CVE-2026-99163

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99163", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.398Z", "datePublished": "2026-10-28T10:35:15.577Z", "dateUpdated": "2026-10-31T12:44:20.055Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-31T12:44:20.055Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields\n\nIn check_synth_field(), when a synthetic event field is a stacktrace\n(field->is_stack) and the histogram field is not a \"long[\" stacktrace\narray, validation falls through to the generic size and signedness\ncomparison.\n\nBecause parse_synth_field() sets a stacktrace field's type to\n\"__data_loc unsigned long[]\", its size is sizeof(u64) and\nsynth_field_signed() marks it as signed. Consequently, any 8-byte\nsigned scalar histogram field passes the fallback check, and its scalar\nvalue is subsequently dereferenced as a kernel stacktrace pointer in\nget_field_size() and trace_stack().\n\nFurthermore, checking strstr(hist_field->type, \"long[\") is insufficient\nbecause tracepoint fields defined with __bitmask() or __rel_bitmask()\nalso have type \"__data_loc unsigned long[]\" or \"__rel_loc unsigned\nlong[]\", whilst create_hist_field() treats them as 4-byte scalar values\nwithout HIST_FIELD_FL_STACKTRACE.\n\nPropagate HIST_FIELD_FL_STACKTRACE to variable references and field\nvariables (whilst excluding variable aliases from per-element\nstacktrace capture), and reject any mismatch between\nHIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Local writes to tracefs synthetic_events and events/.../trigger supply the bad field/action; event_trigger_write() \u2192 event_hist_trigger_parse() \u2192 create_actions() \u2192 the patched check_synth_field(). No network or physical input reaches it.\nAC:L - The attacker can deterministically create the stack field, map an 8-byte signed scalar or expression to it, enable the synthetic event, and issue their own triggering syscall; no race or uncontrollable state is required.\nPR:L - Although these files are mode 0640, tracefs_parse_param() accepts uid= and tracefs_apply_options() propagates that owner to synthetic_events and eventfs trigger files, allowing a delegated non-root tracing account to write both; user namespaces alone cannot mount tracefs.\nUI:N - The attacker performs every required tracefs write and triggers the configured histogram through their own syscall or selected tracepoint, without another user's action.\nS:U - The invalid pointer dereference and ring-buffer overwrite occur entirely within the host kernel's tracing subsystem and do not cross a VM, IOMMU, or separate security authority.\nC:H - An 8-byte signed histogram expression can hold a chosen address; get_field_size() dereferences it and trace_stack() copies up to 16 machine words into a synthetic-event record readable from the trace buffer, permitting repeatable kernel-memory disclosure.\nI:H - get_field_size() sizes the record from the pointer's first word, while trace_stack() independently scans up to 16 nonzero words before memcpy(); a mismatched count therefore writes past the reserved ring-buffer record.\nA:H - Mapping raw_syscalls:sys_enter.id directly to the stack field makes get_field_size() dereference a small invalid address on the attacker's next syscall, producing a deterministic, repeatable kernel oops."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_events_hist.c"], "versions": [{"version": "b9453380c1c542fd095a4dbe9251eeba4022bbce", "lessThan": "eba0a6365a0f38f7598a02fc7f9ee341c7efe7f5", "status": "affected", "versionType": "git"}, {"version": "5f52389bdd9eafb63b3a2f804e02aeb17b6a5f55", "lessThan": "326c45c9e201e3ff4c9e9e0e14c2c91364d6c8be", "status": "affected", "versionType": "git"}, {"version": "f3baa42afeea0d5f04ad31525e861199d02210cc", "lessThan": "6c4e4946febb585d2fc93a02a0cd12cec715bb32", "status": "affected", "versionType": "git"}, {"version": "00cf3d672a9dd409418647e9f98784c339c3ff63", "lessThan": "7e0d05a6234a984ac23b8a563fb7f66f2572b668", "status": "affected", "versionType": "git"}, {"version": "00cf3d672a9dd409418647e9f98784c339c3ff63", "lessThan": "648687f2b448d8527cd7b112fe5d4bd0fec85a87", "status": "affected", "versionType": "git"}, {"version": "00cf3d672a9dd409418647e9f98784c339c3ff63", "lessThan": "1f36e4ddd05d540f363dbaa4c23042549f15b3ef", "status": "affected", "versionType": "git"}, {"version": "00cf3d672a9dd409418647e9f98784c339c3ff63", "lessThan": "deb336ae7c7b341591a6862cf6fcfeca97c77dfd", "status": "affected", "versionType": "git"}, {"version": "00cf3d672a9dd409418647e9f98784c339c3ff63", "lessThan": "a244c241593b5b38a08f0df2cb43c26574efbdcb", "status": "affected", "versionType": "git"}, {"version": "5.10.237", "lessThan": "5.10.273", "status": "affected", "versionType": "semver"}, {"version": "5.15.124", "lessThan": "5.15.224", "status": "affected", "versionType": "semver"}, {"version": "6.1.43", "lessThan": "6.1.191", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/trace_events_hist.