d95a6af4a79241a916871df17c84c68ea20", "lessThan": "00ff1128123d4bdfacd28d68fb4b6e6f657a3648", "status": "affected", "versionType": "git"}, {"version": "6c648d95a6af4a79241a916871df17c84c68ea20", "lessThan": "5ef230f734e0d23db007c8405f38b7e226740084", "status": "affected", "versionType": "git"}, {"version": "6c648d95a6af4a79241a916871df17c84c68ea20", "lessThan": "a1647b653549ff29f0422a63eabf329b842f3822", "status": "affected", "versionType": "git"}, {"version": "6c648d95a6af4a79241a916871df17c84c68ea20", "lessThan": "18a0e3733ce38718688e813e5e2d1106bd4830e5", "status": "affected", "versionType": "git"}, {"version": "6c648d95a6af4a79241a916871df17c84c68ea20", "lessThan": "71caf7f84bd62a4bf91cc95abd2de690afb8d15f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/st.c"], "versions": [{"version": "3.7", "status": "affected"}, {"version": "0", "lessThan": "3.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.7", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7d7f9d2ee4b0841f3eba9fa3627044ad329428de"}, {"url": "https://git.kernel.org/stable/c/d9517fc39ec3ee13eadefdc17f45300f7d23ed8c"}, {"url": "https://git.kernel.org/stable/c/e7a5da4a4820210aa7d7cd8e6eb25aabe9e5b5a7"}, {"url": "https://git.kernel.org/stable/c/00ff1128123d4bdfacd28d68fb4b6e6f657a3648"}, {"url": "https://git.kernel.org/stable/c/5ef230f734e0d23db007c8405f38b7e226740084"}, {"url": "https://git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822"}, {"url": "https://git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5"}, {"url": "https://git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f"}], "title": "scsi: st: Fix use-after-free race between st_remove() and st_open()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/scsi/st.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7d7f9d2ee4b0841f3eba9fa3627044ad329428de", "status": "affected", "version": "6c648d95a6af4a79241a916871df17c84c68ea20", "versionType": "git"}, {"lessThan": "d9517fc39ec3ee13eadefdc17f45300f7d23ed8c", "status": "affected", "version": "6c648d95a6af4a79241a916871df17c84c68ea20", "versionType": "git"}, {"lessThan": "e7a5da4a4820210aa7d7cd8e6eb25aabe9e5b5a7", "status": "affected", "version": "6c648d95a6af4a79241a916871df17c84c68ea20", "versionType": "git"}, {"lessThan": "00ff1128123d4bdfacd28d68fb4b6e6f657a3648", "status": "affected", "version": "6c648d95a6af4a79241a916871df17c84c68ea20", "versionType": "git"}, {"lessThan": "5ef230f734e0d23db007c8405f38b7e226740084", "status": "affected", "version": "6c648d95a6af4a79241a916871df17c84c68ea20", "versionType": "git"}, {"lessThan": "a1647b653549ff29f0422a63eabf329b842f3822", "status": "affected", "version": "6c648d95a6af4a79241a916871df17c84c68ea20", "versionType": "git"}, {"lessThan": "18a0e3733ce38718688e813e5e2d1106bd4830e5", "status": "affected", "version": "6c648d95a6af4a79241a916871df17c84c68ea20", "versionType": "git"}, {"lessThan": "71caf7f84bd62a4bf91cc95abd2de690afb8d15f", "status": "affected", "version": "6c648d95a6af4a79241a916871df17c84c68ea20", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/scsi/st.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.7"}, {"lessThan": "3.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: st: Fix use-after-free race between st_remove() and st_open()\n\nst_remove() drops the probe reference on the scsi_tape with kref_put()\nand only afterwards removes its index from st_index_idr. If that was the\nlast reference, scsi_tape_release() frees the structure while it is\nstill published in the idr.\n\nscsi_tape_get(), called from st_open(), looks up the tape in\nst_index_idr and takes a reference under st_ref_mutex and\nst_index_lock. remove_cdevs() does not wait for opens that are already\npast chrdev_open(), so an open that is blocked on st_ref_mutex while\nst_remove() holds it can take the mutex as soon as st_remove() drops it,\nfind the freed tpnt in the idr and call kref_get() on it:\n\n BUG: KASAN: slab-use-after-free in st_open\n Write of size 4 ...\n st_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)\n chrdev_open\n ...\n Freed by task ...:\n kfree\n st_remove (drivers/scsi/st.c:4512)\n\nRemove the index from the idr before dropping the reference, all under\nst_ref_mutex. A concurrent scsi_tape_get() now either runs first and\nholds a valid reference that keeps the tape alive, or runs afterwards\nand finds nothing, so st_open() fails with -ENXIO.\n\nThis restores the ordering st_remove() had before the conversion to\nst_index_idr, where the tape was unpublished from scsi_tapes[] before\nthe final kref_put()."