huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-43116: kernel: netfilter: ctnetlink: ensure safe access to master conntrack
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the `netfilter: ctnetlink` component of the Linux kernel. This vulnerability occurs due to insufficient locking when accessing the master conntrack object, allowing it to become invalid while still being referenced. A local attacker could potentially exploit this race condition, leading to a system crash and a denial of service.

Statement: ctnetlink expectation handling could keep a reference to the expectation object while the associated master conntrack object was freed concurrently. This leaves exp master as a stale pointer and can let get, delete, or event reporting paths access master conntrack state after it has gone away. For the CVSS the PR:L is used in the paranoid score because some deployments delegate CAP_NET_ADMIN or conntrack management inside network namespaces or containers to less privileged local users. The issue is not directly network reachable as a remote packet only attack, although traffic and conntrack activity can help create the concurrent state needed for the race. In the paranoid case, the stale master conntrack pointer is treated as a use after free candidate with possible confidentiality and integrity impact.

Affected upstream versions: 2.6.16
Fixed upstream versions: 0, 6.1.176, 6.12.94, 6.18.24, 6.19.14, 6.6.143, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9e1196d27ef496f404c76f7a9d03761142d991c4
CVE-2026-43125: kernel: dlm: validate length in dlm_search_rsb_tree
Component: kernel
Severity: Important
CWE: CWE-130 (Improper Handling of Length Parameter Inconsistency)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel's Distributed Lock Manager (dlm) module. An attacker could send specially crafted network messages with an oversized length parameter to the dlm_dump_rsb_name() function. This lack of validation can lead to an out-of-bounds write in the dlm_search_rsb_tree() function, potentially causing a buffer overflow. This vulnerability could allow for denial of service or, in some cases, arbitrary code execution.


Affected upstream versions: 3.4
Fixed upstream versions: 0, 6.12.75, 6.18.16, 6.19.6, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 67288113c5e6cf9e659b4065c0ed6f16100e0c71
CVE-2026-43128: kernel: RDMA/umem: Fix double dma_buf_unpin in failure path
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel's RDMA/umem subsystem. A memory management error, specifically a double unpin of a `dma_buf`, can occur in a failure path during `dma_buf` pinning operations. This vulnerability could lead to system instability or a crash, resulting in a Denial of Service (DoS).

Statement: RDMA pinned dmabuf setup can hit a failure path where ib_umem_dmabuf_map_pages fails after the dmabuf has been marked pinned. The old error path immediately called dma_buf_unpin but left the pinned state set, so the later ib_umem_release and revoke path could call dma_buf_unpin again on the same attachment. The issue is not network reachable by itself and is triggered through local RDMA memory registration paths. Impact is at least local denial of service via crash or corrupted pin state and in the worst case may allow confidentiality or integrity impact due to a dma buf lifetime imbalance and possible memory corruption.

Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.165, 6.12.75, 6.18.16, 6.19.6, 6.6.128, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 70542b69abff34d24b11ae0bb200cc7a766d18df
CVE-2026-43158: kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks
Component: kernel
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel's XFS filesystem. When adding extended attributes (xattrs), which are metadata associated with files, to leaf blocks, incorrect adjustments to the freemap can occur. This inconsistency allows the entries array and free space to overlap, leading to an assertion failure. A local user can exploit this to cause the filesystem to shut down, resulting in a Denial of Service (DoS).

Statement: A local user with the ability to set extended attributes on an XFS filesystem can trigger inconsistent xattr leaf freemap accounting through crafted xattr insertion patterns. This can cause xattr metadata regions to overlap, leading to filesystem corruption detection and XFS shutdown via a reachable assertion. The issue requires the creation of a specific filesystem metadata layout through repeated setxattr operations.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.252, 5.15.202, 6.1.165, 6.12.75, 6.18.16, 6.19.6, 6.6.128, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d08976725355b9d54d8332fce223fa281cc304a5
CVE-2026-43163: kernel: md/bitmap: fix GPF in write_page caused by resize race
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel's md/bitmap component. This vulnerability involves a use-after-free race condition that occurs during array resize operations. When the `bitmap_daemon_work()` and `__bitmap_resize()` functions execute concurrently, they can access memory pages that have already been freed. This can lead to a General Protection Fault (GPF), which causes the system to crash, resulting in a denial of service.


