CVE-2026-99246

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99246", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.403Z", "datePublished": "2026-11-03T11:18:25.838Z", "dateUpdated": "2026-11-03T19:14:37.365Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-03T19:14:37.365Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: protect node reset trace dump with node lock\n\nThe tipc_node_reset_links trace event asks tipc_node_dump() to walk the\nnode's link entries. Unlike the other node events that request link data,\nthis event runs without the node lock.\n\nThis permits bearer teardown to free a link while the trace callback is\ndumping it:\n\n CPU 0 CPU 1\n trace_tipc_node_reset_links()\n tipc_node_dump()\n l = n->links[0].link\n tipc_node_write_lock()\n kfree(l)\n n->links[0].link = NULL\n tipc_node_write_unlock()\n tipc_link_dump(l)\n\ntipc_link_dump() then dereferences the stale pointer. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in tipc_link_dump\n Read of size 4 by task poc/115\n Call Trace:\n tipc_link_dump+0x10cb/0x16b0\n tipc_node_dump+0x4bb/0x740\n trace_event_raw_event_tipc_node_class+0x258/0x360\n tipc_node_reset_links+0x14d/0x1a0\n tipc_rcv+0x13f5/0x3030\n tipc_udp_recv+0x4e3/0x670\n Allocated by task 0:\n tipc_link_create+0x1e1/0x1020\n tipc_node_check_dest+0x7d2/0x11a0\n tipc_disc_rcv+0xdbf/0x1430\n Freed by task 89:\n kfree+0x131/0x3c0\n tipc_node_link_down+0x267/0x4b0\n tipc_node_delete_links+0xec/0x160\n bearer_disable+0x107/0x260\n\nTake the node write lock around the trace event. This serializes the\ndump against tipc_node_link_down(delete=true), which frees the link\nunder the same write lock."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - A TIPC-over-UDP datagram (default port 6118) is received by tipc_udp_recv() and handed to tipc_rcv(); a non-sequential broadcast skb takes tipc_node_bc_rcv() and a LINK_PROTOCOL skb takes tipc_node_bc_sync_rcv(), both calling tipc_node_reset_links() on TIPC_LINK_DOWN_EVT. CONFIG_TIPC_MEDIA_UDP defaults to y, so the trigger is a routable IP packet.\nAC:H - The UAF is the lockless trace_tipc_node_reset_links() dump in tipc_node_reset_links() racing kfree of n->links[].link in tipc_node_link_down(delete=true). That delete=true path is only tipc_node_delete_links() from bearer_disable()/tipc_reset_bearer(), which a remote UDP peer cannot invoke, and the dump runs only if the tipc_node_reset_links tracepoint is already enabled.\nPR:N - tipc_disc_rcv() accepts LINK_CONFIG discovery from any UDP source whose net_id matches (default 4711) with no credentials; TIPC_CRYPTO keys are optional. After tipc_node_check_dest() creates the node/link, that same unauthenticated peer\u2019s broadcast or LINK_PROTOCOL packets reach tipc_node_reset_links().\nUI:N - Once a TIPC UDP bearer is already enabled, tipc_udp_recv() processes the attacker\u2019s packets in softirq; no victim mount, click, or other interactive step is required at exploit time.\nS:U - The use-after-free is of a host-kernel tipc_link object inside tipc_node_dump()/tipc_link_dump(); impact stays in the same kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - KASAN reported a 4-byte read of a freed tipc_link in tipc_link_dump() from the stale n->links[0].link loaded by tipc_node_dump(); reclaiming that kmalloc object lets the dump read leftover or attacker-sprayed heap, including skb_peek() of transmq/deferdq heads.\nI:H - After bearer_disable() kfree()s the tipc_link, the stale pointer in tipc_node_dump() is a slab UAF: spraying a replacement object lets tipc_link_dump() follow attacker-chosen list pointers via skb_peek(), which is an exploitable kernel write/control-flow primitive.\nA:H - tipc_link_dump() dereference of the freed tipc_link oopses the kernel, matching the reported KASAN slab-use-after-free in the tipc_rcv() path; each overlapping packet and bearer teardown can repeat the crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/node.c"], "versions": [{"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "lessThan": "c8b72ca0918e95f708f67c8b3e69b05290f2b6d2", "status": "affected", "versionType": "git"}, {"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "lessThan": "6e492cb98ca69cc1145175e23e22e3b84da7f26d", "status": "affected", "versionType": "git"}, {"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "lessThan": "7bb6a35bd6d69019539d8782fb590fd2aa8a3236", "status": "affected", "versionType": "git"}, {"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "lessThan": "6abd93d01b0f495f29201925a5ee8e6a583c4044", "status": "affected", "versionType": "git"}, {"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "lessThan": "a6101d62ccfa153db8c218ce59362b8e0316fd4f", "status": "affected", "versionType": "git"}, {"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "lessThan": "b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b", "status": "affected", "versionType": "git"}, {"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "lessThan": "fa8c78c0e49aa11fae116fd841e41aa8f2d68751", "status": "affected", "versionType": "git"}, {"version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "lessThan": "dddf197f29ba5e47a476dde82bf542ca2e0d5e5e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/tipc/node.c"], "versions": [{"version": "5.0", "status": "affected"}, {"version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2"}, {"url": "https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d"}, {"url": "https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236"}, {"url": "https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044"}, {"url": "https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f"}, {"url": "https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b"}, {"url": "https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751"}, {"url": "https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e"}], "title": "tipc: protect node reset trace dump with node lock", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/tipc/node.