}], "id": "CVE-2026-99156", "lastModified": "2026-10-31T13:17:57.963", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-28T11:17:35.797", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/00ff1128123d4bdfacd28d68fb4b6e6f657a3648"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5ef230f734e0d23db007c8405f38b7e226740084"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7d7f9d2ee4b0841f3eba9fa3627044ad329428de"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d9517fc39ec3ee13eadefdc17f45300f7d23ed8c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e7a5da4a4820210aa7d7cd8e6eb25aabe9e5b5a7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via use-after-free race condition in SCSI tape driver", "id": "2562680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562680"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: st: Fix use-after-free race between st_remove() and st_open()\nst_remove() drops the probe reference on the scsi_tape with kref_put()\nand only afterwards removes its index from st_index_idr. If that was the\nlast reference, scsi_tape_release() frees the structure while it is\nstill published in the idr.\nscsi_tape_get(), called from st_open(), looks up the tape in\nst_index_idr and takes a reference under st_ref_mutex and\nst_index_lock. remove_cdevs() does not wait for opens that are already\npast chrdev_open(), so an open that is blocked on st_ref_mutex while\nst_remove() holds it can take the mutex as soon as st_remove() drops it,\nfind the freed tpnt in the idr and call kref_get() on it:\nBUG: KASAN: slab-use-after-free in st_open\nWrite of size 4 ...\nst_open (drivers/scsi/st.c:254 drivers/scsi/st.c:1291)\nchrdev_open\n...\nFreed by task ...:\nkfree\nst_remove (drivers/scsi/st.c:4512)\nRemove the index from the idr before dropping the reference, all under\nst_ref_mutex. A concurrent scsi_tape_get() now either runs first and\nholds a valid reference that keeps the tape alive, or runs afterwards\nand finds nothing, so st_open() fails with -ENXIO.\nThis restores the ordering st_remove() had before the conversion to\nst_index_idr, where the tape was unpublished from scsi_tapes[] before\nthe final kref_put().", "A flaw was found in the SCSI tape driver in the Linux kernel. A local user can trigger a race condition between device removal and open operations, causing the kernel to access memory after it has been freed. This use-after-free vulnerability primarily results in a Denial of Service (DoS) by causing a system crash, and could potentially allow privilege escalation."], "name": "CVE-2026-99156", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:35:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99156\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99156\nhttps://git.kernel.org/stable/c/18a0e3733ce38718688e813e5e2d1106bd4830e5\nhttps://git.kernel.org/stable/c/71caf7f84bd62a4bf91cc95abd2de690afb8d15f\nhttps://git.kernel.org/stable/c/a1647b653549ff29f0422a63eabf329b842f3822"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires local access, precise timing during device removal, and access permissions to tape device nodes. In standard Red Hat Enterprise Linux deployments, SCSI tape drives are infrequently used, and device nodes are restricted from unprivileged users by default. Consequently, the likelihood of a local attacker triggering this race condition under typical operational conditions is low.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c648d95a6af4a79241a916871df17c84c68ea20,a1647b653549ff29f0422a63eabf329b842f3822)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c648d95a6af4a79241a916871df17c84c68ea20,18a0e3733ce38718688e813e5e2d1106bd4830e5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c648d95a6af4a79241a916871df17c84c68ea20,71caf7f84bd62a4bf91cc95abd2de690afb8d15f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.7,3.7]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c648d95a6af4a79241a916871df17c84c68ea20,a1647b653549ff29f0422a63eabf329b842f3822)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c648d95a6af4a79241a916871df17c84c68ea20,18a0e3733ce38718688e813e5e2d1106bd4830e5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6c648d95a6af4a79241a916871df17c84c68ea20,71caf7f84bd62a4bf91cc95abd2de690afb8d15f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.7,3.7]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:45:16.180734+00:00", "updated": "2026-11-02T05:45:17.225995+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}