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.237", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.124", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.43", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/eba0a6365a0f38f7598a02fc7f9ee341c7efe7f5"}, {"url": "https://git.kernel.org/stable/c/326c45c9e201e3ff4c9e9e0e14c2c91364d6c8be"}, {"url": "https://git.kernel.org/stable/c/6c4e4946febb585d2fc93a02a0cd12cec715bb32"}, {"url": "https://git.kernel.org/stable/c/7e0d05a6234a984ac23b8a563fb7f66f2572b668"}, {"url": "https://git.kernel.org/stable/c/648687f2b448d8527cd7b112fe5d4bd0fec85a87"}, {"url": "https://git.kernel.org/stable/c/1f36e4ddd05d540f363dbaa4c23042549f15b3ef"}, {"url": "https://git.kernel.org/stable/c/deb336ae7c7b341591a6862cf6fcfeca97c77dfd"}, {"url": "https://git.kernel.org/stable/c/a244c241593b5b38a08f0df2cb43c26574efbdcb"}], "title": "tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/trace_events_hist.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "eba0a6365a0f38f7598a02fc7f9ee341c7efe7f5", "status": "affected", "version": "b9453380c1c542fd095a4dbe9251eeba4022bbce", "versionType": "git"}, {"lessThan": "326c45c9e201e3ff4c9e9e0e14c2c91364d6c8be", "status": "affected", "version": "5f52389bdd9eafb63b3a2f804e02aeb17b6a5f55", "versionType": "git"}, {"lessThan": "6c4e4946febb585d2fc93a02a0cd12cec715bb32", "status": "affected", "version": "f3baa42afeea0d5f04ad31525e861199d02210cc", "versionType": "git"}, {"lessThan": "7e0d05a6234a984ac23b8a563fb7f66f2572b668", "status": "affected", "version": "00cf3d672a9dd409418647e9f98784c339c3ff63", "versionType": "git"}, {"lessThan": "648687f2b448d8527cd7b112fe5d4bd0fec85a87", "status": "affected", "version": "00cf3d672a9dd409418647e9f98784c339c3ff63", "versionType": "git"}, {"lessThan": "1f36e4ddd05d540f363dbaa4c23042549f15b3ef", "status": "affected", "version": "00cf3d672a9dd409418647e9f98784c339c3ff63", "versionType": "git"}, {"lessThan": "deb336ae7c7b341591a6862cf6fcfeca97c77dfd", "status": "affected", "version": "00cf3d672a9dd409418647e9f98784c339c3ff63", "versionType": "git"}, {"lessThan": "a244c241593b5b38a08f0df2cb43c26574efbdcb", "status": "affected", "version": "00cf3d672a9dd409418647e9f98784c339c3ff63", "versionType": "git"}, {"lessThan": "5.10.273", "status": "affected", "version": "5.10.237", "versionType": "semver"}, {"lessThan": "5.15.224", "status": "affected", "version": "5.15.124", "versionType": "semver"}, {"lessThan": "6.1.191", "status": "affected", "version": "6.1.43", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/trace_events_hist.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields\n\nIn check_synth_field(), when a synthetic event field is a stacktrace\n(field->is_stack) and the histogram field is not a \"long[\" stacktrace\narray, validation falls through to the generic size and signedness\ncomparison.\n\nBecause parse_synth_field() sets a stacktrace field's type to\n\"__data_loc unsigned long[]\", its size is sizeof(u64) and\nsynth_field_signed() marks it as signed. Consequently, any 8-byte\nsigned scalar histogram field passes the fallback check, and its scalar\nvalue is subsequently dereferenced as a kernel stacktrace pointer in\nget_field_size() and trace_stack().\n\nFurthermore, checking strstr(hist_field->type, \"long[\") is insufficient\nbecause tracepoint fields defined with __bitmask() or __rel_bitmask()\nalso have type \"__data_loc unsigned long[]\" or \"__rel_loc unsigned\nlong[]\", whilst create_hist_field() treats them as 4-byte scalar values\nwithout HIST_FIELD_FL_STACKTRACE.\n\nPropagate HIST_FIELD_FL_STACKTRACE to variable references and field\nvariables (whilst excluding variable aliases from per-element\nstacktrace capture), and reject any mismatch between\nHIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field()."}], "id": "CVE-2026-99163", "lastModified": "2026-10-31T13:17:58.123", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-28T11:17:36.613", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1f36e4ddd05d540f363dbaa4c23042549f15b3ef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/326c45c9e201e3ff4c9e9e0e14c2c91364d6c8be"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/648687f2b448d8527cd7b112fe5d4bd0fec85a87"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6c4e4946febb585d2fc93a02a0cd12cec715bb32"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7e0d05a6234a984ac23b8a563fb7f66f2572b668"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a244c241593b5b38a08f0df2cb43c26574efbdcb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/deb336ae7c7b341591a6862cf6fcfeca97c77dfd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eba0a6365a0f38f7598a02fc7f9ee341c7efe7f5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via improper field validation in synthetic event tracing", "id": "2562662", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562662"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-843", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields\nIn check_synth_field(), when a synthetic event field is a stacktrace\n(field->is_stack) and the histogram field is not a \"long[\" stacktrace\narray, validation falls through to the generic size and signedness\ncomparison.