Affected upstream versions: 3.5
Fixed upstream versions: 0, 5.10.252, 5.15.202, 6.1.165, 6.12.75, 6.18.16, 6.19.6, 6.6.128, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 140cc839fbeb1ddb33a8da8811b716d88d3905b7
CVE-2026-43190: kernel: netfilter: xt_tcpmss: check remaining length before reading optlen
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel, specifically within the netfilter: xt_tcpmss module. A remote attacker could exploit this vulnerability by sending a specially crafted TCP packet. The TCP option parser does not properly validate the remaining option length, which results in an out-of-bounds read. This allows an attacker to access memory beyond the intended buffer, potentially leading to information disclosure.

Statement: xt_tcpmss can read one byte past the TCP option boundary when the last option byte is not EOL or NOP. The parser may evaluate op i plus 1 while i is already the final byte of the option area, so a crafted TCP packet can trigger an out of bounds read in the netfilter match path. If the attacker can send packets through a ruleset that uses the tcpmss match, then it can trigger this bug. The issue is network reachable only on systems with an applicable xt_tcpmss or iptables rule, and it is not a generic TCP stack exposure. Impact is primarily limited confidentiality risk from a one byte out of bounds read and possible low availability impact.

Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.252, 5.15.202, 6.1.165, 6.12.75, 6.18.16, 6.19.6, 6.6.128, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f895191dc32c53eaf443b6443fe40945b2f92287
CVE-2026-43198: kernel: tcp: fix potential race in tcp_v6_syn_recv_sock()
Component: kernel
Severity: Important
CWE: CWE-821 (Incorrect Synchronization)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel. A race condition exists in the TCP (Transmission Control Protocol) IPv6 (Internet Protocol version 6) socket handling, specifically within the tcp_v6_syn_recv_sock() function. This occurs because a child socket becomes visible in the TCP hash table before its IPv6-specific information is fully initialized. A remote attacker could potentially exploit this timing window, leading to an unstable system state or unexpected behavior, which may result in a denial of service (DoS).


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 6.18.16, 6.19.6, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fe89b2f05b854847784f91127319172945c1fadd
CVE-2026-43205: kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel dpaa2-switch driver. This out-of-bounds write vulnerability occurs because the driver does not validate the num_ifs value reported by the firmware against the DPSW_MAX_IF limit. A highly privileged attacker, capable of influencing the DPAA2 firmware or management complex attributes, could exploit this to trigger kernel memory corruption through flood configuration handling.

Statement: A flaw in the Linux kernel dpaa2-switch driver allows an out-of-bounds write when a firmware-reported num_ifs value is not validated against DPSW_MAX_IF. A highly privileged attacker able to influence the DPAA2 firmware or management complex attributes could trigger kernel memory corruption through flood configuration handling. For the CVSS the PR:H is used because the vulnerable value originates from firmware/device attributes rather than from an unprivileged local or remote user-controlled input.

Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.202, 6.1.165, 6.12.75, 6.18.16, 6.19.6, 6.6.128, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a26dda3bae469c8e4e1b1993ad33dafa32d0fc28
CVE-2026-43260: kernel: bnxt_en: Fix RSS context delete logic
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the bnxt_en driver of the Linux kernel. An issue in the RSS (Receive Side Scaling) context deletion logic can lead to a leak of VNICs (Virtual Network Interface Controllers) in the firmware. This can cause subsequent attempts to create new VNICs to fail, resulting in the loss of active RSS contexts. This vulnerability could lead to a Denial of Service (DoS) for network operations.


Affected upstream versions: 6.11
Fixed upstream versions: 0, 6.12.75, 6.18.16, 6.19.6, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 348a5f8d06c7bdf954e13c17ad5f80b59a075604
CVE-2026-43276: kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path
Component: kernel
Severity: Moderate
CWE: CWE-1341 (Multiple Releases of Same Resource or Handle)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel's mana network driver. This vulnerability, a use-after-free, occurs when the PCI service rescan path attempts to destroy an already-freed workqueue a second time. A local attacker could exploit this condition to cause a system crash, leading to a denial of service.