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c8b72ca0918e95f708f67c8b3e69b05290f2b6d2", "status": "affected", "version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "versionType": "git"}, {"lessThan": "6e492cb98ca69cc1145175e23e22e3b84da7f26d", "status": "affected", "version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "versionType": "git"}, {"lessThan": "7bb6a35bd6d69019539d8782fb590fd2aa8a3236", "status": "affected", "version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "versionType": "git"}, {"lessThan": "6abd93d01b0f495f29201925a5ee8e6a583c4044", "status": "affected", "version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "versionType": "git"}, {"lessThan": "a6101d62ccfa153db8c218ce59362b8e0316fd4f", "status": "affected", "version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "versionType": "git"}, {"lessThan": "b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b", "status": "affected", "version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "versionType": "git"}, {"lessThan": "fa8c78c0e49aa11fae116fd841e41aa8f2d68751", "status": "affected", "version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "versionType": "git"}, {"lessThan": "dddf197f29ba5e47a476dde82bf542ca2e0d5e5e", "status": "affected", "version": "eb18a510b5cd4daeb9736ad8db57a9fc49db185b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/tipc/node.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: protect node reset trace dump with node lock\n\nThe tipc_node_reset_links trace event asks tipc_node_dump() to walk the\nnode's link entries. Unlike the other node events that request link data,\nthis event runs without the node lock.\n\nThis permits bearer teardown to free a link while the trace callback is\ndumping it:\n\n CPU 0 CPU 1\n trace_tipc_node_reset_links()\n tipc_node_dump()\n l = n->links[0].link\n tipc_node_write_lock()\n kfree(l)\n n->links[0].link = NULL\n tipc_node_write_unlock()\n tipc_link_dump(l)\n\ntipc_link_dump() then dereferences the stale pointer. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in tipc_link_dump\n Read of size 4 by task poc/115\n Call Trace:\n tipc_link_dump+0x10cb/0x16b0\n tipc_node_dump+0x4bb/0x740\n trace_event_raw_event_tipc_node_class+0x258/0x360\n tipc_node_reset_links+0x14d/0x1a0\n tipc_rcv+0x13f5/0x3030\n tipc_udp_recv+0x4e3/0x670\n Allocated by task 0:\n tipc_link_create+0x1e1/0x1020\n tipc_node_check_dest+0x7d2/0x11a0\n tipc_disc_rcv+0xdbf/0x1430\n Freed by task 89:\n kfree+0x131/0x3c0\n tipc_node_link_down+0x267/0x4b0\n tipc_node_delete_links+0xec/0x160\n bearer_disable+0x107/0x260\n\nTake the node write lock around the trace event. This serializes the\ndump against tipc_node_link_down(delete=true), which frees the link\nunder the same write lock."}], "id": "CVE-2026-99246", "lastModified": "2026-11-03T20:18:31.013", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-11-03T12:17:31.030", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Arbitrary code execution via use-after-free in TIPC subsystem", "id": "2566154", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566154"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem. A race condition occurs when tracing link reset events without proper locking, which can cause link data to be freed while it is actively being accessed. An unauthenticated remote attacker could exploit this use-after-free vulnerability by sending network traffic that triggers link resets during connection teardown. Successful exploitation could lead to arbitrary code execution or a Denial of Service (DoS) through a system crash."], "name": "CVE-2026-99246", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-03T11:18:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99246\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99246\nhttps://git.kernel.org/stable/c/6abd93d01b0f495f29201925a5ee8e6a583c4044\nhttps://git.kernel.org/stable/c/6e492cb98ca69cc1145175e23e22e3b84da7f26d\nhttps://git.kernel.org/stable/c/7bb6a35bd6d69019539d8782fb590fd2aa8a3236\nhttps://git.kernel.org/stable/c/a6101d62ccfa153db8c218ce59362b8e0316fd4f\nhttps://git.kernel.org/stable/c/b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b\nhttps://git.kernel.org/stable/c/c8b72ca0918e95f708f67c8b3e69b05290f2b6d2\nhttps://git.kernel.org/stable/c/dddf197f29ba5e47a476dde82bf542ca2e0d5e5e\nhttps://git.kernel.org/stable/c/fa8c78c0e49aa11fae116fd841e41aa8f2d68751"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,c8b72ca0918e95f708f67c8b3e69b05290f2b6d2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,6e492cb98ca69cc1145175e23e22e3b84da7f26d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,7bb6a35bd6d69019539d8782fb590fd2aa8a3236)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,6abd93d01b0f495f29201925a5ee8e6a583c4044)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,a6101d62ccfa153db8c218ce59362b8e0316fd4f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,fa8c78c0e49aa11fae116fd841e41aa8f2d68751)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,dddf197f29ba5e47a476dde82bf542ca2e0d5e5e)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.273,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.224,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.191,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.161,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.115,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.59,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.13,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,c8b72ca0918e95f708f67c8b3e69b05290f2b6d2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,6e492cb98ca69cc1145175e23e22e3b84da7f26d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,7bb6a35bd6d69019539d8782fb590fd2aa8a3236)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,6abd93d01b0f495f29201925a5ee8e6a583c4044)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,a6101d62ccfa153db8c218ce59362b8e0316fd4f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,b8b7d28dc2b7472ffd1eff3954c38f1976b21a7b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,fa8c78c0e49aa11fae116fd841e41aa8f2d68751)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eb18a510b5cd4daeb9736ad8db57a9fc49db185b,dddf197f29ba5e47a476dde82bf542ca2e0d5e5e)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.273,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.224,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.191,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.161,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.115,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.59,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.13,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-03T13:45:13.903309+00:00", "updated": "2026-11-05T04:00:15.840041+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}