\nBecause parse_synth_field() sets a stacktrace field's type to\n\"__data_loc unsigned long[]\", its size is sizeof(u64) and\nsynth_field_signed() marks it as signed. Consequently, any 8-byte\nsigned scalar histogram field passes the fallback check, and its scalar\nvalue is subsequently dereferenced as a kernel stacktrace pointer in\nget_field_size() and trace_stack().\nFurthermore, checking strstr(hist_field->type, \"long[\") is insufficient\nbecause tracepoint fields defined with __bitmask() or __rel_bitmask()\nalso have type \"__data_loc unsigned long[]\" or \"__rel_loc unsigned\nlong[]\", whilst create_hist_field() treats them as 4-byte scalar values\nwithout HIST_FIELD_FL_STACKTRACE.\nPropagate HIST_FIELD_FL_STACKTRACE to variable references and field\nvariables (whilst excluding variable aliases from per-element\nstacktrace capture), and reject any mismatch between\nHIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field().", "A flaw was found in the Linux kernel's tracing subsystem. This vulnerability allows a local user with tracing privileges to cause a Denial of Service (DoS) or potentially corrupt kernel memory by creating synthetic events with mismatched field types. Due to improper type validation, the kernel incorrectly treats numerical scalar values as memory pointers and dereferences them."], "name": "CVE-2026-99163", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-10-28T10:35:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99163\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99163\nhttps://git.kernel.org/stable/c/1f36e4ddd05d540f363dbaa4c23042549f15b3ef\nhttps://git.kernel.org/stable/c/a244c241593b5b38a08f0df2cb43c26574efbdcb\nhttps://git.kernel.org/stable/c/deb336ae7c7b341591a6862cf6fcfeca97c77dfd"], "statement": "This vulnerability is rated as Moderate because exploitation requires local access with elevated tracing privileges, limiting the threat to administrative users capable of configuring kernel synthetic events. Under default configurations in Red Hat Enterprise Linux, access to the tracefs interface is restricted to privileged accounts. While an authorized user could trigger an invalid pointer dereference leading to a kernel crash, unprivileged local accounts cannot reach the vulnerable functionality.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00cf3d672a9dd409418647e9f98784c339c3ff63,1f36e4ddd05d540f363dbaa4c23042549f15b3ef)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00cf3d672a9dd409418647e9f98784c339c3ff63,deb336ae7c7b341591a6862cf6fcfeca97c77dfd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00cf3d672a9dd409418647e9f98784c339c3ff63,a244c241593b5b38a08f0df2cb43c26574efbdcb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b9453380c1c542fd095a4dbe9251eeba4022bbce,b9453380c1c542fd095a4dbe9251eeba4022bbce]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f52389bdd9eafb63b3a2f804e02aeb17b6a5f55,5f52389bdd9eafb63b3a2f804e02aeb17b6a5f55]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f3baa42afeea0d5f04ad31525e861199d02210cc,f3baa42afeea0d5f04ad31525e861199d02210cc]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.237,5.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.124,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.43,6.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.3,6.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00cf3d672a9dd409418647e9f98784c339c3ff63,1f36e4ddd05d540f363dbaa4c23042549f15b3ef)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00cf3d672a9dd409418647e9f98784c339c3ff63,deb336ae7c7b341591a6862cf6fcfeca97c77dfd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00cf3d672a9dd409418647e9f98784c339c3ff63,a244c241593b5b38a08f0df2cb43c26574efbdcb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b9453380c1c542fd095a4dbe9251eeba4022bbce,b9453380c1c542fd095a4dbe9251eeba4022bbce]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5f52389bdd9eafb63b3a2f804e02aeb17b6a5f55,5f52389bdd9eafb63b3a2f804e02aeb17b6a5f55]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f3baa42afeea0d5f04ad31525e861199d02210cc,f3baa42afeea0d5f04ad31525e861199d02210cc]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.237,5.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.124,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.43,6.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.3,6.3]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T13:15:18.081249+00:00", "updated": "2026-11-10T08:45:16.537582+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-20", "CWE-843"]}