Affected upstream versions: 6.16
Fixed upstream versions: 0, 6.18.16, 6.19.6, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fa3c2f8d9152344a478abb847081c1b5f84a94f5
CVE-2026-43279: kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2026-05-06T00:00:00+00:00

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) USB audio subsystem. An inconsistency in how USB audio playback and capture streams are handled can lead to an out-of-bounds write to a memory buffer. This can result in a system crash, causing a denial of service for a local user.

Statement: ALSA USB audio could write past the silent URB transfer buffer when implicit feedback stream sizing was inconsistent, causing a constrained kernel buffer overwrite with likely crash/DoS impact. Exploitation requires a specific USB audio device/configuration.

Affected upstream versions: 3.5
Fixed upstream versions: 0, 5.15.202, 6.1.165, 6.12.75, 6.18.16, 6.19.6, 6.6.128, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f
CVE-2026-43284: kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel
Component: kernel
Severity: Important
CWE: CWE-123 (Write-what-where Condition)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-07T00:00:00+00:00

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The xfrm-ESP variant requires unprivileged user or network namespace creation, while the RxRPC variant depends on the rxrpc module being available on the target system.

Statement: This issue is classified as Important, rather than Critical severity, because exploitation requires local access to the system. A low-privileged local attacker can exploit this flaw in the Linux kernel's xfrm-ESP and RxRPC subsystems to gain root privileges by overwriting sensitive system files. Exploitation does not require user interaction, potentially resulting in full compromise of confidentiality, integrity, and availability.

Affected upstream versions: 4.11
Fixed upstream versions: 0, 5.10.255, 5.15.205, 5.15.206, 6.1.171, 6.1.172, 6.12.87, 6.18.28, 6.6.138, 7.0.5, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a6cb440f274a22456ef3e86b457344f1678f38f9
CVE-2026-43303: kernel: mm/page_alloc: clear page->private in free_pages_prepare()
Component: kernel
Severity: Moderate
CWE: CWE-909 (Missing Initialization of Resource)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-08T00:00:00+00:00

A flaw was found in the Linux kernel's memory management subsystem. When pages are freed, the page->private field is not properly cleared. If these pages are later reallocated as high-order pages and split, the tail pages can retain stale page->private values. This can lead to a use-after-free vulnerability in the swap subsystem, where incorrect assumptions about the page->private value can cause the system to crash.

Statement: A stale page private value can remain on freed pages and later survive allocation as a high-order page followed by split_page. The swap subsystem assumes newly allocated pages have page private set to zero and may treat the stale value as a valid swap count continuation, leading to traversal of poisoned or invalid list state and a UAF style wild memory access in the swapoff path. For the CVSS the PR:L is used for the paranoid case because a local user may be able to influence allocator state and page reuse even though the direct crash trace involves swapoff. The issue is not network reachable. Impact is at least local denial of service via kernel crash, and in worst case may allow confidentiality or integrity impact due to core memory management corruption.

Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.176, 6.12.93, 6.18.16, 6.19.6, 6.6.143, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e7790ab165713b79b1617ce659742ceb3a859d05
CVE-2026-43322: kernel: Bluetooth: hci_sync: Fix UAF in le_read_features_complete
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-08T00:00:00+00:00

A flaw was found in the Bluetooth Host Controller Interface (HCI) synchronization module (`hci_sync`) of the Linux kernel. A use-after-free (UAF) vulnerability exists in the `le_read_features_complete` function, where a freed `hci_conn` object is accessed. This can allow an attacker to cause a system crash, leading to a denial of service.


Affected upstream versions: 6.19
Fixed upstream versions: 0, 6.19.12, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 260dc2be643b4a35b27008490c533613e3e53867
CVE-2026-43329: kernel: netfilter: flowtable: strictly check for maximum number of actions
Component: kernel
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-08T00:00:00+00:00

A flaw was found in the Netfilter flowtable component of the Linux kernel. This vulnerability occurs because the system does not strictly check the maximum number of hardware offload actions for IPv6, allowing it to process more actions than supported. This could potentially lead to system instability or a denial of service (DoS) condition, where the affected system becomes unresponsive.


Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.15.203, 6.1.168, 6.12.81, 6.18.22, 6.19.12, 6.6.134, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ead66c77303f760f6c30be96e2e20d5a77cef614
CVE-2026-43330: kernel: crypto: caam - fix overflow on long hmac keys
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-08T00:00:00+00:00

A flaw was found in the Linux kernel's caam cryptographic accelerator driver. When processing a Hash-based Message Authentication Code (HMAC) key that exceeds the block size, the driver incorrectly handles memory allocation and copying. This can lead to an overflow, where the system attempts to read beyond the intended memory buffer, potentially corrupting neighboring memory. This memory corruption could lead to system instability or denial of service.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.12.81, 6.18.22, 6.19.12, 6.6.134, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 31022cfde5235c45fa765f0aabeff5f0652852f2
CVE-2026-43341: kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2026-05-08T00:00:00+00:00

A flaw was found in the Linux kernel's IPv6 In-situ Operations, Administration, and Maintenance (IOAM6) trace fill functionality. An integer overflow vulnerability exists in the `ioam6_fill_trace_data()` function, where the schema length calculation can wrap around due to being stored in an 8-bit unsigned integer. This bypasses buffer size checks, leading to a buffer overflow that can result in a denial of service or other memory corruption issues.

Statement: An IPv6 IOAM trace buffer overflow can occur because the schema length contribution is stored in an 8 bit value. With bit 22 enabled and the largest schema payload, sclen wraps from 256 to 0, bypassing the remaining space check while the code still copies the schema header and payload past the trace buffer. The issue is network reachable, although practical exposure is usually limited to IOAM enabled domains or trusted IPv6 networks rather than the public Internet. Impact is kernel memory corruption through an out of bounds write and may cause denial of service or in worst case confidentiality and integrity impact. For the Red Hat Enterprise Linux before 10 is not actual, because not introduced yet (the Fixes patch 8c6f6fa6772696be0c047a711858084b38763728 not applied yet).

Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.210, 6.1.168, 6.12.81, 6.18.22, 6.19.12, 6.6.134, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d3a1fb2ca323d7a4e10ab3afbfa25e6d8921e4f2
CVE-2026-43414: kernel: scsi: qla2xxx: Completely fix fcport double free
Component: kernel
Severity: Moderate
CWE: CWE-1341 (Multiple Releases of Same Resource or Handle)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-08T00:00:00+00:00

A flaw was found in the Linux kernel's `qla2xxx` SCSI driver. An issue exists where a Fibre Channel port (fcport) object can be freed twice due to an error in the `qla2x00_els_dcmd_sp_free()` function. This double free vulnerability can lead to memory corruption, potentially causing system instability or a denial of service.


Affected upstream versions: 5.15.154 < 5.16, 6.1.84 < 6.2, 6.6.24 < 6.7, 6.7.12 < 6.8, 6.8.3 < 6.9, 6.9
Fixed upstream versions: 0, 5.16, 6.19.9, 6.2, 6.7, 6.8, 6.9, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d48ea85463f5b34f7b92ea0a13eddf1ab993da7b
CVE-2026-43450: kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-05-08T00:00:00+00:00

A flaw was found in the Linux kernel's `nfnetlink_cthelper` component. This vulnerability, an out-of-bounds read, occurs in the `nfnl_cthelper_dump_table()` function when a network connection tracking helper is removed during a dump operation, leading to a bypassed bounds check. A local attacker could exploit this to cause a system crash (denial of service) or potentially access sensitive information from kernel memory.


Affected upstream versions: 3.6
Fixed upstream versions: 0, 5.10.253, 5.15.203, 6.1.167, 6.12.78, 6.18.19, 6.19.9, 6.6.130, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0605e1985a95d4334a67869aee45a47e82301abf
CVE-2026-43499: kernel: rtmutex: Use waiter::task instead of current in remove_waiter()
Component: kernel
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-21T00:00:00+00:00

A flaw was found in the Linux kernel. When the kernel's real-time mutex (rtmutex) component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' (UAF) vulnerability, where the system attempts to use memory that has already been released. A local attacker could potentially exploit this to gain elevated privileges or execute unauthorized code.


Affected upstream versions: 2.6.39
Fixed upstream versions: 0, 5.10.261, 5.15.212, 6.1.175, 6.12.86, 6.18.27, 6.6.140, 7.0.4, 7.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f3fa3424bceb128d2be4b3745506b22844b87db7